diff --git a/.buildkite/ftr_configs.yml b/.buildkite/ftr_configs.yml index 83408d2121c56..f581c21901ebd 100644 --- a/.buildkite/ftr_configs.yml +++ b/.buildkite/ftr_configs.yml @@ -159,6 +159,7 @@ enabled: - x-pack/test/examples/config.ts - x-pack/test/fleet_api_integration/config.ts - x-pack/test/fleet_functional/config.ts + - x-pack/test/ftr_apis/security_and_spaces/config.ts - x-pack/test/functional_basic/config.ts - x-pack/test/functional_cors/config.ts - x-pack/test/functional_embedded/config.ts diff --git a/.buildkite/pipelines/scalability/daily.yml b/.buildkite/pipelines/scalability/daily.yml index 8529a2f36b4de..d88c6c00e7383 100644 --- a/.buildkite/pipelines/scalability/daily.yml +++ b/.buildkite/pipelines/scalability/daily.yml @@ -12,6 +12,10 @@ steps: agents: queue: kb-static-scalability timeout_in_minutes: 90 + retry: + automatic: + - exit_status: '*' + limit: 1 - wait: ~ continue_on_failure: true diff --git a/.buildkite/scripts/steps/artifacts/docker_image.sh b/.buildkite/scripts/steps/artifacts/docker_image.sh index 6be490eef2c47..079ab3be7b054 100755 --- a/.buildkite/scripts/steps/artifacts/docker_image.sh +++ b/.buildkite/scripts/steps/artifacts/docker_image.sh @@ -54,6 +54,16 @@ echo "--- Push manifest" docker manifest push "$KIBANA_IMAGE" docker logout docker.elastic.co +cat << EOF | buildkite-agent annotate --style "info" --context image + ### Container Images + + Manifest: \`$KIBANA_IMAGE\` + + AMD64: \`$KIBANA_IMAGE-amd64\` + + ARM64: \`$KIBANA_IMAGE-arm64\` +EOF + echo "--- Build dependencies report" node scripts/licenses_csv_report "--csv=target/dependencies-$GIT_ABBREV_COMMIT.csv" diff --git a/.ci/Dockerfile b/.ci/Dockerfile index 4f5236c733bc3..6eddcd2060922 100644 --- a/.ci/Dockerfile +++ b/.ci/Dockerfile @@ -1,7 +1,7 @@ # NOTE: This Dockerfile is ONLY used to run certain tasks in CI. It is not used to run Kibana or as a distributable. # If you're looking for the Kibana Docker image distributable, please see: src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.ts -ARG NODE_VERSION=18.13.0 +ARG NODE_VERSION=16.19.0 FROM node:${NODE_VERSION} AS base diff --git a/.node-version b/.node-version index d939939b25962..e65243f2ea379 100644 --- a/.node-version +++ b/.node-version @@ -1 +1 @@ -18.13.0 +16.19.0 diff --git a/.nvmrc b/.nvmrc index d939939b25962..e65243f2ea379 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -18.13.0 +16.19.0 diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel index 2e0916692591a..f097ad8152a59 100644 --- a/WORKSPACE.bazel +++ b/WORKSPACE.bazel @@ -22,13 +22,13 @@ load("@build_bazel_rules_nodejs//:index.bzl", "node_repositories", "yarn_install # Setup the Node.js toolchain for the architectures we want to support node_repositories( node_repositories = { - "18.13.0-darwin_amd64": ("node-v18.13.0-darwin-x64.tar.gz", "node-v18.13.0-darwin-x64", "8b57c4da4ff6cca19d5ef7953f8816e3406d1508a2e4ee7f997984b3b1d11b77"), - "18.13.0-darwin_arm64": ("node-v18.13.0-darwin-arm64.tar.gz", "node-v18.13.0-darwin-arm64", "418d535e64dbcbd628715180c2de4ffcecb8a84b81f233c60e6ab9f0d795c249"), - "18.13.0-linux_arm64": ("node-v18.13.0-linux-arm64.tar.xz", "node-v18.13.0-linux-arm64", "5b338667822341d1ea3b18d5b37d442a655829b9eafdc5f9008f00b8451ac148"), - "18.13.0-linux_amd64": ("node-v18.13.0-linux-x64.tar.xz", "node-v18.13.0-linux-x64", "7f5d6922a91986ef059ba8a4396aa435440adacfe6fc6fab60a857c8f2cf5e7a"), - "18.13.0-windows_amd64": ("node-v18.13.0-win-x64.zip", "node-v18.13.0-win-x64", "29c99ad1167ddbd72f2b15e91b560e36ac785b1873ba6791ab50d9d62f1957e2"), + "16.19.0-darwin_amd64": ("node-v16.19.0-darwin-x64.tar.gz", "node-v16.19.0-darwin-x64", "491e5a5592eca1961dcbb1fae28567428ce56ce9cc7977b04041e163e0c1670c"), + "16.19.0-darwin_arm64": ("node-v16.19.0-darwin-arm64.tar.gz", "node-v16.19.0-darwin-arm64", "5c9434fbb0f323fecf3d261b23a2e544919380c5043d0046d9745682fefd9cde"), + "16.19.0-linux_arm64": ("node-v16.19.0-linux-arm64.tar.xz", "node-v16.19.0-linux-arm64", "9072c995052f832678fe8fab18e960bd9853f30e481787e53f8dd1ec8aaa3bb6"), + "16.19.0-linux_amd64": ("node-v16.19.0-linux-x64.tar.xz", "node-v16.19.0-linux-x64", "c88b52497ab38a3ddf526e5b46a41270320409109c3f74171b241132984fd08f"), + "16.19.0-windows_amd64": ("node-v16.19.0-win-x64.zip", "node-v16.19.0-win-x64", "534ca7a24e999c81cec847a498cc43d47e2bb158f6edf639e5297f2718350e96"), }, - node_version = "18.13.0", + node_version = "16.19.0", node_urls = [ "https://nodejs.org/dist/v{version}/{filename}", ], diff --git a/api_docs/actions.mdx b/api_docs/actions.mdx index 5af6f4bc32d27..2b5de2a9e3c9e 100644 --- a/api_docs/actions.mdx +++ b/api_docs/actions.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/actions title: "actions" image: https://source.unsplash.com/400x175/?github description: API docs for the actions plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'actions'] --- import actionsObj from './actions.devdocs.json'; diff --git a/api_docs/advanced_settings.mdx b/api_docs/advanced_settings.mdx index b959b3c28eb54..230ecce49d683 100644 --- a/api_docs/advanced_settings.mdx +++ b/api_docs/advanced_settings.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/advancedSettings title: "advancedSettings" image: https://source.unsplash.com/400x175/?github description: API docs for the advancedSettings plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'advancedSettings'] --- import advancedSettingsObj from './advanced_settings.devdocs.json'; diff --git a/api_docs/aiops.mdx b/api_docs/aiops.mdx index 63d37dc999326..e704437b831c8 100644 --- a/api_docs/aiops.mdx +++ b/api_docs/aiops.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/aiops title: "aiops" image: https://source.unsplash.com/400x175/?github description: API docs for the aiops plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'aiops'] --- import aiopsObj from './aiops.devdocs.json'; diff --git a/api_docs/alerting.mdx b/api_docs/alerting.mdx index 5f517105b65f1..15fae82e3d87e 100644 --- a/api_docs/alerting.mdx +++ b/api_docs/alerting.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/alerting title: "alerting" image: https://source.unsplash.com/400x175/?github description: API docs for the alerting plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'alerting'] --- import alertingObj from './alerting.devdocs.json'; diff --git a/api_docs/apm.devdocs.json b/api_docs/apm.devdocs.json index e4bdaa18a4266..4fc59e2c641db 100644 --- a/api_docs/apm.devdocs.json +++ b/api_docs/apm.devdocs.json @@ -920,6 +920,10 @@ }, ">]>; }>, ", "PartialC", + "<{ offset: ", + "StringC", + "; }>, ", + "PartialC", "<{ transactionType: ", "StringC", "; }>]>; }>, ", diff --git a/api_docs/apm.mdx b/api_docs/apm.mdx index 76cb793134ae6..ab1ba8a79751c 100644 --- a/api_docs/apm.mdx +++ b/api_docs/apm.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/apm title: "apm" image: https://source.unsplash.com/400x175/?github description: API docs for the apm plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'apm'] --- import apmObj from './apm.devdocs.json'; diff --git a/api_docs/banners.mdx b/api_docs/banners.mdx index d96f0d1e71ff0..0e8d9ddbc5849 100644 --- a/api_docs/banners.mdx +++ b/api_docs/banners.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/banners title: "banners" image: https://source.unsplash.com/400x175/?github description: API docs for the banners plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'banners'] --- import bannersObj from './banners.devdocs.json'; diff --git a/api_docs/bfetch.mdx b/api_docs/bfetch.mdx index 30deb966dde64..22d8137b26567 100644 --- a/api_docs/bfetch.mdx +++ b/api_docs/bfetch.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/bfetch title: "bfetch" image: https://source.unsplash.com/400x175/?github description: API docs for the bfetch plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'bfetch'] --- import bfetchObj from './bfetch.devdocs.json'; diff --git a/api_docs/canvas.mdx b/api_docs/canvas.mdx index 49597d58d3bdc..5999b8f6e13ee 100644 --- a/api_docs/canvas.mdx +++ b/api_docs/canvas.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/canvas title: "canvas" image: https://source.unsplash.com/400x175/?github description: API docs for the canvas plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'canvas'] --- import canvasObj from './canvas.devdocs.json'; diff --git a/api_docs/cases.devdocs.json b/api_docs/cases.devdocs.json index 86e97f6cd258e..cbeaef4fdcb10 100644 --- a/api_docs/cases.devdocs.json +++ b/api_docs/cases.devdocs.json @@ -872,7 +872,7 @@ }, " | undefined; severity?: ", "CaseSeverity", - " | undefined; assignees?: string | string[] | undefined; reporters?: string | string[] | undefined; defaultSearchOperator?: \"AND\" | \"OR\" | undefined; fields?: string | string[] | undefined; from?: string | undefined; page?: number | undefined; perPage?: number | undefined; search?: string | undefined; searchFields?: string | string[] | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; to?: string | undefined; owner?: string | string[] | undefined; }, signal?: AbortSignal | undefined) => Promise<", + " | undefined; assignees?: string | string[] | undefined; reporters?: string | string[] | undefined; defaultSearchOperator?: \"AND\" | \"OR\" | undefined; fields?: string | string[] | undefined; from?: string | undefined; page?: number | undefined; perPage?: number | undefined; search?: string | undefined; searchFields?: string | string[] | undefined; rootSearchFields?: string[] | undefined; sortField?: string | undefined; sortOrder?: \"asc\" | \"desc\" | undefined; to?: string | undefined; owner?: string | string[] | undefined; }, signal?: AbortSignal | undefined) => Promise<", "Cases", ">; getCasesStatus: (query: { from?: string | undefined; to?: string | undefined; owner?: string | string[] | undefined; }, signal?: AbortSignal | undefined) => Promise<{ countOpenCases: number; countInProgressCases: number; countClosedCases: number; }>; getCasesMetrics: (query: { features: string[]; } & { from?: string | undefined; to?: string | undefined; owner?: string | string[] | undefined; }, signal?: AbortSignal | undefined) => Promise<{ mttr?: number | null | undefined; }>; }; }" ], diff --git a/api_docs/cases.mdx b/api_docs/cases.mdx index 9b6b16e48821f..7b47f4649afd4 100644 --- a/api_docs/cases.mdx +++ b/api_docs/cases.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cases title: "cases" image: https://source.unsplash.com/400x175/?github description: API docs for the cases plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cases'] --- import casesObj from './cases.devdocs.json'; diff --git a/api_docs/charts.devdocs.json b/api_docs/charts.devdocs.json index 1feebcea52e15..95753867fedab 100644 --- a/api_docs/charts.devdocs.json +++ b/api_docs/charts.devdocs.json @@ -1309,6 +1309,56 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "charts", + "id": "def-public.MultiClickTriggerEvent", + "type": "Interface", + "tags": [], + "label": "MultiClickTriggerEvent", + "description": [], + "path": "src/plugins/charts/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "charts", + "id": "def-public.MultiClickTriggerEvent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "signature": [ + "\"multiFilter\"" + ], + "path": "src/plugins/charts/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "charts", + "id": "def-public.MultiClickTriggerEvent.data", + "type": "Object", + "tags": [], + "label": "data", + "description": [], + "signature": [ + "{ data: { table: Pick<", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + }, + ", \"rows\" | \"columns\">; column: number; value: any[]; }; timeFieldName?: string | undefined; negate?: boolean | undefined; }" + ], + "path": "src/plugins/charts/public/index.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "charts", "id": "def-public.RawColorSchema", diff --git a/api_docs/charts.mdx b/api_docs/charts.mdx index 27d8c02de9712..385bc6788116b 100644 --- a/api_docs/charts.mdx +++ b/api_docs/charts.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/charts title: "charts" image: https://source.unsplash.com/400x175/?github description: API docs for the charts plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'charts'] --- import chartsObj from './charts.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualization | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 267 | 16 | 252 | 9 | +| 270 | 16 | 255 | 9 | ## Client diff --git a/api_docs/cloud.mdx b/api_docs/cloud.mdx index 9afb82f5b3a82..3ccf2d039efb8 100644 --- a/api_docs/cloud.mdx +++ b/api_docs/cloud.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloud title: "cloud" image: https://source.unsplash.com/400x175/?github description: API docs for the cloud plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloud'] --- import cloudObj from './cloud.devdocs.json'; diff --git a/api_docs/cloud_chat.mdx b/api_docs/cloud_chat.mdx index 86b0adf6e8c9b..e119a1e9d54f4 100644 --- a/api_docs/cloud_chat.mdx +++ b/api_docs/cloud_chat.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudChat title: "cloudChat" image: https://source.unsplash.com/400x175/?github description: API docs for the cloudChat plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudChat'] --- import cloudChatObj from './cloud_chat.devdocs.json'; diff --git a/api_docs/cloud_data_migration.mdx b/api_docs/cloud_data_migration.mdx index 996490eb633e1..49083c11254a2 100644 --- a/api_docs/cloud_data_migration.mdx +++ b/api_docs/cloud_data_migration.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDataMigration title: "cloudDataMigration" image: https://source.unsplash.com/400x175/?github description: API docs for the cloudDataMigration plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDataMigration'] --- import cloudDataMigrationObj from './cloud_data_migration.devdocs.json'; diff --git a/api_docs/cloud_defend.mdx b/api_docs/cloud_defend.mdx index 5ee2a651a1234..9a0cc0e7bf27e 100644 --- a/api_docs/cloud_defend.mdx +++ b/api_docs/cloud_defend.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudDefend title: "cloudDefend" image: https://source.unsplash.com/400x175/?github description: API docs for the cloudDefend plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudDefend'] --- import cloudDefendObj from './cloud_defend.devdocs.json'; diff --git a/api_docs/cloud_experiments.mdx b/api_docs/cloud_experiments.mdx index 3375fa1a35d2f..28872b884bb58 100644 --- a/api_docs/cloud_experiments.mdx +++ b/api_docs/cloud_experiments.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudExperiments title: "cloudExperiments" image: https://source.unsplash.com/400x175/?github description: API docs for the cloudExperiments plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudExperiments'] --- import cloudExperimentsObj from './cloud_experiments.devdocs.json'; diff --git a/api_docs/cloud_security_posture.mdx b/api_docs/cloud_security_posture.mdx index a013c776d0f01..deb048bb62efc 100644 --- a/api_docs/cloud_security_posture.mdx +++ b/api_docs/cloud_security_posture.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/cloudSecurityPosture title: "cloudSecurityPosture" image: https://source.unsplash.com/400x175/?github description: API docs for the cloudSecurityPosture plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'cloudSecurityPosture'] --- import cloudSecurityPostureObj from './cloud_security_posture.devdocs.json'; diff --git a/api_docs/console.mdx b/api_docs/console.mdx index a1dbb3b029ba4..33aa6301ba518 100644 --- a/api_docs/console.mdx +++ b/api_docs/console.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/console title: "console" image: https://source.unsplash.com/400x175/?github description: API docs for the console plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'console'] --- import consoleObj from './console.devdocs.json'; diff --git a/api_docs/controls.mdx b/api_docs/controls.mdx index 31476cd710f52..b09c9768f076a 100644 --- a/api_docs/controls.mdx +++ b/api_docs/controls.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/controls title: "controls" image: https://source.unsplash.com/400x175/?github description: API docs for the controls plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'controls'] --- import controlsObj from './controls.devdocs.json'; diff --git a/api_docs/core.devdocs.json b/api_docs/core.devdocs.json index 13efb1d24be0c..f9e75a566a99a 100644 --- a/api_docs/core.devdocs.json +++ b/api_docs/core.devdocs.json @@ -20904,14 +20904,6 @@ "plugin": "@kbn/core-saved-objects-browser-mocks", "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, { "plugin": "@kbn/core-saved-objects-server", "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" @@ -20924,210 +20916,6 @@ "plugin": "@kbn/core-saved-objects-server", "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" @@ -21136,70 +20924,6 @@ "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" - }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" @@ -21208,138 +20932,6 @@ "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" @@ -21380,102 +20972,6 @@ "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, { "plugin": "apm", "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" @@ -21668,70 +21164,6 @@ "plugin": "data", "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, { "plugin": "cases", "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" @@ -21780,42 +21212,6 @@ "plugin": "synthetics", "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, { "plugin": "cases", "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" @@ -21860,42 +21256,6 @@ "plugin": "cases", "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, { "plugin": "@kbn/core-saved-objects-browser-internal", "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" @@ -21917,156 +21277,16 @@ "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { "plugin": "@kbn/core-ui-settings-server-internal", @@ -22079,126 +21299,6 @@ { "plugin": "@kbn/core-ui-settings-server-internal", "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" } ], "initialIsOpen": false @@ -22265,30 +21365,6 @@ { "plugin": "visualizations", "path": "src/plugins/visualizations/public/utils/saved_visualization_references/saved_visualization_references.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" } ], "initialIsOpen": false @@ -22658,22 +21734,6 @@ "plugin": "ml", "path": "x-pack/plugins/ml/common/types/modules.ts" }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, { "plugin": "dashboard", "path": "src/plugins/dashboard/public/services/dashboard_saved_object/lib/save_dashboard_state_to_saved_object.ts" @@ -22681,14 +21741,6 @@ { "plugin": "dashboard", "path": "src/plugins/dashboard/public/services/dashboard_saved_object/lib/save_dashboard_state_to_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" } ], "initialIsOpen": false @@ -23117,22 +22169,6 @@ "plugin": "savedObjectsTaggingOss", "path": "src/plugins/saved_objects_tagging_oss/public/decorator/inject_tag_references.test.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, { "plugin": "kibanaUtils", "path": "src/plugins/kibana_utils/common/persistable_state/types.ts" @@ -23673,38 +22709,6 @@ "plugin": "data", "path": "src/plugins/data/common/search/search_source/inject_references.test.ts" }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, { "plugin": "lens", "path": "x-pack/plugins/lens/common/locator/locator.ts" @@ -23726,64 +22730,76 @@ "path": "x-pack/plugins/lens/public/app_plugin/share_action.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/types.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/tx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/tx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_read.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_read.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_write.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_write.ts" + }, + { + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + }, + { + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" } ], "initialIsOpen": false @@ -28809,21 +27825,14 @@ { "parentPluginId": "core", "id": "def-server.AddAuditEventParams.outcome", - "type": "CompoundType", + "type": "string", "tags": [], "label": "outcome", "description": [ "\nThe outcome of the operation\n'failure' | 'success' | 'unknown'" ], "signature": [ - { - "pluginId": "@kbn/ecs", - "scope": "common", - "docId": "kibKbnEcsPluginApi", - "section": "def-common.EcsEventOutcome", - "text": "EcsEventOutcome" - }, - " | undefined" + "string | undefined" ], "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts", "deprecated": false, @@ -34239,6 +33248,438 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent", + "type": "Interface", + "tags": [], + "label": "EcsEvent", + "description": [ + "\nThe event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events." + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.action", + "type": "string", + "tags": [], + "label": "action", + "description": [ + "\nThe action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.agent_id_status", + "type": "string", + "tags": [], + "label": "agent_id_status", + "description": [ + "\nAgents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation.\nFor example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used.\nIf no validation is performed then the field should be omitted.\nThe allowed values are:\n`verified` - The `agent.id` field value matches expected value obtained from auth metadata.\n`mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata.\n`missing` - There was no `agent.id` field in the event to validate.\n`auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.category", + "type": "Array", + "tags": [], + "label": "category", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.code", + "type": "string", + "tags": [], + "label": "code", + "description": [ + "\nIdentification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.created", + "type": "string", + "tags": [], + "label": "created", + "description": [ + "\nevent.created contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, @timestamp should be used." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.dataset", + "type": "string", + "tags": [], + "label": "dataset", + "description": [ + "\nName of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.duration", + "type": "number", + "tags": [], + "label": "duration", + "description": [ + "\nDuration of the event in nanoseconds.\nIf event.start and event.end are known this value should be the difference between the end and start time." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.end", + "type": "string", + "tags": [], + "label": "end", + "description": [ + "\nevent.end contains the date when the event ended or when the activity was last observed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.hash", + "type": "string", + "tags": [], + "label": "hash", + "description": [ + "\nHash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique ID to describe the event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.ingested", + "type": "string", + "tags": [], + "label": "ingested", + "description": [ + "\nTimestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.kind", + "type": "string", + "tags": [], + "label": "kind", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.module", + "type": "string", + "tags": [], + "label": "module", + "description": [ + "\nName of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.original", + "type": "string", + "tags": [], + "label": "original", + "description": [ + "\nRaw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex.\nThis field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.outcome", + "type": "string", + "tags": [], + "label": "outcome", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.provider", + "type": "string", + "tags": [], + "label": "provider", + "description": [ + "\nSource of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.reason", + "type": "string", + "tags": [], + "label": "reason", + "description": [ + "\nReason why this event happened, according to the source.\nThis describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.reference", + "type": "string", + "tags": [], + "label": "reference", + "description": [ + "\nReference URL linking to additional information about this event.\nThis URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.risk_score", + "type": "number", + "tags": [], + "label": "risk_score", + "description": [ + "\nRisk score or priority of the event (e.g. security solutions). Use your system's original value here." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.risk_score_norm", + "type": "number", + "tags": [], + "label": "risk_score_norm", + "description": [ + "\nNormalized risk score or priority of the event, on a scale of 0 to 100.\nThis is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.sequence", + "type": "number", + "tags": [], + "label": "sequence", + "description": [ + "\nSequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.severity", + "type": "number", + "tags": [], + "label": "severity", + "description": [ + "\nThe numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.start", + "type": "string", + "tags": [], + "label": "start", + "description": [ + "\nevent.start contains the date when the event started or when the activity was first observed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.timezone", + "type": "string", + "tags": [], + "label": "timezone", + "description": [ + "\nThis field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise.\nAcceptable timezone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\")." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.type", + "type": "Array", + "tags": [], + "label": "type", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "core", + "id": "def-server.EcsEvent.url", + "type": "string", + "tags": [], + "label": "url", + "description": [ + "\nURL linking to an external system to continue investigation of this event.\nThis URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "core", "id": "def-server.ElasticsearchClientConfig", @@ -54679,6 +54120,30 @@ { "plugin": "savedSearch", "path": "src/plugins/saved_search/server/saved_objects/search_migrations.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" + }, + { + "plugin": "@kbn/core-saved-objects-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" + }, + { + "plugin": "@kbn/core-saved-objects-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" } ], "children": [ @@ -66876,146 +66341,322 @@ "type": "Type", "tags": [], "label": "Ecs", - "description": [ - "\nRepresents the full ECS schema.\n" - ], + "description": [], "signature": [ - "EcsBase", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsBase", + "text": "EcsBase" + }, " & ", - "EcsTracing", - " & { ecs: EcsField; agent?: ", - "EcsAgent", - " | undefined; as?: ", - "EcsAutonomousSystem", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTracing", + "text": "EcsTracing" + }, + " & { agent?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsAgent", + "text": "EcsAgent" + }, " | undefined; client?: ", - "EcsClient", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsClient", + "text": "EcsClient" + }, " | undefined; cloud?: ", - "EcsCloud", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsCloud", + "text": "EcsCloud" + }, " | undefined; container?: ", - "EcsContainer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsContainer", + "text": "EcsContainer" + }, " | undefined; data_stream?: ", - "EcsDataStream", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDataStream", + "text": "EcsDataStream" + }, " | undefined; destination?: ", - "EcsDestination", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDestination", + "text": "EcsDestination" + }, + " | undefined; device?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDevice", + "text": "EcsDevice" + }, + " | undefined; dll?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDll", + "text": "EcsDll" + }, " | undefined; dns?: ", - "EcsDns", - " | undefined; email?: ", - "EcsEmail", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDns", + "text": "EcsDns" + }, + " | undefined; ecs: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEcs", + "text": "EcsEcs" + }, + "; email?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEmail", + "text": "EcsEmail" + }, " | undefined; error?: ", - "EcsError", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsError", + "text": "EcsError" + }, " | undefined; event?: ", - "EcsEvent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEvent", + "text": "EcsEvent" + }, " | undefined; faas?: ", - "EcsFaas", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsFaas", + "text": "EcsFaas" + }, " | undefined; file?: ", - "EcsFile", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsFile", + "text": "EcsFile" + }, " | undefined; group?: ", - "EcsGroup", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsGroup", + "text": "EcsGroup" + }, " | undefined; host?: ", - "EcsHost", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHost", + "text": "EcsHost" + }, " | undefined; http?: ", - "EcsHttp", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHttp", + "text": "EcsHttp" + }, " | undefined; log?: ", - "EcsLog", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsLog", + "text": "EcsLog" + }, " | undefined; network?: ", - "EcsNetwork", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsNetwork", + "text": "EcsNetwork" + }, " | undefined; observer?: ", - "EcsObserver", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsObserver", + "text": "EcsObserver" + }, " | undefined; orchestrator?: ", - "EcsOrchestrator", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsOrchestrator", + "text": "EcsOrchestrator" + }, " | undefined; organization?: ", - "EcsOrganization", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsOrganization", + "text": "EcsOrganization" + }, " | undefined; package?: ", - "EcsPackage", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsPackage", + "text": "EcsPackage" + }, " | undefined; process?: ", - "EcsProcess", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsProcess", + "text": "EcsProcess" + }, " | undefined; registry?: ", - "EcsRegistry", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRegistry", + "text": "EcsRegistry" + }, " | undefined; related?: ", - "EcsRelated", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRelated", + "text": "EcsRelated" + }, " | undefined; rule?: ", - "EcsRule", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRule", + "text": "EcsRule" + }, " | undefined; server?: ", - "EcsServer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsServer", + "text": "EcsServer" + }, " | undefined; service?: ", - "EcsService", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsService", + "text": "EcsService" + }, " | undefined; source?: ", - "EcsSource", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsSource", + "text": "EcsSource" + }, " | undefined; threat?: ", - "EcsThreat", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsThreat", + "text": "EcsThreat" + }, " | undefined; tls?: ", - "EcsTls", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTls", + "text": "EcsTls" + }, " | undefined; url?: ", - "EcsUrl", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUrl", + "text": "EcsUrl" + }, " | undefined; user?: ", - "EcsUser", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUser", + "text": "EcsUser" + }, " | undefined; user_agent?: ", - "EcsUserAgent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUserAgent", + "text": "EcsUserAgent" + }, " | undefined; vulnerability?: ", - "EcsVulnerability", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsVulnerability", + "text": "EcsVulnerability" + }, " | undefined; }" ], - "path": "packages/kbn-ecs/src/ecs/index.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "core", - "id": "def-server.EcsEventCategory", - "type": "Type", - "tags": [], - "label": "EcsEventCategory", - "description": [], - "signature": [ - "\"host\" | \"database\" | \"email\" | \"package\" | \"network\" | \"web\" | \"file\" | \"session\" | \"registry\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\"" - ], - "path": "packages/kbn-ecs/src/ecs/event.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "core", - "id": "def-server.EcsEventKind", - "type": "Type", - "tags": [], - "label": "EcsEventKind", - "description": [], - "signature": [ - "\"metric\" | \"alert\" | \"signal\" | \"state\" | \"event\" | \"pipeline_error\"" - ], - "path": "packages/kbn-ecs/src/ecs/event.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "core", - "id": "def-server.EcsEventOutcome", - "type": "Type", - "tags": [], - "label": "EcsEventOutcome", - "description": [], - "signature": [ - "\"success\" | \"unknown\" | \"failure\"" - ], - "path": "packages/kbn-ecs/src/ecs/event.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "core", - "id": "def-server.EcsEventType", - "type": "Type", - "tags": [], - "label": "EcsEventType", - "description": [], - "signature": [ - "\"start\" | \"error\" | \"connection\" | \"user\" | \"info\" | \"group\" | \"end\" | \"admin\" | \"protocol\" | \"access\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\"" - ], - "path": "packages/kbn-ecs/src/ecs/event.ts", + "path": "packages/kbn-ecs/generated/index.ts", "deprecated": false, "trackAdoption": false, "initialIsOpen": false @@ -69055,71 +68696,269 @@ ], "signature": [ "Omit<", - "EcsBase", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsBase", + "text": "EcsBase" + }, ", \"message\" | \"@timestamp\"> & ", - "EcsTracing", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTracing", + "text": "EcsTracing" + }, " & { agent?: ", - "EcsAgent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsAgent", + "text": "EcsAgent" + }, " | undefined; as?: ", - "EcsAutonomousSystem", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsAs", + "text": "EcsAs" + }, " | undefined; client?: ", - "EcsClient", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsClient", + "text": "EcsClient" + }, " | undefined; cloud?: ", - "EcsCloud", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsCloud", + "text": "EcsCloud" + }, " | undefined; container?: ", - "EcsContainer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsContainer", + "text": "EcsContainer" + }, " | undefined; destination?: ", - "EcsDestination", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDestination", + "text": "EcsDestination" + }, " | undefined; dns?: ", - "EcsDns", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDns", + "text": "EcsDns" + }, " | undefined; error?: ", - "EcsError", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsError", + "text": "EcsError" + }, " | undefined; event?: ", - "EcsEvent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEvent", + "text": "EcsEvent" + }, " | undefined; file?: ", - "EcsFile", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsFile", + "text": "EcsFile" + }, " | undefined; group?: ", - "EcsGroup", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsGroup", + "text": "EcsGroup" + }, " | undefined; host?: ", - "EcsHost", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHost", + "text": "EcsHost" + }, " | undefined; http?: ", - "EcsHttp", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHttp", + "text": "EcsHttp" + }, " | undefined; log?: Omit<", - "EcsLog", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsLog", + "text": "EcsLog" + }, ", \"logger\" | \"level\"> | undefined; network?: ", - "EcsNetwork", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsNetwork", + "text": "EcsNetwork" + }, " | undefined; observer?: ", - "EcsObserver", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsObserver", + "text": "EcsObserver" + }, " | undefined; organization?: ", - "EcsOrganization", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsOrganization", + "text": "EcsOrganization" + }, " | undefined; package?: ", - "EcsPackage", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsPackage", + "text": "EcsPackage" + }, " | undefined; process?: ", - "EcsProcess", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsProcess", + "text": "EcsProcess" + }, " | undefined; registry?: ", - "EcsRegistry", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRegistry", + "text": "EcsRegistry" + }, " | undefined; related?: ", - "EcsRelated", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRelated", + "text": "EcsRelated" + }, " | undefined; rule?: ", - "EcsRule", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRule", + "text": "EcsRule" + }, " | undefined; server?: ", - "EcsServer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsServer", + "text": "EcsServer" + }, " | undefined; service?: ", - "EcsService", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsService", + "text": "EcsService" + }, " | undefined; source?: ", - "EcsSource", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsSource", + "text": "EcsSource" + }, " | undefined; threat?: ", - "EcsThreat", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsThreat", + "text": "EcsThreat" + }, " | undefined; tls?: ", - "EcsTls", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTls", + "text": "EcsTls" + }, " | undefined; url?: ", - "EcsUrl", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUrl", + "text": "EcsUrl" + }, " | undefined; user?: ", - "EcsUser", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUser", + "text": "EcsUser" + }, " | undefined; user_agent?: ", - "EcsUserAgent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUserAgent", + "text": "EcsUserAgent" + }, " | undefined; vulnerability?: ", - "EcsVulnerability", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsVulnerability", + "text": "EcsVulnerability" + }, " | undefined; }" ], "path": "packages/kbn-logging/src/log_meta.ts", diff --git a/api_docs/core.mdx b/api_docs/core.mdx index 91e0e52480418..a2c23e8830527 100644 --- a/api_docs/core.mdx +++ b/api_docs/core.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/core title: "core" image: https://source.unsplash.com/400x175/?github description: API docs for the core plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'core'] --- import coreObj from './core.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) for que | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 2810 | 17 | 1018 | 0 | +| 2833 | 17 | 1015 | 0 | ## Client diff --git a/api_docs/custom_integrations.mdx b/api_docs/custom_integrations.mdx index 9b6af9cc6cb91..b01f3a6b7e918 100644 --- a/api_docs/custom_integrations.mdx +++ b/api_docs/custom_integrations.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/customIntegrations title: "customIntegrations" image: https://source.unsplash.com/400x175/?github description: API docs for the customIntegrations plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'customIntegrations'] --- import customIntegrationsObj from './custom_integrations.devdocs.json'; diff --git a/api_docs/dashboard.mdx b/api_docs/dashboard.mdx index feec23729aeeb..ae9c5c1e7b1bb 100644 --- a/api_docs/dashboard.mdx +++ b/api_docs/dashboard.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboard title: "dashboard" image: https://source.unsplash.com/400x175/?github description: API docs for the dashboard plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboard'] --- import dashboardObj from './dashboard.devdocs.json'; diff --git a/api_docs/dashboard_enhanced.mdx b/api_docs/dashboard_enhanced.mdx index bcb2b88e7bf2d..61e59d5e1f25f 100644 --- a/api_docs/dashboard_enhanced.mdx +++ b/api_docs/dashboard_enhanced.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dashboardEnhanced title: "dashboardEnhanced" image: https://source.unsplash.com/400x175/?github description: API docs for the dashboardEnhanced plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dashboardEnhanced'] --- import dashboardEnhancedObj from './dashboard_enhanced.devdocs.json'; diff --git a/api_docs/data.devdocs.json b/api_docs/data.devdocs.json index 2f9626f9c64d0..b8f5b5f037f20 100644 --- a/api_docs/data.devdocs.json +++ b/api_docs/data.devdocs.json @@ -10941,14 +10941,6 @@ "plugin": "@kbn/core-saved-objects-browser-mocks", "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, { "plugin": "@kbn/core-saved-objects-server", "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" @@ -10962,10044 +10954,1449 @@ "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "plugin": "core", + "path": "src/core/types/index.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "plugin": "apm", + "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_view.stub.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_view.stub.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.SerializedSearchSourceFields", + "type": "Type", + "tags": [], + "label": "SerializedSearchSourceFields", + "description": [], + "signature": [ + "{ type?: string | undefined; query?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.Query", + "text": "Query" }, + " | ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.AggregateQuery", + "text": "AggregateQuery" }, + " | undefined; filter?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.Filter", + "text": "Filter" }, + "[] | undefined; sort?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.EsQuerySortValue", + "text": "EsQuerySortValue" }, + "[] | undefined; highlight?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" }, + " | undefined; highlightAll?: boolean | undefined; trackTotalHits?: number | boolean | undefined; aggs?: { type: string; enabled?: boolean | undefined; id?: string | undefined; params?: {} | ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" }, + " | undefined; schema?: string | undefined; }[] | undefined; from?: number | undefined; size?: number | undefined; source?: boolean | ", + "Fields", + " | undefined; version?: boolean | undefined; fields?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.SearchFieldValue", + "text": "SearchFieldValue" }, + "[] | undefined; fieldsFromSource?: ", + "Fields", + " | undefined; index?: string | ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" }, + " | undefined; searchAfter?: ", + "SortResults", + " | undefined; timeout?: string | undefined; terminate_after?: number | undefined; parent?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.SerializedSearchSourceFields", + "text": "SerializedSearchSourceFields" }, + " | undefined; }" + ], + "path": "src/plugins/data/common/search/search_source/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.TypeMeta", + "type": "Type", + "tags": [], + "label": "TypeMeta", + "description": [ + "\nInterface for metadata about rollup indices" + ], + "signature": [ + "{ aggs?: Record | undefined; params?: { rollup_index: string; } | undefined; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + } + ], + "objects": [ + { + "parentPluginId": "data", + "id": "def-public.AggGroupLabels", + "type": "Object", + "tags": [], + "label": "AggGroupLabels", + "description": [], + "path": "src/plugins/data/common/search/aggs/agg_groups.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "parentPluginId": "data", + "id": "def-public.AggGroupLabels.AggGroupNames.Buckets", + "type": "Any", + "tags": [], + "label": "[AggGroupNames.Buckets]", + "description": [], + "signature": [ + "any" + ], + "path": "src/plugins/data/common/search/aggs/agg_groups.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "parentPluginId": "data", + "id": "def-public.AggGroupLabels.AggGroupNames.Metrics", + "type": "Any", + "tags": [], + "label": "[AggGroupNames.Metrics]", + "description": [], + "signature": [ + "any" + ], + "path": "src/plugins/data/common/search/aggs/agg_groups.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "parentPluginId": "data", + "id": "def-public.AggGroupLabels.AggGroupNames.None", + "type": "Any", + "tags": [], + "label": "[AggGroupNames.None]", + "description": [], + "signature": [ + "any" + ], + "path": "src/plugins/data/common/search/aggs/agg_groups.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.AggGroupNames", + "type": "Object", + "tags": [], + "label": "AggGroupNames", + "description": [], + "signature": [ + "{ readonly Buckets: \"buckets\"; readonly Metrics: \"metrics\"; readonly None: \"none\"; }" + ], + "path": "src/plugins/data/common/search/aggs/agg_groups.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.exporters", + "type": "Object", + "tags": [], + "label": "exporters", + "description": [], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.exporters.datatableToCSV", + "type": "Function", + "tags": [], + "label": "datatableToCSV", + "description": [], + "signature": [ + "({ columns, rows }: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + }, + ", { csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }: CSVOptions) => string" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.exporters.datatableToCSV.$1", + "type": "Object", + "tags": [], + "label": "__0", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + } + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.exporters.datatableToCSV.$2", + "type": "Object", + "tags": [], + "label": "__1", + "description": [], + "signature": [ + "CSVOptions" + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.exporters.CSV_MIME_TYPE", + "type": "string", + "tags": [], + "label": "CSV_MIME_TYPE", + "description": [], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.exporters.cellHasFormulas", + "type": "Function", + "tags": [], + "label": "cellHasFormulas", + "description": [], + "signature": [ + "(val: string) => boolean" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.exporters.cellHasFormulas.$1", + "type": "string", + "tags": [], + "label": "val", + "description": [], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, + "parentPluginId": "data", + "id": "def-public.exporters.tableHasFormulas", + "type": "Function", + "tags": [], + "label": "tableHasFormulas", + "description": [], + "signature": [ + "(columns: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + "[], rows: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableRow", + "text": "DatatableRow" + }, + "[]) => boolean" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.exporters.tableHasFormulas.$1", + "type": "Array", + "tags": [], + "label": "columns", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + "[]" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.exporters.tableHasFormulas.$2", + "type": "Array", + "tags": [], + "label": "rows", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableRow", + "text": "DatatableRow" + }, + "[]" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.indexPatterns", + "type": "Object", + "tags": [], + "label": "indexPatterns", + "description": [], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.ILLEGAL_CHARACTERS_KEY", + "type": "string", + "tags": [], + "label": "ILLEGAL_CHARACTERS_KEY", + "description": [], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.CONTAINS_SPACES_KEY", + "type": "string", + "tags": [], + "label": "CONTAINS_SPACES_KEY", + "description": [], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.ILLEGAL_CHARACTERS_VISIBLE", + "type": "Array", + "tags": [], + "label": "ILLEGAL_CHARACTERS_VISIBLE", + "description": [], + "signature": [ + "string[]" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.ILLEGAL_CHARACTERS", + "type": "Array", + "tags": [], + "label": "ILLEGAL_CHARACTERS", + "description": [], + "signature": [ + "string[]" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.isFilterable", + "type": "Function", + "tags": [], + "label": "isFilterable", + "description": [], + "signature": [ + "(field: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + ") => boolean" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.indexPatterns.isFilterable.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + } + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "core", - "path": "src/core/types/index.ts" - }, - { - "plugin": "apm", - "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.isNestedField", + "type": "Function", + "tags": [], + "label": "isNestedField", + "description": [], + "signature": [ + "(field: HasSubtype) => boolean" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.indexPatterns.isNestedField.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.isMultiField", + "type": "Function", + "tags": [], + "label": "isMultiField", + "description": [], + "signature": [ + "(field: HasSubtype) => boolean" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.indexPatterns.isMultiField.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.getFieldSubtypeMulti", + "type": "Function", + "tags": [], + "label": "getFieldSubtypeMulti", + "description": [], + "signature": [ + "(field: HasSubtype) => ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubTypeMulti", + "text": "IFieldSubTypeMulti" + }, + " | undefined" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.indexPatterns.getFieldSubtypeMulti.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" + "parentPluginId": "data", + "id": "def-public.indexPatterns.getFieldSubtypeNested", + "type": "Function", + "tags": [], + "label": "getFieldSubtypeNested", + "description": [], + "signature": [ + "(field: HasSubtype) => ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubTypeNested", + "text": "IFieldSubTypeNested" + }, + " | undefined" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.indexPatterns.getFieldSubtypeNested.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_view.stub.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_view.stub.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" - }, - { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" - }, - { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" - }, - { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.SerializedSearchSourceFields", - "type": "Type", - "tags": [], - "label": "SerializedSearchSourceFields", - "description": [], - "signature": [ - "{ type?: string | undefined; query?: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.Query", - "text": "Query" - }, - " | ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.AggregateQuery", - "text": "AggregateQuery" - }, - " | undefined; filter?: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.Filter", - "text": "Filter" - }, - "[] | undefined; sort?: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.EsQuerySortValue", - "text": "EsQuerySortValue" - }, - "[] | undefined; highlight?: ", - { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - " | undefined; highlightAll?: boolean | undefined; trackTotalHits?: number | boolean | undefined; aggs?: { type: string; enabled?: boolean | undefined; id?: string | undefined; params?: {} | ", - { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - " | undefined; schema?: string | undefined; }[] | undefined; from?: number | undefined; size?: number | undefined; source?: boolean | ", - "Fields", - " | undefined; version?: boolean | undefined; fields?: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.SearchFieldValue", - "text": "SearchFieldValue" - }, - "[] | undefined; fieldsFromSource?: ", - "Fields", - " | undefined; index?: string | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - " | undefined; searchAfter?: ", - "SortResults", - " | undefined; timeout?: string | undefined; terminate_after?: number | undefined; parent?: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.SerializedSearchSourceFields", - "text": "SerializedSearchSourceFields" - }, - " | undefined; }" - ], - "path": "src/plugins/data/common/search/search_source/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.TypeMeta", - "type": "Type", - "tags": [], - "label": "TypeMeta", - "description": [ - "\nInterface for metadata about rollup indices" - ], - "signature": [ - "{ aggs?: Record | undefined; params?: { rollup_index: string; } | undefined; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - } - ], - "objects": [ - { - "parentPluginId": "data", - "id": "def-public.AggGroupLabels", - "type": "Object", - "tags": [], - "label": "AggGroupLabels", - "description": [], - "path": "src/plugins/data/common/search/aggs/agg_groups.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.AggGroupLabels.AggGroupNames.Buckets", - "type": "Any", - "tags": [], - "label": "[AggGroupNames.Buckets]", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/common/search/aggs/agg_groups.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.AggGroupLabels.AggGroupNames.Metrics", - "type": "Any", - "tags": [], - "label": "[AggGroupNames.Metrics]", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/common/search/aggs/agg_groups.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.AggGroupLabels.AggGroupNames.None", - "type": "Any", - "tags": [], - "label": "[AggGroupNames.None]", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/common/search/aggs/agg_groups.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.AggGroupNames", - "type": "Object", - "tags": [], - "label": "AggGroupNames", - "description": [], - "signature": [ - "{ readonly Buckets: \"buckets\"; readonly Metrics: \"metrics\"; readonly None: \"none\"; }" - ], - "path": "src/plugins/data/common/search/aggs/agg_groups.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.exporters", - "type": "Object", - "tags": [], - "label": "exporters", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.exporters.datatableToCSV", - "type": "Function", - "tags": [], - "label": "datatableToCSV", - "description": [], - "signature": [ - "({ columns, rows }: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - }, - ", { csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }: CSVOptions) => string" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.exporters.datatableToCSV.$1", - "type": "Object", - "tags": [], - "label": "__0", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - } - ], - "path": "src/plugins/data/common/exports/export_csv.tsx", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.exporters.datatableToCSV.$2", - "type": "Object", - "tags": [], - "label": "__1", - "description": [], - "signature": [ - "CSVOptions" - ], - "path": "src/plugins/data/common/exports/export_csv.tsx", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.exporters.CSV_MIME_TYPE", - "type": "string", - "tags": [], - "label": "CSV_MIME_TYPE", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.exporters.cellHasFormulas", - "type": "Function", - "tags": [], - "label": "cellHasFormulas", - "description": [], - "signature": [ - "(val: string) => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.exporters.cellHasFormulas.$1", - "type": "string", - "tags": [], - "label": "val", - "description": [], - "path": "src/plugins/data/common/exports/formula_checks.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.exporters.tableHasFormulas", - "type": "Function", - "tags": [], - "label": "tableHasFormulas", - "description": [], - "signature": [ - "(columns: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - "[], rows: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableRow", - "text": "DatatableRow" - }, - "[]) => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.exporters.tableHasFormulas.$1", - "type": "Array", - "tags": [], - "label": "columns", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - "[]" - ], - "path": "src/plugins/data/common/exports/formula_checks.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.exporters.tableHasFormulas.$2", - "type": "Array", - "tags": [], - "label": "rows", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableRow", - "text": "DatatableRow" - }, - "[]" - ], - "path": "src/plugins/data/common/exports/formula_checks.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns", - "type": "Object", - "tags": [], - "label": "indexPatterns", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.ILLEGAL_CHARACTERS_KEY", - "type": "string", - "tags": [], - "label": "ILLEGAL_CHARACTERS_KEY", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.CONTAINS_SPACES_KEY", - "type": "string", - "tags": [], - "label": "CONTAINS_SPACES_KEY", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.ILLEGAL_CHARACTERS_VISIBLE", - "type": "Array", - "tags": [], - "label": "ILLEGAL_CHARACTERS_VISIBLE", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.ILLEGAL_CHARACTERS", - "type": "Array", - "tags": [], - "label": "ILLEGAL_CHARACTERS", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.isFilterable", - "type": "Function", - "tags": [], - "label": "isFilterable", - "description": [], - "signature": [ - "(field: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - ") => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.isFilterable.$1", - "type": "Object", - "tags": [], - "label": "field", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - } - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.isNestedField", - "type": "Function", - "tags": [], - "label": "isNestedField", - "description": [], - "signature": [ - "(field: HasSubtype) => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.isNestedField.$1", - "type": "Object", - "tags": [], - "label": "field", - "description": [], - "signature": [ - "{ subType?: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" - }, - " | undefined; }" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.isMultiField", - "type": "Function", - "tags": [], - "label": "isMultiField", - "description": [], - "signature": [ - "(field: HasSubtype) => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.isMultiField.$1", - "type": "Object", - "tags": [], - "label": "field", - "description": [], - "signature": [ - "{ subType?: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" - }, - " | undefined; }" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.getFieldSubtypeMulti", - "type": "Function", - "tags": [], - "label": "getFieldSubtypeMulti", - "description": [], - "signature": [ - "(field: HasSubtype) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubTypeMulti", - "text": "IFieldSubTypeMulti" - }, - " | undefined" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.getFieldSubtypeMulti.$1", - "type": "Object", - "tags": [], - "label": "field", - "description": [], - "signature": [ - "{ subType?: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" - }, - " | undefined; }" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.getFieldSubtypeNested", - "type": "Function", - "tags": [], - "label": "getFieldSubtypeNested", - "description": [], - "signature": [ - "(field: HasSubtype) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubTypeNested", - "text": "IFieldSubTypeNested" - }, - " | undefined" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.getFieldSubtypeNested.$1", - "type": "Object", - "tags": [], - "label": "field", - "description": [], - "signature": [ - "{ subType?: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" - }, - " | undefined; }" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.validate", - "type": "Function", - "tags": [], - "label": "validate", - "description": [], - "signature": [ - "(indexPattern: string) => { ILLEGAL_CHARACTERS?: string[] | undefined; CONTAINS_SPACES?: boolean | undefined; }" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.indexPatterns.validate.$1", - "type": "string", - "tags": [], - "label": "indexPattern", - "description": [], - "path": "src/plugins/data_views/common/lib/validate_data_view.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.search", - "type": "Object", - "tags": [], - "label": "search", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs", - "type": "Object", - "tags": [], - "label": "aggs", - "description": [], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.CidrMask", - "type": "Object", - "tags": [], - "label": "CidrMask", - "description": [], - "signature": [ - "typeof ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.CidrMask", - "text": "CidrMask" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.dateHistogramInterval", - "type": "Function", - "tags": [], - "label": "dateHistogramInterval", - "description": [], - "signature": [ - "(interval: string, shouldForceFixed?: boolean | undefined) => Interval" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.dateHistogramInterval.$1", - "type": "string", - "tags": [], - "label": "interval", - "description": [], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.dateHistogramInterval.$2", - "type": "CompoundType", - "tags": [], - "label": "shouldForceFixed", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.intervalOptions", - "type": "Array", - "tags": [], - "label": "intervalOptions", - "description": [], - "signature": [ - "({ display: any; val: string; enabled(agg: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IBucketAggConfig", - "text": "IBucketAggConfig" - }, - "): boolean; } | { display: any; val: string; })[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.InvalidEsCalendarIntervalError", - "type": "Object", - "tags": [], - "label": "InvalidEsCalendarIntervalError", - "description": [], - "signature": [ - "typeof ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.InvalidEsCalendarIntervalError", - "text": "InvalidEsCalendarIntervalError" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.InvalidEsIntervalFormatError", - "type": "Object", - "tags": [], - "label": "InvalidEsIntervalFormatError", - "description": [], - "signature": [ - "typeof ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.InvalidEsIntervalFormatError", - "text": "InvalidEsIntervalFormatError" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.IpAddress", - "type": "Object", - "tags": [], - "label": "IpAddress", - "description": [], - "signature": [ - "typeof ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IpAddress", - "text": "IpAddress" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isDateHistogramBucketAggConfig", - "type": "Function", - "tags": [], - "label": "isDateHistogramBucketAggConfig", - "description": [], - "signature": [ - "(agg: any) => agg is ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IBucketDateHistogramAggConfig", - "text": "IBucketDateHistogramAggConfig" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isDateHistogramBucketAggConfig.$1", - "type": "Any", - "tags": [], - "label": "agg", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/common/search/aggs/buckets/date_histogram.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isNumberType", - "type": "Function", - "tags": [], - "label": "isNumberType", - "description": [], - "signature": [ - "(agg: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - }, - ") => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isNumberType.$1", - "type": "Object", - "tags": [], - "label": "agg", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - } - ], - "path": "src/plugins/data/common/search/aggs/buckets/migrate_include_exclude_format.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isStringType", - "type": "Function", - "tags": [], - "label": "isStringType", - "description": [], - "signature": [ - "(agg: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - }, - ") => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isStringType.$1", - "type": "Object", - "tags": [], - "label": "agg", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - } - ], - "path": "src/plugins/data/common/search/aggs/buckets/migrate_include_exclude_format.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isType", - "type": "Function", - "tags": [], - "label": "isType", - "description": [], - "signature": [ - "(...types: string[]) => (agg: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - }, - ") => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isType.$1", - "type": "Array", - "tags": [], - "label": "types", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data/common/search/aggs/buckets/migrate_include_exclude_format.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isValidEsInterval", - "type": "Function", - "tags": [], - "label": "isValidEsInterval", - "description": [], - "signature": [ - "(interval: string) => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isValidEsInterval.$1", - "type": "string", - "tags": [], - "label": "interval", - "description": [], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/is_valid_es_interval.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isValidInterval", - "type": "Function", - "tags": [], - "label": "isValidInterval", - "description": [], - "signature": [ - "(value: string, baseInterval?: string | undefined) => boolean" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isValidInterval.$1", - "type": "string", - "tags": [], - "label": "value", - "description": [], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/is_valid_interval.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.isValidInterval.$2", - "type": "string", - "tags": [], - "label": "baseInterval", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/is_valid_interval.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.parentPipelineType", - "type": "Any", - "tags": [], - "label": "parentPipelineType", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.parseEsInterval", - "type": "Function", - "tags": [], - "label": "parseEsInterval", - "description": [], - "signature": [ - "(interval: string) => { value: number; unit: ", - { - "pluginId": "@kbn/datemath", - "scope": "common", - "docId": "kibKbnDatemathPluginApi", - "section": "def-common.Unit", - "text": "Unit" - }, - "; type: \"fixed\" | \"calendar\"; }" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.parseEsInterval.$1", - "type": "string", - "tags": [], - "label": "interval", - "description": [], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_es_interval.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.parseInterval", - "type": "Function", - "tags": [], - "label": "parseInterval", - "description": [], - "signature": [ - "(interval: string) => moment.Duration | null" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.parseInterval.$1", - "type": "string", - "tags": [], - "label": "interval", - "description": [], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_interval.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.propFilter", - "type": "Function", - "tags": [], - "label": "propFilter", - "description": [], - "signature": [ - "

(prop: P) => (list: T[], filters?: string | string[] | FilterFunc) => T[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.propFilter.$1", - "type": "Uncategorized", - "tags": [], - "label": "prop", - "description": [], - "signature": [ - "P" - ], - "path": "src/plugins/data/common/search/aggs/utils/prop_filter.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.siblingPipelineType", - "type": "Any", - "tags": [], - "label": "siblingPipelineType", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.termsAggFilter", - "type": "Array", - "tags": [], - "label": "termsAggFilter", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.toAbsoluteDates", - "type": "Function", - "tags": [], - "label": "toAbsoluteDates", - "description": [], - "signature": [ - "(range: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.TimeRange", - "text": "TimeRange" - }, - ") => { from: Date; to: Date; } | undefined" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.toAbsoluteDates.$1", - "type": "Object", - "tags": [], - "label": "range", - "description": [], - "signature": [ - "{ from: string; to: string; mode?: \"absolute\" | \"relative\" | undefined; }" - ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/to_absolute_dates.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.boundsDescendingRaw", - "type": "Array", - "tags": [], - "label": "boundsDescendingRaw", - "description": [], - "signature": [ - "({ bound: number; interval: moment.Duration; boundLabel: any; intervalLabel: any; } | { bound: moment.Duration; interval: moment.Duration; boundLabel: any; intervalLabel: any; })[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.calcAutoIntervalLessThan", - "type": "Function", - "tags": [], - "label": "calcAutoIntervalLessThan", - "description": [], - "signature": [ - "(maxBucketCount: number, duration: number) => moment.Duration" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.aggs.calcAutoIntervalLessThan.$1", - "type": "number", - "tags": [], - "label": "maxBucketCount", - "description": [], - "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.aggs.calcAutoIntervalLessThan.$2", - "type": "number", - "tags": [], - "label": "duration", - "description": [], - "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.getResponseInspectorStats", - "type": "Function", - "tags": [], - "label": "getResponseInspectorStats", - "description": [], - "signature": [ - "(resp?: ", - "SearchResponse", - "> | undefined, searchSource?: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.ISearchSource", - "text": "ISearchSource" - }, - " | undefined) => ", - { - "pluginId": "inspector", - "scope": "common", - "docId": "kibInspectorPluginApi", - "section": "def-common.RequestStatistics", - "text": "RequestStatistics" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.getResponseInspectorStats.$1", - "type": "Object", - "tags": [], - "label": "resp", - "description": [], - "signature": [ - "SearchResponse", - "> | undefined" - ], - "path": "src/plugins/data/common/search/search_source/inspect/inspector_stats.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.getResponseInspectorStats.$2", - "type": "Object", - "tags": [], - "label": "searchSource", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.ISearchSource", - "text": "ISearchSource" - }, - " | undefined" - ], - "path": "src/plugins/data/common/search/search_source/inspect/inspector_stats.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.tabifyAggResponse", - "type": "Function", - "tags": [], - "label": "tabifyAggResponse", - "description": [], - "signature": [ - "(aggConfigs: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfigs", - "text": "AggConfigs" - }, - ", esResponse: Record, respOpts?: Partial<", - "TabbedResponseWriterOptions", - "> | undefined) => ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - } - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.tabifyAggResponse.$1", - "type": "Object", - "tags": [], - "label": "aggConfigs", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfigs", - "text": "AggConfigs" - } - ], - "path": "src/plugins/data/common/search/tabify/tabify.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.tabifyAggResponse.$2", - "type": "Object", - "tags": [], - "label": "esResponse", - "description": [], - "signature": [ - "{ [x: string]: any; }" - ], - "path": "src/plugins/data/common/search/tabify/tabify.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.tabifyAggResponse.$3", - "type": "Object", - "tags": [], - "label": "respOpts", - "description": [], - "signature": [ - "Partial<", - "TabbedResponseWriterOptions", - "> | undefined" - ], - "path": "src/plugins/data/common/search/tabify/tabify.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.search.tabifyGetColumns", - "type": "Function", - "tags": [], - "label": "tabifyGetColumns", - "description": [], - "signature": [ - "(aggs: ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - }, - "[], minimalColumns: boolean) => ", - "TabbedAggColumn", - "[]" - ], - "path": "src/plugins/data/public/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-public.search.tabifyGetColumns.$1", - "type": "Array", - "tags": [], - "label": "aggs", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" - }, - "[]" - ], - "path": "src/plugins/data/common/search/tabify/get_columns.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.search.tabifyGetColumns.$2", - "type": "boolean", - "tags": [], - "label": "minimalColumns", - "description": [], - "path": "src/plugins/data/common/search/tabify/get_columns.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-public.UI_SETTINGS", - "type": "Object", - "tags": [], - "label": "UI_SETTINGS", - "description": [], - "signature": [ - "{ readonly META_FIELDS: \"metaFields\"; readonly DOC_HIGHLIGHT: \"doc_table:highlight\"; readonly QUERY_STRING_OPTIONS: \"query:queryString:options\"; readonly QUERY_ALLOW_LEADING_WILDCARDS: \"query:allowLeadingWildcards\"; readonly SEARCH_QUERY_LANGUAGE: \"search:queryLanguage\"; readonly SORT_OPTIONS: \"sort:options\"; readonly COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX: \"courier:ignoreFilterIfFieldNotInIndex\"; readonly COURIER_SET_REQUEST_PREFERENCE: \"courier:setRequestPreference\"; readonly COURIER_CUSTOM_REQUEST_PREFERENCE: \"courier:customRequestPreference\"; readonly COURIER_MAX_CONCURRENT_SHARD_REQUESTS: \"courier:maxConcurrentShardRequests\"; readonly SEARCH_INCLUDE_FROZEN: \"search:includeFrozen\"; readonly SEARCH_TIMEOUT: \"search:timeout\"; readonly HISTOGRAM_BAR_TARGET: \"histogram:barTarget\"; readonly HISTOGRAM_MAX_BARS: \"histogram:maxBars\"; readonly HISTORY_LIMIT: \"history:limit\"; readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: \"timepicker:refreshIntervalDefaults\"; readonly TIMEPICKER_QUICK_RANGES: \"timepicker:quickRanges\"; readonly TIMEPICKER_TIME_DEFAULTS: \"timepicker:timeDefaults\"; readonly FILTERS_PINNED_BY_DEFAULT: \"filters:pinnedByDefault\"; readonly FILTERS_EDITOR_SUGGEST_VALUES: \"filterEditor:suggestValues\"; readonly AUTOCOMPLETE_USE_TIMERANGE: \"autocomplete:useTimeRange\"; readonly AUTOCOMPLETE_VALUE_SUGGESTION_METHOD: \"autocomplete:valueSuggestionMethod\"; readonly DATE_FORMAT: \"dateFormat\"; readonly DATEFORMAT_TZ: \"dateFormat:tz\"; }" - ], - "path": "src/plugins/data/common/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - } - ], - "setup": { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginSetup", - "type": "Interface", - "tags": [], - "label": "DataPublicPluginSetup", - "description": [ - "\nData plugin public Setup contract" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginSetup.search", - "type": "Object", - "tags": [], - "label": "search", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataSearchPluginApi", - "section": "def-public.ISearchSetup", - "text": "ISearchSetup" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginSetup.query", - "type": "Object", - "tags": [], - "label": "query", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataQueryPluginApi", - "section": "def-public.QuerySetup", - "text": "QuerySetup" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "lifecycle": "setup", - "initialIsOpen": true - }, - "start": { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart", - "type": "Interface", - "tags": [], - "label": "DataPublicPluginStart", - "description": [ - "\nData plugin public Start contract" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.actions", - "type": "Object", - "tags": [], - "label": "actions", - "description": [ - "\nfilter creation utilities\n{@link DataPublicPluginStartActions}" - ], - "signature": [ - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataPluginApi", - "section": "def-public.DataPublicPluginStartActions", - "text": "DataPublicPluginStartActions" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.dataViews", - "type": "Object", - "tags": [], - "label": "dataViews", - "description": [ - "\ndata views service\n{@link DataViewsContract}" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "public", - "docId": "kibDataViewsPluginApi", - "section": "def-public.DataViewsServicePublic", - "text": "DataViewsServicePublic" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.datatableUtilities", - "type": "Object", - "tags": [], - "label": "datatableUtilities", - "description": [ - "\nDatatable type utility functions." - ], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataPluginApi", - "section": "def-common.DatatableUtilitiesService", - "text": "DatatableUtilitiesService" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.indexPatterns", - "type": "Object", - "tags": [ - "deprecated" - ], - "label": "indexPatterns", - "description": [ - "\nindex patterns service\n{@link DataViewsContract}" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "public", - "docId": "kibDataViewsPluginApi", - "section": "def-public.DataViewsServicePublic", - "text": "DataViewsServicePublic" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/plugin.ts" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/boundary_index_expression.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/entity_index_expression.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "inputControlVis", - "path": "src/plugins/input_control_vis/public/control/list_control_factory.ts" - }, - { - "plugin": "inputControlVis", - "path": "src/plugins/input_control_vis/public/control/range_control_factory.ts" - }, - { - "plugin": "inputControlVis", - "path": "src/plugins/input_control_vis/public/components/editor/controls_tab.tsx" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/mock/endpoint/dependencies_start_mock.ts" - }, - { - "plugin": "savedObjects", - "path": "src/plugins/saved_objects/public/saved_object/saved_object.test.ts" - }, - { - "plugin": "savedObjects", - "path": "src/plugins/saved_objects/public/saved_object/saved_object.test.ts" - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.search", - "type": "Object", - "tags": [], - "label": "search", - "description": [ - "\nsearch service\n{@link ISearchStart}" - ], - "signature": [ - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataSearchPluginApi", - "section": "def-public.ISearchStart", - "text": "ISearchStart" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.fieldFormats", - "type": "CompoundType", - "tags": [ - "deprecated" - ], - "label": "fieldFormats", - "description": [], - "signature": [ - "Omit<", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormatsRegistry", - "text": "FieldFormatsRegistry" - }, - ", \"init\" | \"register\"> & { deserialize: ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FormatFactory", - "text": "FormatFactory" - }, - "; }" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "dashboard", - "path": "src/plugins/dashboard/public/services/data/types.ts" - }, - { - "plugin": "dashboard", - "path": "src/plugins/dashboard/public/services/data/data_service.ts" - }, - { - "plugin": "dataVisualizer", - "path": "x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_row/document_stats.tsx" - }, - { - "plugin": "dataVisualizer", - "path": "x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx" - }, - { - "plugin": "dataVisualizer", - "path": "x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_expanded_row/choropleth_map.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/threshold/expression.tsx" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - }, - { - "plugin": "expressionPartitionVis", - "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" - } - ] - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.query", - "type": "Object", - "tags": [], - "label": "query", - "description": [ - "\nquery service\n{@link QueryStart}" - ], - "signature": [ - { - "pluginId": "data", - "scope": "public", - "docId": "kibDataQueryPluginApi", - "section": "def-public.QueryStart", - "text": "QueryStart" - } - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-public.DataPublicPluginStart.nowProvider", - "type": "Object", - "tags": [], - "label": "nowProvider", - "description": [], - "signature": [ - "{ get: () => Date; }" - ], - "path": "src/plugins/data/public/types.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "lifecycle": "start", - "initialIsOpen": true - } - }, - "server": { - "classes": [ - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin", - "type": "Class", - "tags": [], - "label": "DataServerPlugin", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "server", - "docId": "kibDataPluginApi", - "section": "def-server.DataServerPlugin", - "text": "DataServerPlugin" - }, - " implements ", - { - "pluginId": "@kbn/core-plugins-server", - "scope": "common", - "docId": "kibKbnCorePluginsServerPluginApi", - "section": "def-common.Plugin", - "text": "Plugin" - }, - "<", - { - "pluginId": "data", - "scope": "server", - "docId": "kibDataPluginApi", - "section": "def-server.DataPluginSetup", - "text": "DataPluginSetup" - }, - ", ", - { - "pluginId": "data", - "scope": "server", - "docId": "kibDataPluginApi", - "section": "def-server.DataPluginStart", - "text": "DataPluginStart" - }, - ", ", - "DataPluginSetupDependencies", - ", ", - "DataPluginStartDependencies", - ">" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.Unnamed.$1", - "type": "Object", - "tags": [], - "label": "initializerContext", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-plugins-server", - "scope": "common", - "docId": "kibKbnCorePluginsServerPluginApi", - "section": "def-common.PluginInitializerContext", - "text": "PluginInitializerContext" - }, - "; }>; asyncSearch: Readonly<{ pollInterval?: number | undefined; } & { waitForCompletion: moment.Duration; keepAlive: moment.Duration; batchedReduceSize: number; }>; sessions: Readonly<{} & { enabled: boolean; notTouchedTimeout: moment.Duration; maxUpdateRetries: number; defaultExpiration: moment.Duration; management: Readonly<{} & { refreshInterval: moment.Duration; maxSessions: number; refreshTimeout: moment.Duration; expiresSoonWarning: moment.Duration; }>; }>; }>; }>>" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.setup", - "type": "Function", - "tags": [], - "label": "setup", - "description": [], - "signature": [ - "(core: ", - { - "pluginId": "@kbn/core-lifecycle-server", - "scope": "common", - "docId": "kibKbnCoreLifecycleServerPluginApi", - "section": "def-common.CoreSetup", - "text": "CoreSetup" - }, - "<", - "DataPluginStartDependencies", - ", ", - { - "pluginId": "data", - "scope": "server", - "docId": "kibDataPluginApi", - "section": "def-server.DataPluginStart", - "text": "DataPluginStart" - }, - ">, { bfetch, expressions, usageCollection, fieldFormats, taskManager, security, }: ", - "DataPluginSetupDependencies", - ") => { search: ", - "ISearchSetup", - "; query: ", - "QuerySetup", - "; fieldFormats: ", - { - "pluginId": "fieldFormats", - "scope": "server", - "docId": "kibFieldFormatsPluginApi", - "section": "def-server.FieldFormatsSetup", - "text": "FieldFormatsSetup" - }, - "; }" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.setup.$1", - "type": "Object", - "tags": [], - "label": "core", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-lifecycle-server", - "scope": "common", - "docId": "kibKbnCoreLifecycleServerPluginApi", - "section": "def-common.CoreSetup", - "text": "CoreSetup" - }, - "<", - "DataPluginStartDependencies", - ", ", - { - "pluginId": "data", - "scope": "server", - "docId": "kibDataPluginApi", - "section": "def-server.DataPluginStart", - "text": "DataPluginStart" - }, - ">" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.setup.$2", - "type": "Object", - "tags": [], - "label": "{\n bfetch,\n expressions,\n usageCollection,\n fieldFormats,\n taskManager,\n security,\n }", - "description": [], - "signature": [ - "DataPluginSetupDependencies" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.start", - "type": "Function", - "tags": [], - "label": "start", - "description": [], - "signature": [ - "(core: ", - { - "pluginId": "@kbn/core-lifecycle-server", - "scope": "common", - "docId": "kibKbnCoreLifecycleServerPluginApi", - "section": "def-common.CoreStart", - "text": "CoreStart" - }, - ", { fieldFormats, dataViews, taskManager }: ", - "DataPluginStartDependencies", - ") => { datatableUtilities: ", - "DatatableUtilitiesService", - "; search: ", - "ISearchStart", - "<", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IEsSearchRequest", - "text": "IEsSearchRequest" - }, - ", ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IEsSearchResponse", - "text": "IEsSearchResponse" - }, - ">; fieldFormats: ", - { - "pluginId": "fieldFormats", - "scope": "server", - "docId": "kibFieldFormatsPluginApi", - "section": "def-server.FieldFormatsStart", - "text": "FieldFormatsStart" - }, - "; indexPatterns: ", - { - "pluginId": "dataViews", - "scope": "server", - "docId": "kibDataViewsPluginApi", - "section": "def-server.DataViewsServerPluginStart", - "text": "DataViewsServerPluginStart" - }, - "; }" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.start.$1", - "type": "Object", - "tags": [], - "label": "core", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-lifecycle-server", - "scope": "common", - "docId": "kibKbnCoreLifecycleServerPluginApi", - "section": "def-common.CoreStart", - "text": "CoreStart" - } - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.start.$2", - "type": "Object", - "tags": [], - "label": "{ fieldFormats, dataViews, taskManager }", - "description": [], - "signature": [ - "DataPluginStartDependencies" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataServerPlugin.stop", - "type": "Function", - "tags": [], - "label": "stop", - "description": [], - "signature": [ - "() => void" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView", - "type": "Class", - "tags": [], - "label": "DataView", - "description": [ - "\nData view class. Central kibana abstraction around multiple indices." - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " implements ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.DataViewBase", - "text": "DataViewBase" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.id", - "type": "string", - "tags": [], - "label": "id", - "description": [ - "\nSaved object id" - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.title", - "type": "string", - "tags": [ - "deprecated" - ], - "label": "title", - "description": [ - "\nTitle of data view" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/types.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/source/index.tsx" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/source/index.tsx" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts" - }, - { - "plugin": "timelines", - "path": "x-pack/plugins/timelines/public/mock/index_pattern.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" - }, - { - "plugin": "threatIntelligence", - "path": "x-pack/plugins/threat_intelligence/public/common/mocks/mock_security_context.tsx" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/build_es_query.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/from_combined_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/from_filters.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/from_filters.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/from_kuery.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/es_query/from_nested_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/build_filters/build_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/build_filters/exists_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/build_filters/get_filter_field.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/build_filters/phrases_filter.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/helpers/compare_filters.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/helpers/compare_filters.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/filters/helpers/compare_filters.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/ast/ast.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/and.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/exists.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/is.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/nested.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/not.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/or.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/range.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/node_types/function.test.ts" - }, - { - "plugin": "@kbn/es-query", - "path": "packages/kbn-es-query/src/kuery/functions/utils/get_full_field_name_node.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "unifiedSearch", - "path": "src/plugins/unified_search/public/autocomplete/providers/value_suggestion_provider.ts" - }, - { - "plugin": "unifiedSearch", - "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" - }, - { - "plugin": "unifiedSearch", - "path": "src/plugins/unified_search/public/dataview_picker/change_dataview.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/rest_api_routes/update_data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/rest_api_routes/update_data_view.ts" - }, - { - "plugin": "triggersActionsUi", - "path": "x-pack/plugins/triggers_actions_ui/public/common/lib/data_apis.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx" - }, - { - "plugin": "controls", - "path": "src/plugins/controls/public/services/options_list/options_list_service.ts" - }, - { - "plugin": "controls", - "path": "src/plugins/controls/public/services/options_list/options_list_service.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/public/data_views_service/loader.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx" - }, - { - "plugin": "aiops", - "path": "x-pack/plugins/aiops/public/components/log_categorization/log_categorization_page.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/server/lib/alerts/alerting_service.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/common/log_views/resolved_log_view.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/common/index_patterns_utils.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/common/index_patterns_utils.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/server/lib/get_fields.ts" - }, - { - "plugin": "apm", - "path": "x-pack/plugins/apm/server/routes/data_view/create_static_data_view.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/report_definition_field.tsx" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/use_filter_values.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx" - }, - { - "plugin": "dataVisualizer", - "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts" - }, - { - "plugin": "dataVisualizer", - "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.tsx" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/services/kibana/data_views.ts" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/services/kibana/data_views.ts" - }, - { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/datasource/datasource_component.js" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/state_management/datasource.sagas.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/state_management/persistence.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/state_management/persistence.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/validators.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx" - }, - { - "plugin": "timelines", - "path": "x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/boundary_index_expression.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/entity_index_expression.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" - }, - { - "plugin": "stackAlerts", - "path": "x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.tsx" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx" - }, - { - "plugin": "transform", - "path": "x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/components/filter_term_form.tsx" - }, - { - "plugin": "transform", - "path": "x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts" - }, - { - "plugin": "transform", - "path": "x-pack/plugins/transform/public/app/services/es_index_service.ts" - }, - { - "plugin": "transform", - "path": "x-pack/plugins/transform/server/routes/api/transforms.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/public/application/components/es_deprecation_logs/fix_deprecation_logs/external_links.tsx" - }, - { - "plugin": "ux", - "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/use_data_view.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/state_management/datasource.test.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts" - }, - { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts" - }, - { - "plugin": "ml", - "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_kpi.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_with_reference_lines.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/test_formula_metric_attribute.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/mobile_test_attribute.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_cwv.ts" - }, - { - "plugin": "transform", - "path": "x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/common.test.ts" - }, - { - "plugin": "controls", - "path": "src/plugins/controls/public/services/data_views/data_views.story.ts" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/field_editor/components/scripting_help/test_script.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/field_editor/field_editor.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/create_edit_field/create_edit_field.tsx" - }, - { - "plugin": "inputControlVis", - "path": "src/plugins/input_control_vis/public/control/list_control_factory.ts" - }, - { - "plugin": "inputControlVis", - "path": "src/plugins/input_control_vis/public/control/range_control_factory.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/server/routes/field_stats.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/server/routes/field_stats.ts" - }, - { - "plugin": "visDefaultEditor", - "path": "src/plugins/vis_default_editor/public/components/controls/field.tsx" - }, - { - "plugin": "visDefaultEditor", - "path": "src/plugins/vis_default_editor/public/components/controls/field.tsx" - }, - { - "plugin": "visDefaultEditor", - "path": "src/plugins/vis_default_editor/public/components/agg_select.tsx" - }, - { - "plugin": "inputControlVis", - "path": "src/plugins/input_control_vis/public/test_utils/get_index_pattern_mock.ts" - }, - { - "plugin": "presentationUtil", - "path": "src/plugins/presentation_util/public/services/data_views/data_views.story.ts" - }, - { - "plugin": "visTypeTimelion", - "path": "src/plugins/vis_types/timelion/public/helpers/arg_value_suggestions.ts" - }, - { - "plugin": "visTypeTimelion", - "path": "src/plugins/vis_types/timelion/public/helpers/arg_value_suggestions.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/common/index_patterns_utils.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/common/index_patterns_utils.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/application/components/lib/convert_series_to_datatable.ts" - }, - { - "plugin": "visTypeVega", - "path": "src/plugins/vis_types/vega/public/data_model/search_api.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/application/components/lib/convert_series_to_datatable.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/convert_to_lens/lib/datasource/datasource_info.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/convert_to_lens/lib/datasource/datasource_info.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/convert_to_lens/lib/datasource/datasource_info.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/server/lib/search_strategies/lib/cached_index_pattern_fetcher.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/server/lib/search_strategies/lib/cached_index_pattern_fetcher.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" - }, - { - "plugin": "discover", - "path": "src/plugins/discover/public/application/main/hooks/use_text_based_query_language.ts" - }, - { - "plugin": "infra", - "path": "x-pack/plugins/infra/public/pages/metrics/hosts/hooks/use_data_view.test.ts" - } - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.fieldFormatMap", - "type": "Object", - "tags": [], - "label": "fieldFormatMap", - "description": [ - "\nMap of field formats by field name" - ], - "signature": [ - "{ [x: string]: ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.SerializedFieldFormat", - "text": "SerializedFieldFormat" - }, - "<{}, ", - { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - ">; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.typeMeta", - "type": "Object", - "tags": [], - "label": "typeMeta", - "description": [ - "\nOnly used by rollup indices, used by rollup specific endpoint to load field list." - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TypeMeta", - "text": "TypeMeta" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.fields", - "type": "CompoundType", - "tags": [], - "label": "fields", - "description": [ - "\nField list, in extended array format" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.IIndexPatternFieldList", - "text": "IIndexPatternFieldList" - }, - " & { toSpec: () => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewFieldMap", - "text": "DataViewFieldMap" - }, - "; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.timeFieldName", - "type": "string", - "tags": [], - "label": "timeFieldName", - "description": [ - "\nTimestamp field name" - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.type", - "type": "string", - "tags": [], - "label": "type", - "description": [ - "\nType is used to identify rollup index patterns." - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.flattenHit", - "type": "Function", - "tags": [ - "deprecated" - ], - "label": "flattenHit", - "description": [], - "signature": [ - "(hit: Record, deep?: boolean | undefined) => Record" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" - }, - { - "plugin": "maps", - "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" - } - ], - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.flattenHit.$1", - "type": "Object", - "tags": [], - "label": "hit", - "description": [], - "signature": [ - "{ [x: string]: unknown[]; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.flattenHit.$2", - "type": "CompoundType", - "tags": [], - "label": "deep", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.metaFields", - "type": "Array", - "tags": [], - "label": "metaFields", - "description": [ - "\nList of meta fields by name" - ], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.version", - "type": "string", - "tags": [], - "label": "version", - "description": [ - "\nSavedObject version" - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.sourceFilters", - "type": "Array", - "tags": [], - "label": "sourceFilters", - "description": [ - "\nArray of filters - hides fields in discover" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.SourceFilter", - "text": "SourceFilter" - }, - "[] | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.namespaces", - "type": "Array", - "tags": [], - "label": "namespaces", - "description": [ - "\nArray of namespace ids" - ], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.allowNoIndex", - "type": "boolean", - "tags": [], - "label": "allowNoIndex", - "description": [ - "\nPrevents errors when index pattern exists before indices" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.name", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "\nName of the data view. Human readable name used to differentiate data view." - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.matchedIndices", - "type": "Array", - "tags": [], - "label": "matchedIndices", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [ - "\nconstructor" - ], - "signature": [ - "any" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.Unnamed.$1", - "type": "Object", - "tags": [], - "label": "config", - "description": [ - "- config data and dependencies" - ], - "signature": [ - "DataViewDeps" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getName", - "type": "Function", - "tags": [], - "label": "getName", - "description": [ - "\nGet name of Data View" - ], - "signature": [ - "() => string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getIndexPattern", - "type": "Function", - "tags": [], - "label": "getIndexPattern", - "description": [ - "\nGet index pattern" - ], - "signature": [ - "() => string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [ - "index pattern string" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setIndexPattern", - "type": "Function", - "tags": [], - "label": "setIndexPattern", - "description": [ - "\nSet index pattern" - ], - "signature": [ - "(indexPattern: string) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.setIndexPattern.$1", - "type": "string", - "tags": [], - "label": "indexPattern", - "description": [], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getOriginalSavedObjectBody", - "type": "Function", - "tags": [], - "label": "getOriginalSavedObjectBody", - "description": [ - "\nGet last saved saved object fields" - ], - "signature": [ - "() => { fieldAttrs?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; fields?: string | undefined; sourceFilters?: string | undefined; fieldFormatMap?: string | undefined; typeMeta?: string | undefined; type?: string | undefined; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.resetOriginalSavedObjectBody", - "type": "Function", - "tags": [], - "label": "resetOriginalSavedObjectBody", - "description": [ - "\nReset last saved saved object fields. Used after saving." - ], - "signature": [ - "() => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getFieldAttrs", - "type": "Function", - "tags": [], - "label": "getFieldAttrs", - "description": [ - "\nReturns field attributes map" - ], - "signature": [ - "() => { [x: string]: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" - }, - "; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getComputedFields", - "type": "Function", - "tags": [], - "label": "getComputedFields", - "description": [ - "\nReturns scripted fields" - ], - "signature": [ - "() => { storedFields: string[]; scriptFields: Record; docvalueFields: { field: string; format: string; }[]; runtimeFields: ", - "MappingRuntimeFields", - "; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.isPersisted", - "type": "Function", - "tags": [], - "label": "isPersisted", - "description": [], - "signature": [ - "() => boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.toSpec", - "type": "Function", - "tags": [], - "label": "toSpec", - "description": [ - "\nCreates static representation of the data view." - ], - "signature": [ - "(includeFields?: boolean) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.toSpec.$1", - "type": "boolean", - "tags": [], - "label": "includeFields", - "description": [ - "Whether or not to include the `fields` list as part of this spec. If not included, the list\nwill be fetched from Elasticsearch when instantiating a new Data View with this spec." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getSourceFiltering", - "type": "Function", - "tags": [], - "label": "getSourceFiltering", - "description": [ - "\nGet the source filtering configuration for that index." - ], - "signature": [ - "() => { excludes: string[]; }" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.removeScriptedField", - "type": "Function", - "tags": [ - "deprecated" - ], - "label": "removeScriptedField", - "description": [ - "\nRemoves scripted field from field list." - ], - "signature": [ - "(fieldName: string) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/field_editor/field_editor.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - } - ], - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.removeScriptedField.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "name of scripted field to remove" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getNonScriptedFields", - "type": "Function", - "tags": [ - "deprecated" - ], - "label": "getNonScriptedFields", - "description": [ - "\n" - ], - "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - "[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/state_management/datasource.test.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts" - } - ], - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getScriptedFields", - "type": "Function", - "tags": [ - "deprecated" - ], - "label": "getScriptedFields", - "description": [ - "\n" - ], - "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - "[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, - "trackAdoption": false, - "references": [ - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/register_index_pattern_usage_collection.ts" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - } - ], - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.isTSDBMode", - "type": "Function", - "tags": [], - "label": "isTSDBMode", - "description": [ - "\nreturns true if dataview contains TSDB fields" - ], - "signature": [ - "() => boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.isTimeBased", - "type": "Function", - "tags": [], - "label": "isTimeBased", - "description": [ - "\nDoes the data view have a timestamp field?" - ], - "signature": [ - "() => this is ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TimeBasedDataView", - "text": "TimeBasedDataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.isTimeNanosBased", - "type": "Function", - "tags": [], - "label": "isTimeNanosBased", - "description": [ - "\nDoes the data view have a timestamp field and is it a date nanos field?" - ], - "signature": [ - "() => this is ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TimeBasedDataView", - "text": "TimeBasedDataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getTimeField", - "type": "Function", - "tags": [], - "label": "getTimeField", - "description": [ - "\nGet timestamp field as DataViewField or return undefined" - ], - "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getFieldByName", - "type": "Function", - "tags": [], - "label": "getFieldByName", - "description": [ - "\nGet field by name." - ], - "signature": [ - "(name: string) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.getFieldByName.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getAggregationRestrictions", - "type": "Function", - "tags": [], - "label": "getAggregationRestrictions", - "description": [ - "\nGet aggregation restrictions. Rollup fields can only perform a subset of aggregations." - ], - "signature": [ - "() => Record | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getAsSavedObjectBody", - "type": "Function", - "tags": [], - "label": "getAsSavedObjectBody", - "description": [ - "\nReturns index pattern as saved object body for saving" - ], - "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getFormatterForField", - "type": "Function", - "tags": [], - "label": "getFormatterForField", - "description": [ - "\nProvide a field, get its formatter" - ], - "signature": [ - "(field: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - ") => ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormat", - "text": "FieldFormat" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.getFormatterForField.$1", - "type": "CompoundType", - "tags": [], - "label": "field", - "description": [ - "field to get formatter for" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.addRuntimeField", - "type": "Function", - "tags": [], - "label": "addRuntimeField", - "description": [ - "\nAdd a runtime field - Appended to existing mapped field or a new field is\ncreated as appropriate." - ], - "signature": [ - "(name: string, runtimeField: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" - }, - ") => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - "[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.addRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "Field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.addRuntimeField.$2", - "type": "Object", - "tags": [], - "label": "runtimeField", - "description": [ - "Runtime field definition" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.hasRuntimeField", - "type": "Function", - "tags": [], - "label": "hasRuntimeField", - "description": [ - "\nChecks if runtime field exists" - ], - "signature": [ - "(name: string) => boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.hasRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getRuntimeField", - "type": "Function", - "tags": [], - "label": "getRuntimeField", - "description": [ - "\nReturns runtime field if exists" - ], - "signature": [ - "(name: string) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" - }, - " | null" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.getRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "Runtime field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getAllRuntimeFields", - "type": "Function", - "tags": [], - "label": "getAllRuntimeFields", - "description": [ - "\nGet all runtime field definitions.\nNOTE: this does not strip out runtime fields that match mapped field names" - ], - "signature": [ - "() => Record" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [ - "map of runtime field definitions by field name" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getFieldsByRuntimeFieldName", - "type": "Function", - "tags": [], - "label": "getFieldsByRuntimeFieldName", - "description": [ - "\nReturns data view fields backed by runtime fields." - ], - "signature": [ - "(name: string) => Record | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.getFieldsByRuntimeFieldName.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "runtime field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "map of DataViewFields (that are runtime fields) by field name" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.replaceAllRuntimeFields", - "type": "Function", - "tags": [], - "label": "replaceAllRuntimeFields", - "description": [ - "\nReplaces all existing runtime fields with new fields." - ], - "signature": [ - "(newFields: Record) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.replaceAllRuntimeFields.$1", - "type": "Object", - "tags": [], - "label": "newFields", - "description": [ - "Map of runtime field definitions by field name" - ], - "signature": [ - "Record" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.removeRuntimeField", - "type": "Function", - "tags": [], - "label": "removeRuntimeField", - "description": [ - "\nRemove a runtime field - removed from mapped field or removed unmapped\nfield as appropriate. Doesn't clear associated field attributes." - ], - "signature": [ - "(name: string) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.removeRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "- Field name to remove" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getRuntimeMappings", - "type": "Function", - "tags": [], - "label": "getRuntimeMappings", - "description": [ - "\nReturn the \"runtime_mappings\" section of the ES search query." - ], - "signature": [ - "() => ", - "MappingRuntimeFields" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.getFormatterForFieldNoDefault", - "type": "Function", - "tags": [], - "label": "getFormatterForFieldNoDefault", - "description": [ - "\nGet formatter for a given field name. Return undefined if none exists." - ], - "signature": [ - "(fieldname: string) => ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormat", - "text": "FieldFormat" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.getFormatterForFieldNoDefault.$1", - "type": "string", - "tags": [], - "label": "fieldname", - "description": [ - "name of field to get formatter for" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldAttrs", - "type": "Function", - "tags": [], - "label": "setFieldAttrs", - "description": [ - "\nSet field attribute" - ], - "signature": [ - "(fieldName: string, attrName: K, value: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" - }, - "[K]) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldAttrs.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "name of field to set attribute on" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldAttrs.$2", - "type": "Uncategorized", - "tags": [], - "label": "attrName", - "description": [ - "name of attribute to set" - ], - "signature": [ - "K" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldAttrs.$3", - "type": "Uncategorized", - "tags": [], - "label": "value", - "description": [ - "value of attribute" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" - }, - "[K]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldCustomLabel", - "type": "Function", - "tags": [], - "label": "setFieldCustomLabel", - "description": [ - "\nSet field custom label" - ], - "signature": [ - "(fieldName: string, customLabel: string | null | undefined) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldCustomLabel.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "name of field to set custom label on" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldCustomLabel.$2", - "type": "CompoundType", - "tags": [], - "label": "customLabel", - "description": [ - "custom label value. If undefined, custom label is removed" - ], - "signature": [ - "string | null | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldCount", - "type": "Function", - "tags": [], - "label": "setFieldCount", - "description": [ - "\nSet field count" - ], - "signature": [ - "(fieldName: string, count: number | null | undefined) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldCount.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "name of field to set count on" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldCount.$2", - "type": "CompoundType", - "tags": [], - "label": "count", - "description": [ - "count value. If undefined, count is removed" - ], - "signature": [ - "number | null | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldFormat", - "type": "Function", - "tags": [], - "label": "setFieldFormat", - "description": [ - "\nSet field formatter" - ], - "signature": [ - "(fieldName: string, format: ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.SerializedFieldFormat", - "text": "SerializedFieldFormat" - }, - "<{}, ", - { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - ">) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldFormat.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "name of field to set format on" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.setFieldFormat.$2", - "type": "Object", - "tags": [], - "label": "format", - "description": [ - "field format in serialized form" - ], - "signature": [ - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.SerializedFieldFormat", - "text": "SerializedFieldFormat" - }, - "<{}, ", - { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataView.deleteFieldFormat", - "type": "Function", - "tags": [], - "label": "deleteFieldFormat", - "description": [ - "\nRemove field format from the field format map." - ], - "signature": [ - "(fieldName: string) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataView.deleteFieldFormat.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "field name associated with the format for removal" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService", - "type": "Class", - "tags": [], - "label": "DataViewsService", - "description": [ - "\nData views service, providing CRUD operations for data views." - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getCanSave", - "type": "Function", - "tags": [], - "label": "getCanSave", - "description": [ - "\nCan the user save data views?" - ], - "signature": [ - "() => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [ - "\nDataViewsService constructor" - ], - "signature": [ - "any" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.Unnamed.$1", - "type": "Object", - "tags": [], - "label": "deps", - "description": [ - "Service dependencies" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewsServiceDeps", - "text": "DataViewsServiceDeps" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getIds", - "type": "Function", - "tags": [], - "label": "getIds", - "description": [ - "\nGets list of index pattern ids." - ], - "signature": [ - "(refresh?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getIds.$1", - "type": "boolean", - "tags": [], - "label": "refresh", - "description": [ - "Force refresh of index pattern list" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getTitles", - "type": "Function", - "tags": [], - "label": "getTitles", - "description": [ - "\nGets list of index pattern titles." - ], - "signature": [ - "(refresh?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getTitles.$1", - "type": "boolean", - "tags": [], - "label": "refresh", - "description": [ - "Force refresh of index pattern list" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.find", - "type": "Function", - "tags": [], - "label": "find", - "description": [ - "\nFind and load index patterns by title." - ], - "signature": [ - "(search: string, size?: number) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - "[]>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.find.$1", - "type": "string", - "tags": [], - "label": "search", - "description": [ - "Search string" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.find.$2", - "type": "number", - "tags": [], - "label": "size", - "description": [ - "Number of data views to return" - ], - "signature": [ - "number" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "DataView[]" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getIdsWithTitle", - "type": "Function", - "tags": [], - "label": "getIdsWithTitle", - "description": [ - "\nGets list of index pattern ids with titles." - ], - "signature": [ - "(refresh?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewListItem", - "text": "DataViewListItem" - }, - "[]>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getIdsWithTitle.$1", - "type": "boolean", - "tags": [], - "label": "refresh", - "description": [ - "Force refresh of index pattern list" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.clearCache", - "type": "Function", - "tags": [], - "label": "clearCache", - "description": [ - "\nClear index pattern saved objects cache." - ], - "signature": [ - "() => void" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.clearInstanceCache", - "type": "Function", - "tags": [], - "label": "clearInstanceCache", - "description": [ - "\nClear index pattern instance cache" - ], - "signature": [ - "(id?: string | undefined) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.clearInstanceCache.$1", - "type": "string", - "tags": [], - "label": "id", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getCache", - "type": "Function", - "tags": [], - "label": "getCache", - "description": [ - "\nGet cache, contains data view saved objects." - ], - "signature": [ - "() => Promise<", - { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" - }, - "<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSavedObjectAttrs", - "text": "DataViewSavedObjectAttrs" - }, - ">[] | null | undefined>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getDefault", - "type": "Function", - "tags": [], - "label": "getDefault", - "description": [ - "\nGet default index pattern" - ], - "signature": [ - "(displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | null>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getDefault.$1", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getDefaultId", - "type": "Function", - "tags": [], - "label": "getDefaultId", - "description": [ - "\nGet default index pattern id" - ], - "signature": [ - "() => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.setDefault", - "type": "Function", - "tags": [], - "label": "setDefault", - "description": [ - "\nOptionally set default index pattern, unless force = true" - ], - "signature": [ - "(id: string | null, force?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.setDefault.$1", - "type": "CompoundType", - "tags": [], - "label": "id", - "description": [ - "data view id" - ], - "signature": [ - "string | null" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.setDefault.$2", - "type": "boolean", - "tags": [], - "label": "force", - "description": [ - "set default data view even if there's an existing default" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.hasUserDataView", - "type": "Function", - "tags": [], - "label": "hasUserDataView", - "description": [ - "\nChecks if current user has a user created index pattern ignoring fleet's server default index patterns." - ], - "signature": [ - "() => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getFieldsForWildcard", - "type": "Function", - "tags": [], - "label": "getFieldsForWildcard", - "description": [ - "\nGet field list by providing { pattern }." - ], - "signature": [ - "(options: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" - }, - ") => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[]>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getFieldsForWildcard.$1", - "type": "Object", - "tags": [], - "label": "options", - "description": [ - "options for getting field list" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "FieldSpec[]" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getFieldsForIndexPattern", - "type": "Function", - "tags": [], - "label": "getFieldsForIndexPattern", - "description": [ - "\nGet field list by providing an index patttern (or spec)." - ], - "signature": [ - "(indexPattern: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", options?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" - }, - " | undefined) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[]>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getFieldsForIndexPattern.$1", - "type": "CompoundType", - "tags": [], - "label": "indexPattern", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getFieldsForIndexPattern.$2", - "type": "Object", - "tags": [], - "label": "options", - "description": [ - "options for getting field list" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [ - "FieldSpec[]" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.refreshFields", - "type": "Function", - "tags": [], - "label": "refreshFields", - "description": [ - "\nRefresh field list for a given index pattern." - ], - "signature": [ - "(dataView: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ", displayErrors?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.refreshFields.$1", - "type": "Object", - "tags": [], - "label": "dataView", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.refreshFields.$2", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.fieldArrayToMap", - "type": "Function", - "tags": [], - "label": "fieldArrayToMap", - "description": [ - "\nConverts field array to map." - ], - "signature": [ - "(fields: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[], fieldAttrs?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" - }, - " | undefined) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewFieldMap", - "text": "DataViewFieldMap" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.fieldArrayToMap.$1", - "type": "Array", - "tags": [], - "label": "fields", - "description": [ - ": FieldSpec[]" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[]" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.fieldArrayToMap.$2", - "type": "Object", - "tags": [], - "label": "fieldAttrs", - "description": [ - ": FieldAttrs" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [ - "Record" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.savedObjectToSpec", - "type": "Function", - "tags": [], - "label": "savedObjectToSpec", - "description": [ - "\nConverts data view saved object to data view spec." - ], - "signature": [ - "(savedObject: ", - { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" - }, - "<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" - }, - ">) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.savedObjectToSpec.$1", - "type": "Object", - "tags": [], - "label": "savedObject", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" - }, - "<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "DataViewSpec" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.get", - "type": "Function", - "tags": [], - "label": "get", - "description": [ - "\nGet an index pattern by id, cache optimized." - ], - "signature": [ - "(id: string, displayErrors?: boolean, refreshFields?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.get.$1", - "type": "string", - "tags": [], - "label": "id", - "description": [], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.get.$2", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.get.$3", - "type": "boolean", - "tags": [], - "label": "refreshFields", - "description": [ - "- If set true, will fetch fields from the index pattern" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.create", - "type": "Function", - "tags": [], - "label": "create", - "description": [ - "\nCreate data view instance." - ], - "signature": [ - "(spec: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.create.$1", - "type": "Object", - "tags": [], - "label": "spec", - "description": [ - "data view spec" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.create.$2", - "type": "boolean", - "tags": [], - "label": "skipFetchFields", - "description": [ - "if true, will not fetch fields" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.create.$3", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "DataView" - ] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createAndSave", - "type": "Function", - "tags": [], - "label": "createAndSave", - "description": [ - "\nCreate a new data view and save it right away." - ], - "signature": [ - "(spec: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", override?: boolean, skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createAndSave.$1", - "type": "Object", - "tags": [], - "label": "spec", - "description": [ - "data view spec" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createAndSave.$2", - "type": "boolean", - "tags": [], - "label": "override", - "description": [ - "Overwrite if existing index pattern exists." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createAndSave.$3", - "type": "boolean", - "tags": [], - "label": "skipFetchFields", - "description": [ - "Whether to skip field refresh step." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createAndSave.$4", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createSavedObject", - "type": "Function", - "tags": [], - "label": "createSavedObject", - "description": [ - "\nSave a new data view." - ], - "signature": [ - "(dataView: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ", override?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createSavedObject.$1", - "type": "Object", - "tags": [], - "label": "dataView", - "description": [ - "data view instance" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createSavedObject.$2", - "type": "boolean", - "tags": [], - "label": "override", - "description": [ - "Overwrite if existing index pattern exists" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.createSavedObject.$3", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.updateSavedObject", - "type": "Function", - "tags": [], - "label": "updateSavedObject", - "description": [ - "\nSave existing data view. Will attempt to merge differences if there are conflicts." - ], - "signature": [ - "(indexPattern: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ", saveAttempts?: number, ignoreErrors?: boolean, displayErrors?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.updateSavedObject.$1", - "type": "Object", - "tags": [], - "label": "indexPattern", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.updateSavedObject.$2", - "type": "number", - "tags": [], - "label": "saveAttempts", - "description": [], - "signature": [ - "number" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.updateSavedObject.$3", - "type": "boolean", - "tags": [], - "label": "ignoreErrors", - "description": [], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.updateSavedObject.$4", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.delete", - "type": "Function", - "tags": [], - "label": "delete", - "description": [ - "\nDeletes an index pattern from .kibana index." - ], - "signature": [ - "(indexPatternId: string) => Promise<{}>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.delete.$1", - "type": "string", - "tags": [], - "label": "indexPatternId", - "description": [ - ": Id of kibana Index Pattern to delete" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getDefaultDataView", - "type": "Function", - "tags": [], - "label": "getDefaultDataView", - "description": [ - "\nReturns the default data view as an object.\nIf no default is found, or it is missing\nanother data view is selected as default and returned.\nIf no possible data view found to become a default returns null.\n" - ], - "signature": [ - "(refreshFields?: boolean | undefined) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | null>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsService.getDefaultDataView.$1", - "type": "CompoundType", - "tags": [], - "label": "refreshFields", - "description": [ - "- if true, will refresh the fields of the default data view" - ], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [ - "default data view" - ] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher", - "type": "Class", - "tags": [], - "label": "IndexPatternsFetcher", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.Unnamed.$1", - "type": "Object", - "tags": [], - "label": "elasticsearchClient", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-elasticsearch-server", - "scope": "common", - "docId": "kibKbnCoreElasticsearchServerPluginApi", - "section": "def-common.ElasticsearchClient", - "text": "ElasticsearchClient" - } - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.Unnamed.$2", - "type": "boolean", - "tags": [], - "label": "allowNoIndices", - "description": [], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard", - "type": "Function", - "tags": [ - "property", - "property", - "return" - ], - "label": "getFieldsForWildcard", - "description": [ - "\n Get a list of field objects for an index pattern that may contain wildcards\n" - ], - "signature": [ - "(options: { pattern: string | string[]; metaFields?: string[] | undefined; fieldCapsOptions?: { allow_no_indices: boolean; includeUnmapped?: boolean | undefined; } | undefined; type?: string | undefined; rollupIndex?: string | undefined; indexFilter?: ", - "QueryDslQueryContainer", - " | undefined; fields?: string[] | undefined; }) => Promise<{ fields: ", - { - "pluginId": "dataViews", - "scope": "server", - "docId": "kibDataViewsPluginApi", - "section": "def-server.FieldDescriptor", - "text": "FieldDescriptor" - }, - "[]; indices: string[]; }>" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1", - "type": "Object", - "tags": [], - "label": "options", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.pattern", - "type": "CompoundType", - "tags": [], - "label": "pattern", - "description": [], - "signature": [ - "string | string[]" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.metaFields", - "type": "Array", - "tags": [], - "label": "metaFields", - "description": [], - "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.fieldCapsOptions", - "type": "Object", - "tags": [], - "label": "fieldCapsOptions", - "description": [], - "signature": [ - "{ allow_no_indices: boolean; includeUnmapped?: boolean | undefined; } | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.type", - "type": "string", - "tags": [], - "label": "type", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.rollupIndex", - "type": "string", - "tags": [], - "label": "rollupIndex", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.indexFilter", - "type": "Object", - "tags": [], - "label": "indexFilter", - "description": [], - "signature": [ - "QueryDslQueryContainer", - " | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.fields", - "type": "Array", - "tags": [], - "label": "fields", - "description": [], - "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.validatePatternListActive", - "type": "Function", - "tags": [ - "return" - ], - "label": "validatePatternListActive", - "description": [ - "\n Returns an index pattern list of only those index pattern strings in the given list that return indices\n" - ], - "signature": [ - "(patternList: string[]) => Promise" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.IndexPatternsFetcher.validatePatternListActive.$1", - "type": "Array", - "tags": [], - "label": "patternList", - "description": [ - "string[]" - ], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - } - ], - "initialIsOpen": false - } - ], - "functions": [ - { - "parentPluginId": "data", - "id": "def-server.getCapabilitiesForRollupIndices", - "type": "Function", - "tags": [], - "label": "getCapabilitiesForRollupIndices", - "description": [ - "\nGet rollup job capabilities" - ], - "signature": [ - "(indices: ", - "RollupGetRollupIndexCapsResponse", - ") => ", - { - "pluginId": "dataViews", - "scope": "server", - "docId": "kibDataViewsPluginApi", - "section": "def-server.RollupIndexCapability", - "text": "RollupIndexCapability" - } - ], - "path": "src/plugins/data_views/server/fetcher/lib/map_capabilities.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.getCapabilitiesForRollupIndices.$1", - "type": "Object", - "tags": [], - "label": "indices", - "description": [ - "rollup job index capabilites" - ], - "signature": [ - "RollupGetRollupIndexCapsResponse" - ], - "path": "src/plugins/data_views/server/fetcher/lib/map_capabilities.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.getEsQueryConfig", - "type": "Function", - "tags": [], - "label": "getEsQueryConfig", - "description": [], - "signature": [ - "(config: KibanaConfig) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.EsQueryConfig", - "text": "EsQueryConfig" - } - ], - "path": "src/plugins/data/common/es_query/get_es_query_config.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.getEsQueryConfig.$1", - "type": "Object", - "tags": [], - "label": "config", - "description": [], - "signature": [ - "KibanaConfig" - ], - "path": "src/plugins/data/common/es_query/get_es_query_config.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.getRequestAbortedSignal", - "type": "Function", - "tags": [], - "label": "getRequestAbortedSignal", - "description": [ - "\nA simple utility function that returns an `AbortSignal` corresponding to an `AbortController`\nwhich aborts when the given request is aborted." - ], - "signature": [ - "(aborted$: ", - "Observable", - ") => AbortSignal" - ], - "path": "src/plugins/data/server/lib/get_request_aborted_signal.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.getRequestAbortedSignal.$1", - "type": "Object", - "tags": [], - "label": "aborted$", - "description": [ - "The observable of abort events (usually `request.events.aborted$`)" - ], - "signature": [ - "Observable", - "" - ], - "path": "src/plugins/data/server/lib/get_request_aborted_signal.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.getTime", - "type": "Function", - "tags": [], - "label": "getTime", - "description": [], - "signature": [ - "(indexPattern: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | undefined, timeRange: ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.TimeRange", - "text": "TimeRange" - }, - ", options: { forceNow?: Date | undefined; fieldName?: string | undefined; } | undefined) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.RangeFilter", - "text": "RangeFilter" - }, - " | ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.ScriptedRangeFilter", - "text": "ScriptedRangeFilter" - }, - " | ", - "MatchAllRangeFilter", - " | undefined" - ], - "path": "src/plugins/data/common/query/timefilter/get_time.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.getTime.$1", - "type": "Object", - "tags": [], - "label": "indexPattern", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | undefined" - ], - "path": "src/plugins/data/common/query/timefilter/get_time.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - }, - { - "parentPluginId": "data", - "id": "def-server.getTime.$2", - "type": "Object", - "tags": [], - "label": "timeRange", - "description": [], - "signature": [ - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.TimeRange", - "text": "TimeRange" - } - ], - "path": "src/plugins/data/common/query/timefilter/get_time.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-server.getTime.$3", - "type": "Object", - "tags": [], - "label": "options", - "description": [], - "path": "src/plugins/data/common/query/timefilter/get_time.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.getTime.$3.forceNow", - "type": "Object", - "tags": [], - "label": "forceNow", - "description": [], - "signature": [ - "Date | undefined" - ], - "path": "src/plugins/data/common/query/timefilter/get_time.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.getTime.$3.fieldName", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/common/query/timefilter/get_time.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.parseInterval", - "type": "Function", - "tags": [], - "label": "parseInterval", - "description": [], - "signature": [ - "(interval: string) => moment.Duration | null" - ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_interval.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.parseInterval.$1", - "type": "string", - "tags": [], - "label": "interval", - "description": [], - "signature": [ - "string" - ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_interval.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - } - ], - "interfaces": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsServerPluginStart", - "type": "Interface", - "tags": [], - "label": "DataViewsServerPluginStart", - "description": [ - "\nDataViews server plugin start api" - ], - "path": "src/plugins/data_views/server/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory", - "type": "Function", - "tags": [], - "label": "dataViewsServiceFactory", - "description": [ - "\nReturns a DataViews service instance" - ], - "signature": [ - "(savedObjectsClient: ", - { - "pluginId": "@kbn/core-saved-objects-api-server", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsApiServerPluginApi", - "section": "def-common.SavedObjectsClientContract", - "text": "SavedObjectsClientContract" - }, - ", elasticsearchClient: ", - { - "pluginId": "@kbn/core-elasticsearch-server", - "scope": "common", - "docId": "kibKbnCoreElasticsearchServerPluginApi", - "section": "def-common.ElasticsearchClient", - "text": "ElasticsearchClient" - }, - ", request?: ", - { - "pluginId": "@kbn/core-http-server", - "scope": "common", - "docId": "kibKbnCoreHttpServerPluginApi", - "section": "def-common.KibanaRequest", - "text": "KibanaRequest" - }, - " | undefined, byPassCapabilities?: boolean | undefined) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewsService", - "text": "DataViewsService" - }, - ">" - ], - "path": "src/plugins/data_views/server/types.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$1", - "type": "Object", - "tags": [], - "label": "savedObjectsClient", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-saved-objects-api-server", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsApiServerPluginApi", - "section": "def-common.SavedObjectsClientContract", - "text": "SavedObjectsClientContract" - } - ], - "path": "src/plugins/data_views/server/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$2", - "type": "Object", - "tags": [], - "label": "elasticsearchClient", - "description": [], - "signature": [ - "{ name: string | symbol; get: { (this: That, params: ", - "GetRequest", - " | ", - "GetRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "GetResponse", - ">; (this: That, params: ", - "GetRequest", - " | ", - "GetRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "GetResponse", - ", unknown>>; (this: That, params: ", - "GetRequest", - " | ", - "GetRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "GetResponse", - ">; }; delete: { (this: That, params: ", - "DeleteRequest", - " | ", - "DeleteRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "WriteResponseBase", - ">; (this: That, params: ", - "DeleteRequest", - " | ", - "DeleteRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "WriteResponseBase", - ", unknown>>; (this: That, params: ", - "DeleteRequest", - " | ", - "DeleteRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "WriteResponseBase", - ">; }; cluster: ", - "default", - "; eql: ", - "default", - "; search: { >(this: That, params?: ", - "SearchRequest", - " | ", - "SearchRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "SearchResponse", - ">; >(this: That, params?: ", - "SearchRequest", - " | ", - "SearchRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "SearchResponse", - ", unknown>>; >(this: That, params?: ", - "SearchRequest", - " | ", - "SearchRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "SearchResponse", - ">; }; create: { (this: That, params: ", - "CreateRequest", - " | ", - "CreateRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "WriteResponseBase", - ">; (this: That, params: ", - "CreateRequest", - " | ", - "CreateRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "WriteResponseBase", - ", unknown>>; (this: That, params: ", - "CreateRequest", - " | ", - "CreateRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "WriteResponseBase", - ">; }; monitoring: ", - "default", - "; security: ", - "default", - "; index: { (this: That, params: ", - "IndexRequest", - " | ", - "IndexRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "WriteResponseBase", - ">; (this: That, params: ", - "IndexRequest", - " | ", - "IndexRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "WriteResponseBase", - ", unknown>>; (this: That, params: ", - "IndexRequest", - " | ", - "IndexRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "WriteResponseBase", - ">; }; update: { (this: That, params: ", - "UpdateRequest", - " | ", - "UpdateRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "UpdateResponse", - ">; (this: That, params: ", - "UpdateRequest", - " | ", - "UpdateRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "UpdateResponse", - ", unknown>>; (this: That, params: ", - "UpdateRequest", - " | ", - "UpdateRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "UpdateResponse", - ">; }; asyncSearch: ", - "default", - "; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", - "default", - "; helpers: ", - "default", - "; child: (opts: ", - "ClientOptions", - ") => ", - "default", - "; autoscaling: ", - "default", - "; bulk: { (this: That, params: ", - "BulkRequest", - " | ", - "BulkRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "BulkResponse", - ">; (this: That, params: ", - "BulkRequest", - " | ", - "BulkRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "BulkResponse", - ", unknown>>; (this: That, params: ", - "BulkRequest", - " | ", - "BulkRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "BulkResponse", - ">; }; cat: ", - "default", - "; ccr: ", - "default", - "; clearScroll: { (this: That, params?: ", - "ClearScrollRequest", - " | ", - "ClearScrollRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ClearScrollResponse", - ">; (this: That, params?: ", - "ClearScrollRequest", - " | ", - "ClearScrollRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ClearScrollResponse", - ", unknown>>; (this: That, params?: ", - "ClearScrollRequest", - " | ", - "ClearScrollRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ClearScrollResponse", - ">; }; closePointInTime: { (this: That, params: ", - "ClosePointInTimeRequest", - " | ", - "ClosePointInTimeRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ClosePointInTimeResponse", - ">; (this: That, params: ", - "ClosePointInTimeRequest", - " | ", - "ClosePointInTimeRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ClosePointInTimeResponse", - ", unknown>>; (this: That, params: ", - "ClosePointInTimeRequest", - " | ", - "ClosePointInTimeRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ClosePointInTimeResponse", - ">; }; count: { (this: That, params?: ", - "CountRequest", - " | ", - "CountRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "CountResponse", - ">; (this: That, params?: ", - "CountRequest", - " | ", - "CountRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "CountResponse", - ", unknown>>; (this: That, params?: ", - "CountRequest", - " | ", - "CountRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "CountResponse", - ">; }; danglingIndices: ", - "default", - "; deleteByQuery: { (this: That, params: ", - "DeleteByQueryRequest", - " | ", - "DeleteByQueryRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "DeleteByQueryResponse", - ">; (this: That, params: ", - "DeleteByQueryRequest", - " | ", - "DeleteByQueryRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "DeleteByQueryResponse", - ", unknown>>; (this: That, params: ", - "DeleteByQueryRequest", - " | ", - "DeleteByQueryRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "DeleteByQueryResponse", - ">; }; deleteByQueryRethrottle: { (this: That, params: ", - "DeleteByQueryRethrottleRequest", - " | ", - "DeleteByQueryRethrottleRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "TasksTaskListResponseBase", - ">; (this: That, params: ", - "DeleteByQueryRethrottleRequest", - " | ", - "DeleteByQueryRethrottleRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "TasksTaskListResponseBase", - ", unknown>>; (this: That, params: ", - "DeleteByQueryRethrottleRequest", - " | ", - "DeleteByQueryRethrottleRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "TasksTaskListResponseBase", - ">; }; deleteScript: { (this: That, params: ", - "DeleteScriptRequest", - " | ", - "DeleteScriptRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "AcknowledgedResponseBase", - ">; (this: That, params: ", - "DeleteScriptRequest", - " | ", - "DeleteScriptRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "AcknowledgedResponseBase", - ", unknown>>; (this: That, params: ", - "DeleteScriptRequest", - " | ", - "DeleteScriptRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "AcknowledgedResponseBase", - ">; }; enrich: ", - "default", - "; exists: { (this: That, params: ", - "ExistsRequest", - " | ", - "ExistsRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise; (this: That, params: ", - "ExistsRequest", - " | ", - "ExistsRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - ">; (this: That, params: ", - "ExistsRequest", - " | ", - "ExistsRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise; }; existsSource: { (this: That, params: ", - "ExistsSourceRequest", - " | ", - "ExistsSourceRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise; (this: That, params: ", - "ExistsSourceRequest", - " | ", - "ExistsSourceRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - ">; (this: That, params: ", - "ExistsSourceRequest", - " | ", - "ExistsSourceRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise; }; explain: { (this: That, params: ", - "ExplainRequest", - " | ", - "ExplainRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ExplainResponse", - ">; (this: That, params: ", - "ExplainRequest", - " | ", - "ExplainRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ExplainResponse", - ", unknown>>; (this: That, params: ", - "ExplainRequest", - " | ", - "ExplainRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ExplainResponse", - ">; }; features: ", - "default", - "; fieldCaps: { (this: That, params: ", - "FieldCapsRequest", - " | ", - "FieldCapsRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "FieldCapsResponse", - ">; (this: That, params: ", - "FieldCapsRequest", - " | ", - "FieldCapsRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "FieldCapsResponse", - ", unknown>>; (this: That, params: ", - "FieldCapsRequest", - " | ", - "FieldCapsRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "FieldCapsResponse", - ">; }; fleet: ", - "default", - "; getScript: { (this: That, params: ", - "GetScriptRequest", - " | ", - "GetScriptRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "GetScriptResponse", - ">; (this: That, params: ", - "GetScriptRequest", - " | ", - "GetScriptRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "GetScriptResponse", - ", unknown>>; (this: That, params: ", - "GetScriptRequest", - " | ", - "GetScriptRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "GetScriptResponse", - ">; }; getScriptContext: { (this: That, params?: ", - "GetScriptContextRequest", - " | ", - "GetScriptContextRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "GetScriptContextResponse", - ">; (this: That, params?: ", - "GetScriptContextRequest", - " | ", - "GetScriptContextRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "GetScriptContextResponse", - ", unknown>>; (this: That, params?: ", - "GetScriptContextRequest", - " | ", - "GetScriptContextRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "GetScriptContextResponse", - ">; }; getScriptLanguages: { (this: That, params?: ", - "GetScriptLanguagesRequest", - " | ", - "GetScriptLanguagesRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "GetScriptLanguagesResponse", - ">; (this: That, params?: ", - "GetScriptLanguagesRequest", - " | ", - "GetScriptLanguagesRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "GetScriptLanguagesResponse", - ", unknown>>; (this: That, params?: ", - "GetScriptLanguagesRequest", - " | ", - "GetScriptLanguagesRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "GetScriptLanguagesResponse", - ">; }; getSource: { (this: That, params: ", - "GetSourceRequest", - " | ", - "GetSourceRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise; (this: That, params: ", - "GetSourceRequest", - " | ", - "GetSourceRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - ">; (this: That, params: ", - "GetSourceRequest", - " | ", - "GetSourceRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise; }; graph: ", - "default", - "; ilm: ", - "default", - "; indices: ", - "default", - "; info: { (this: That, params?: ", - "InfoRequest", - " | ", - "InfoRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "InfoResponse", - ">; (this: That, params?: ", - "InfoRequest", - " | ", - "InfoRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "InfoResponse", - ", unknown>>; (this: That, params?: ", - "InfoRequest", - " | ", - "InfoRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "InfoResponse", - ">; }; ingest: ", - "default", - "; knnSearch: { (this: That, params: ", - "KnnSearchRequest", - " | ", - "KnnSearchRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "KnnSearchResponse", - ">; (this: That, params: ", - "KnnSearchRequest", - " | ", - "KnnSearchRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "KnnSearchResponse", - ", unknown>>; (this: That, params: ", - "KnnSearchRequest", - " | ", - "KnnSearchRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "KnnSearchResponse", - ">; }; license: ", - "default", - "; logstash: ", - "default", - "; mget: { (this: That, params?: ", - "MgetRequest", - " | ", - "MgetRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "MgetResponse", - ">; (this: That, params?: ", - "MgetRequest", - " | ", - "MgetRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "MgetResponse", - ", unknown>>; (this: That, params?: ", - "MgetRequest", - " | ", - "MgetRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "MgetResponse", - ">; }; migration: ", - "default", - "; ml: ", - "default", - "; msearch: { >(this: That, params: ", - "MsearchRequest", - " | ", - "MsearchRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "MsearchResponse", - ">; >(this: That, params: ", - "MsearchRequest", - " | ", - "MsearchRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "MsearchResponse", - ", unknown>>; >(this: That, params: ", - "MsearchRequest", - " | ", - "MsearchRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "MsearchResponse", - ">; }; msearchTemplate: { >(this: That, params: ", - "MsearchTemplateRequest", - " | ", - "MsearchTemplateRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "MsearchTemplateResponse", - ">; >(this: That, params: ", - "MsearchTemplateRequest", - " | ", - "MsearchTemplateRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "MsearchTemplateResponse", - ", unknown>>; >(this: That, params: ", - "MsearchTemplateRequest", - " | ", - "MsearchTemplateRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "MsearchTemplateResponse", - ">; }; mtermvectors: { (this: That, params?: ", - "MtermvectorsRequest", - " | ", - "MtermvectorsRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "MtermvectorsResponse", - ">; (this: That, params?: ", - "MtermvectorsRequest", - " | ", - "MtermvectorsRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "MtermvectorsResponse", - ", unknown>>; (this: That, params?: ", - "MtermvectorsRequest", - " | ", - "MtermvectorsRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "MtermvectorsResponse", - ">; }; nodes: ", - "default", - "; openPointInTime: { (this: That, params: ", - "OpenPointInTimeRequest", - " | ", - "OpenPointInTimeRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "OpenPointInTimeResponse", - ">; (this: That, params: ", - "OpenPointInTimeRequest", - " | ", - "OpenPointInTimeRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "OpenPointInTimeResponse", - ", unknown>>; (this: That, params: ", - "OpenPointInTimeRequest", - " | ", - "OpenPointInTimeRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "OpenPointInTimeResponse", - ">; }; ping: { (this: That, params?: ", - "PingRequest", - " | ", - "PingRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise; (this: That, params?: ", - "PingRequest", - " | ", - "PingRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - ">; (this: That, params?: ", - "PingRequest", - " | ", - "PingRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise; }; putScript: { (this: That, params: ", - "PutScriptRequest", - " | ", - "PutScriptRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "AcknowledgedResponseBase", - ">; (this: That, params: ", - "PutScriptRequest", - " | ", - "PutScriptRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "AcknowledgedResponseBase", - ", unknown>>; (this: That, params: ", - "PutScriptRequest", - " | ", - "PutScriptRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "AcknowledgedResponseBase", - ">; }; rankEval: { (this: That, params: ", - "RankEvalRequest", - " | ", - "RankEvalRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "RankEvalResponse", - ">; (this: That, params: ", - "RankEvalRequest", - " | ", - "RankEvalRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "RankEvalResponse", - ", unknown>>; (this: That, params: ", - "RankEvalRequest", - " | ", - "RankEvalRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "RankEvalResponse", - ">; }; reindex: { (this: That, params: ", - "ReindexRequest", - " | ", - "ReindexRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ReindexResponse", - ">; (this: That, params: ", - "ReindexRequest", - " | ", - "ReindexRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ReindexResponse", - ", unknown>>; (this: That, params: ", - "ReindexRequest", - " | ", - "ReindexRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ReindexResponse", - ">; }; reindexRethrottle: { (this: That, params: ", - "ReindexRethrottleRequest", - " | ", - "ReindexRethrottleRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ReindexRethrottleResponse", - ">; (this: That, params: ", - "ReindexRethrottleRequest", - " | ", - "ReindexRethrottleRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ReindexRethrottleResponse", - ", unknown>>; (this: That, params: ", - "ReindexRethrottleRequest", - " | ", - "ReindexRethrottleRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ReindexRethrottleResponse", - ">; }; renderSearchTemplate: { (this: That, params?: ", - "RenderSearchTemplateRequest", - " | ", - "RenderSearchTemplateRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "RenderSearchTemplateResponse", - ">; (this: That, params?: ", - "RenderSearchTemplateRequest", - " | ", - "RenderSearchTemplateRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "RenderSearchTemplateResponse", - ", unknown>>; (this: That, params?: ", - "RenderSearchTemplateRequest", - " | ", - "RenderSearchTemplateRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "RenderSearchTemplateResponse", - ">; }; rollup: ", - "default", - "; scriptsPainlessExecute: { (this: That, params?: ", - "ScriptsPainlessExecuteRequest", - " | ", - "ScriptsPainlessExecuteRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ScriptsPainlessExecuteResponse", - ">; (this: That, params?: ", - "ScriptsPainlessExecuteRequest", - " | ", - "ScriptsPainlessExecuteRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ScriptsPainlessExecuteResponse", - ", unknown>>; (this: That, params?: ", - "ScriptsPainlessExecuteRequest", - " | ", - "ScriptsPainlessExecuteRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ScriptsPainlessExecuteResponse", - ">; }; scroll: { >(this: That, params: ", - "ScrollRequest", - " | ", - "ScrollRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "ScrollResponse", - ">; >(this: That, params: ", - "ScrollRequest", - " | ", - "ScrollRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "ScrollResponse", - ", unknown>>; >(this: That, params: ", - "ScrollRequest", - " | ", - "ScrollRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "ScrollResponse", - ">; }; searchMvt: { (this: That, params: ", - "SearchMvtRequest", - " | ", - "SearchMvtRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise; (this: That, params: ", - "SearchMvtRequest", - " | ", - "SearchMvtRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - ">; (this: That, params: ", - "SearchMvtRequest", - " | ", - "SearchMvtRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise; }; searchShards: { (this: That, params?: ", - "SearchShardsRequest", - " | ", - "SearchShardsRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "SearchShardsResponse", - ">; (this: That, params?: ", - "SearchShardsRequest", - " | ", - "SearchShardsRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "SearchShardsResponse", - ", unknown>>; (this: That, params?: ", - "SearchShardsRequest", - " | ", - "SearchShardsRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "SearchShardsResponse", - ">; }; searchTemplate: { (this: That, params?: ", - "SearchTemplateRequest", - " | ", - "SearchTemplateRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "SearchTemplateResponse", - ">; (this: That, params?: ", - "SearchTemplateRequest", - " | ", - "SearchTemplateRequest", - " | undefined, options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "SearchTemplateResponse", - ", unknown>>; (this: That, params?: ", - "SearchTemplateRequest", - " | ", - "SearchTemplateRequest", - " | undefined, options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "SearchTemplateResponse", - ">; }; searchableSnapshots: ", - "default", - "; shutdown: ", - "default", - "; slm: ", - "default", - "; snapshot: ", - "default", - "; sql: ", - "default", - "; ssl: ", - "default", - "; tasks: ", - "default", - "; termsEnum: { (this: That, params: ", - "TermsEnumRequest", - " | ", - "TermsEnumRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "TermsEnumResponse", - ">; (this: That, params: ", - "TermsEnumRequest", - " | ", - "TermsEnumRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "TermsEnumResponse", - ", unknown>>; (this: That, params: ", - "TermsEnumRequest", - " | ", - "TermsEnumRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "TermsEnumResponse", - ">; }; termvectors: { (this: That, params: ", - "TermvectorsRequest", - " | ", - "TermvectorsRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "TermvectorsResponse", - ">; (this: That, params: ", - "TermvectorsRequest", - " | ", - "TermvectorsRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "TermvectorsResponse", - ", unknown>>; (this: That, params: ", - "TermvectorsRequest", - " | ", - "TermvectorsRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "TermvectorsResponse", - ">; }; textStructure: ", - "default", - "; transform: ", - "default", - "; updateByQuery: { (this: That, params: ", - "UpdateByQueryRequest", - " | ", - "UpdateByQueryRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "UpdateByQueryResponse", - ">; (this: That, params: ", - "UpdateByQueryRequest", - " | ", - "UpdateByQueryRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "UpdateByQueryResponse", - ", unknown>>; (this: That, params: ", - "UpdateByQueryRequest", - " | ", - "UpdateByQueryRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "UpdateByQueryResponse", - ">; }; updateByQueryRethrottle: { (this: That, params: ", - "UpdateByQueryRethrottleRequest", - " | ", - "UpdateByQueryRethrottleRequest", - ", options?: ", - "TransportRequestOptionsWithOutMeta", - " | undefined): Promise<", - "UpdateByQueryRethrottleResponse", - ">; (this: That, params: ", - "UpdateByQueryRethrottleRequest", - " | ", - "UpdateByQueryRethrottleRequest", - ", options?: ", - "TransportRequestOptionsWithMeta", - " | undefined): Promise<", - "TransportResult", - "<", - "UpdateByQueryRethrottleResponse", - ", unknown>>; (this: That, params: ", - "UpdateByQueryRethrottleRequest", - " | ", - "UpdateByQueryRethrottleRequest", - ", options?: ", - "TransportRequestOptions", - " | undefined): Promise<", - "UpdateByQueryRethrottleResponse", - ">; }; watcher: ", - "default", - "; xpack: ", - "default", - "; }" - ], - "path": "src/plugins/data_views/server/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$3", - "type": "Object", - "tags": [], - "label": "request", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-http-server", - "scope": "common", - "docId": "kibKbnCoreHttpServerPluginApi", - "section": "def-common.KibanaRequest", - "text": "KibanaRequest" - }, - " | undefined" - ], - "path": "src/plugins/data_views/server/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$4", - "type": "CompoundType", - "tags": [], - "label": "byPassCapabilities", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/server/types.ts", - "deprecated": false, - "trackAdoption": false - } - ] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor", - "type": "Interface", - "tags": [], - "label": "FieldDescriptor", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.aggregatable", - "type": "boolean", - "tags": [], - "label": "aggregatable", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.name", - "type": "string", - "tags": [], - "label": "name", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.readFromDocValues", - "type": "boolean", - "tags": [], - "label": "readFromDocValues", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.searchable", - "type": "boolean", - "tags": [], - "label": "searchable", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.type", - "type": "string", - "tags": [], - "label": "type", - "description": [], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.esTypes", - "type": "Array", - "tags": [], - "label": "esTypes", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.subType", - "type": "Object", - "tags": [], - "label": "subType", - "description": [], - "signature": [ - "FieldSubType | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.metadata_field", - "type": "CompoundType", - "tags": [], - "label": "metadata_field", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.fixedInterval", - "type": "Array", - "tags": [], - "label": "fixedInterval", - "description": [], - "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.timeZone", - "type": "Array", - "tags": [], - "label": "timeZone", - "description": [], - "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.timeSeriesMetric", - "type": "CompoundType", - "tags": [], - "label": "timeSeriesMetric", - "description": [], - "signature": [ - "\"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.FieldDescriptor.timeSeriesDimension", - "type": "CompoundType", - "tags": [], - "label": "timeSeriesDimension", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.IEsSearchRequest", - "type": "Interface", - "tags": [], - "label": "IEsSearchRequest", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IEsSearchRequest", - "text": "IEsSearchRequest" - }, - " extends ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IKibanaSearchRequest", - "text": "IKibanaSearchRequest" - }, - "<", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.ISearchRequestParams", - "text": "ISearchRequestParams" - }, - ">" - ], - "path": "src/plugins/data/common/search/strategies/es_search/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.IEsSearchRequest.indexType", - "type": "string", - "tags": [], - "label": "indexType", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/common/search/strategies/es_search/types.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions", - "type": "Interface", - "tags": [], - "label": "ISearchOptions", - "description": [], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.abortSignal", - "type": "Object", - "tags": [], - "label": "abortSignal", - "description": [ - "\nAn `AbortSignal` that allows the caller of `search` to abort a search request." - ], - "signature": [ - "AbortSignal | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.strategy", - "type": "string", - "tags": [], - "label": "strategy", - "description": [ - "\nUse this option to force using a specific server side search strategy. Leave empty to use the default strategy." - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.legacyHitsTotal", - "type": "CompoundType", - "tags": [], - "label": "legacyHitsTotal", - "description": [ - "\nRequest the legacy format for the total number of hits. If sending `rest_total_hits_as_int` to\nsomething other than `true`, this should be set to `false`." - ], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.sessionId", - "type": "string", - "tags": [], - "label": "sessionId", - "description": [ - "\nA session ID, grouping multiple search requests into a single session." - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.isStored", - "type": "CompoundType", - "tags": [], - "label": "isStored", - "description": [ - "\nWhether the session is already saved (i.e. sent to background)" - ], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.isSearchStored", - "type": "CompoundType", - "tags": [], - "label": "isSearchStored", - "description": [ - "\nWhether the search was successfully polled after session was saved. Search was added to a session saved object and keepAlive extended." - ], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.isRestore", - "type": "CompoundType", - "tags": [], - "label": "isRestore", - "description": [ - "\nWhether the session is restored (i.e. search requests should re-use the stored search IDs,\nrather than starting from scratch)" - ], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.executionContext", - "type": "Object", - "tags": [], - "label": "executionContext", - "description": [ - "\nRepresents a meta-information about a Kibana entity intitating a saerch request." - ], - "signature": [ - { - "pluginId": "@kbn/core-execution-context-common", - "scope": "common", - "docId": "kibKbnCoreExecutionContextCommonPluginApi", - "section": "def-common.KibanaExecutionContext", - "text": "KibanaExecutionContext" - }, - " | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.indexPattern", - "type": "Object", - "tags": [], - "label": "indexPattern", - "description": [ - "\nIndex pattern reference is used for better error messages" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.ISearchOptions.transport", - "type": "Object", - "tags": [], - "label": "transport", - "description": [ - "\nTransportRequestOptions, other than `signal`, to pass through to the ES client.\nTo pass an abort signal, use {@link ISearchOptions.abortSignal}" - ], - "signature": [ - "Omit<", - "TransportRequestOptions", - ", \"signal\"> | undefined" - ], - "path": "src/plugins/data/common/search/types.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - } - ], - "enums": [ - { - "parentPluginId": "data", - "id": "def-server.ES_FIELD_TYPES", - "type": "Enum", - "tags": [], - "label": "ES_FIELD_TYPES", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.KBN_FIELD_TYPES", - "type": "Enum", - "tags": [], - "label": "KBN_FIELD_TYPES", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.METRIC_TYPES", - "type": "Enum", - "tags": [], - "label": "METRIC_TYPES", - "description": [], - "path": "src/plugins/data/common/search/aggs/metrics/metric_agg_types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - } - ], - "misc": [ - { - "parentPluginId": "data", - "id": "def-server.DEFAULT_QUERY_LANGUAGE", - "type": "string", - "tags": [], - "label": "DEFAULT_QUERY_LANGUAGE", - "description": [], - "signature": [ - "\"kuery\"" - ], - "path": "src/plugins/data/common/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.ES_SEARCH_STRATEGY", - "type": "string", - "tags": [], - "label": "ES_SEARCH_STRATEGY", - "description": [], - "signature": [ - "\"es\"" - ], - "path": "src/plugins/data/common/search/strategies/es_search/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.IEsSearchResponse", - "type": "Type", - "tags": [], - "label": "IEsSearchResponse", - "description": [], - "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IKibanaSearchResponse", - "text": "IKibanaSearchResponse" - }, - "<", - "SearchResponse", - ">>" - ], - "path": "src/plugins/data/common/search/strategies/es_search/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.ParsedInterval", - "type": "Type", - "tags": [], - "label": "ParsedInterval", - "description": [], - "signature": [ - "{ value: number; unit: ", - { - "pluginId": "@kbn/datemath", - "scope": "common", - "docId": "kibKbnDatemathPluginApi", - "section": "def-common.Unit", - "text": "Unit" - }, - "; type: \"fixed\" | \"calendar\"; }" - ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_es_interval.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - } - ], - "objects": [ - { - "parentPluginId": "data", - "id": "def-server.exporters", - "type": "Object", - "tags": [], - "label": "exporters", - "description": [], - "path": "src/plugins/data/server/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + "parentPluginId": "data", + "id": "def-public.indexPatterns.validate", + "type": "Function", + "tags": [], + "label": "validate", + "description": [], + "signature": [ + "(indexPattern: string) => { ILLEGAL_CHARACTERS?: string[] | undefined; CONTAINS_SPACES?: boolean | undefined; }" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.indexPatterns.validate.$1", + "type": "string", + "tags": [], + "label": "indexPattern", + "description": [], + "path": "src/plugins/data_views/common/lib/validate_data_view.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.search", + "type": "Object", + "tags": [], + "label": "search", + "description": [], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-server.exporters.datatableToCSV", - "type": "Function", + "id": "def-public.search.aggs", + "type": "Object", "tags": [], - "label": "datatableToCSV", + "label": "aggs", "description": [], - "signature": [ - "({ columns, rows }: ", + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" + "parentPluginId": "data", + "id": "def-public.search.aggs.CidrMask", + "type": "Object", + "tags": [], + "label": "CidrMask", + "description": [], + "signature": [ + "typeof ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.CidrMask", + "text": "CidrMask" + } + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.dateHistogramInterval", + "type": "Function", + "tags": [], + "label": "dateHistogramInterval", + "description": [], + "signature": [ + "(interval: string, shouldForceFixed?: boolean | undefined) => Interval" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.dateHistogramInterval.$1", + "type": "string", + "tags": [], + "label": "interval", + "description": [], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.dateHistogramInterval.$2", + "type": "CompoundType", + "tags": [], + "label": "shouldForceFixed", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.intervalOptions", + "type": "Array", + "tags": [], + "label": "intervalOptions", + "description": [], + "signature": [ + "({ display: any; val: string; enabled(agg: ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IBucketAggConfig", + "text": "IBucketAggConfig" + }, + "): boolean; } | { display: any; val: string; })[]" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.InvalidEsCalendarIntervalError", + "type": "Object", + "tags": [], + "label": "InvalidEsCalendarIntervalError", + "description": [], + "signature": [ + "typeof ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.InvalidEsCalendarIntervalError", + "text": "InvalidEsCalendarIntervalError" + } + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.InvalidEsIntervalFormatError", + "type": "Object", + "tags": [], + "label": "InvalidEsIntervalFormatError", + "description": [], + "signature": [ + "typeof ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.InvalidEsIntervalFormatError", + "text": "InvalidEsIntervalFormatError" + } + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.IpAddress", + "type": "Object", + "tags": [], + "label": "IpAddress", + "description": [], + "signature": [ + "typeof ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IpAddress", + "text": "IpAddress" + } + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isDateHistogramBucketAggConfig", + "type": "Function", + "tags": [], + "label": "isDateHistogramBucketAggConfig", + "description": [], + "signature": [ + "(agg: any) => agg is ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IBucketDateHistogramAggConfig", + "text": "IBucketDateHistogramAggConfig" + } + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isDateHistogramBucketAggConfig.$1", + "type": "Any", + "tags": [], + "label": "agg", + "description": [], + "signature": [ + "any" + ], + "path": "src/plugins/data/common/search/aggs/buckets/date_histogram.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isNumberType", + "type": "Function", + "tags": [], + "label": "isNumberType", + "description": [], + "signature": [ + "(agg: ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + }, + ") => boolean" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isNumberType.$1", + "type": "Object", + "tags": [], + "label": "agg", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + } + ], + "path": "src/plugins/data/common/search/aggs/buckets/migrate_include_exclude_format.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, - ", { csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }: CSVOptions) => string" - ], - "path": "src/plugins/data/server/index.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ { "parentPluginId": "data", - "id": "def-server.exporters.datatableToCSV.$1", - "type": "Object", + "id": "def-public.search.aggs.isStringType", + "type": "Function", "tags": [], - "label": "__0", + "label": "isStringType", "description": [], "signature": [ + "(agg: ", { - "pluginId": "expressions", + "pluginId": "data", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - } + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + }, + ") => boolean" ], - "path": "src/plugins/data/common/exports/export_csv.tsx", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isStringType.$1", + "type": "Object", + "tags": [], + "label": "agg", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + } + ], + "path": "src/plugins/data/common/search/aggs/buckets/migrate_include_exclude_format.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { "parentPluginId": "data", - "id": "def-server.exporters.datatableToCSV.$2", - "type": "Object", + "id": "def-public.search.aggs.isType", + "type": "Function", "tags": [], - "label": "__1", + "label": "isType", "description": [], "signature": [ - "CSVOptions" + "(...types: string[]) => (agg: ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + }, + ") => boolean" ], - "path": "src/plugins/data/common/exports/export_csv.tsx", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false - } - ] - }, - { - "parentPluginId": "data", - "id": "def-server.exporters.CSV_MIME_TYPE", - "type": "string", - "tags": [], - "label": "CSV_MIME_TYPE", - "description": [], - "path": "src/plugins/data/server/index.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.search", - "type": "Object", - "tags": [], - "label": "search", - "description": [], - "path": "src/plugins/data/server/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.search.aggs", - "type": "Object", - "tags": [], - "label": "aggs", - "description": [], - "path": "src/plugins/data/server/index.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isType.$1", + "type": "Array", + "tags": [], + "label": "types", + "description": [], + "signature": [ + "string[]" + ], + "path": "src/plugins/data/common/search/aggs/buckets/migrate_include_exclude_format.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, { "parentPluginId": "data", - "id": "def-server.search.aggs.CidrMask", - "type": "Object", + "id": "def-public.search.aggs.isValidEsInterval", + "type": "Function", "tags": [], - "label": "CidrMask", + "label": "isValidEsInterval", "description": [], "signature": [ - "typeof ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.CidrMask", - "text": "CidrMask" - } + "(interval: string) => boolean" ], - "path": "src/plugins/data/server/index.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.isValidEsInterval.$1", + "type": "string", + "tags": [], + "label": "interval", + "description": [], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/is_valid_es_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { "parentPluginId": "data", - "id": "def-server.search.aggs.dateHistogramInterval", + "id": "def-public.search.aggs.isValidInterval", "type": "Function", "tags": [], - "label": "dateHistogramInterval", + "label": "isValidInterval", "description": [], "signature": [ - "(interval: string, shouldForceFixed?: boolean | undefined) => Interval" + "(value: string, baseInterval?: string | undefined) => boolean" ], - "path": "src/plugins/data/server/index.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-server.search.aggs.dateHistogramInterval.$1", + "id": "def-public.search.aggs.isValidInterval.$1", "type": "string", "tags": [], - "label": "interval", + "label": "value", "description": [], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/is_valid_interval.ts", "deprecated": false, "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-server.search.aggs.dateHistogramInterval.$2", - "type": "CompoundType", + "id": "def-public.search.aggs.isValidInterval.$2", + "type": "string", "tags": [], - "label": "shouldForceFixed", + "label": "baseInterval", "description": [], "signature": [ - "boolean | undefined" + "string | undefined" ], - "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/is_valid_interval.ts", "deprecated": false, "trackAdoption": false } @@ -21007,28 +12404,57 @@ }, { "parentPluginId": "data", - "id": "def-server.search.aggs.IpAddress", - "type": "Object", + "id": "def-public.search.aggs.parentPipelineType", + "type": "Any", "tags": [], - "label": "IpAddress", + "label": "parentPipelineType", "description": [], "signature": [ - "typeof ", + "any" + ], + "path": "src/plugins/data/public/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.parseEsInterval", + "type": "Function", + "tags": [], + "label": "parseEsInterval", + "description": [], + "signature": [ + "(interval: string) => { value: number; unit: ", { - "pluginId": "data", + "pluginId": "@kbn/datemath", "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IpAddress", - "text": "IpAddress" - } + "docId": "kibKbnDatemathPluginApi", + "section": "def-common.Unit", + "text": "Unit" + }, + "; type: \"fixed\" | \"calendar\"; }" ], - "path": "src/plugins/data/server/index.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.parseEsInterval.$1", + "type": "string", + "tags": [], + "label": "interval", + "description": [], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_es_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, { "parentPluginId": "data", - "id": "def-server.search.aggs.parseInterval", + "id": "def-public.search.aggs.parseInterval", "type": "Function", "tags": [], "label": "parseInterval", @@ -21036,14 +12462,14 @@ "signature": [ "(interval: string) => moment.Duration | null" ], - "path": "src/plugins/data/server/index.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-server.search.aggs.parseInterval.$1", + "id": "def-public.search.aggs.parseInterval.$1", "type": "string", "tags": [], "label": "interval", @@ -21056,833 +12482,843 @@ }, { "parentPluginId": "data", - "id": "def-server.search.aggs.calcAutoIntervalLessThan", + "id": "def-public.search.aggs.propFilter", "type": "Function", "tags": [], - "label": "calcAutoIntervalLessThan", + "label": "propFilter", "description": [], "signature": [ - "(maxBucketCount: number, duration: number) => moment.Duration" + "

(prop: P) => (list: T[], filters?: string | string[] | FilterFunc) => T[]" ], - "path": "src/plugins/data/server/index.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-server.search.aggs.calcAutoIntervalLessThan.$1", - "type": "number", - "tags": [], - "label": "maxBucketCount", - "description": [], - "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.search.aggs.calcAutoIntervalLessThan.$2", - "type": "number", + "id": "def-public.search.aggs.propFilter.$1", + "type": "Uncategorized", "tags": [], - "label": "duration", + "label": "prop", "description": [], - "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", + "signature": [ + "P" + ], + "path": "src/plugins/data/common/search/aggs/utils/prop_filter.ts", "deprecated": false, - "trackAdoption": false - } - ] - } - ] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-server.UI_SETTINGS", - "type": "Object", - "tags": [], - "label": "UI_SETTINGS", - "description": [], - "signature": [ - "{ readonly META_FIELDS: \"metaFields\"; readonly DOC_HIGHLIGHT: \"doc_table:highlight\"; readonly QUERY_STRING_OPTIONS: \"query:queryString:options\"; readonly QUERY_ALLOW_LEADING_WILDCARDS: \"query:allowLeadingWildcards\"; readonly SEARCH_QUERY_LANGUAGE: \"search:queryLanguage\"; readonly SORT_OPTIONS: \"sort:options\"; readonly COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX: \"courier:ignoreFilterIfFieldNotInIndex\"; readonly COURIER_SET_REQUEST_PREFERENCE: \"courier:setRequestPreference\"; readonly COURIER_CUSTOM_REQUEST_PREFERENCE: \"courier:customRequestPreference\"; readonly COURIER_MAX_CONCURRENT_SHARD_REQUESTS: \"courier:maxConcurrentShardRequests\"; readonly SEARCH_INCLUDE_FROZEN: \"search:includeFrozen\"; readonly SEARCH_TIMEOUT: \"search:timeout\"; readonly HISTOGRAM_BAR_TARGET: \"histogram:barTarget\"; readonly HISTOGRAM_MAX_BARS: \"histogram:maxBars\"; readonly HISTORY_LIMIT: \"history:limit\"; readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: \"timepicker:refreshIntervalDefaults\"; readonly TIMEPICKER_QUICK_RANGES: \"timepicker:quickRanges\"; readonly TIMEPICKER_TIME_DEFAULTS: \"timepicker:timeDefaults\"; readonly FILTERS_PINNED_BY_DEFAULT: \"filters:pinnedByDefault\"; readonly FILTERS_EDITOR_SUGGEST_VALUES: \"filterEditor:suggestValues\"; readonly AUTOCOMPLETE_USE_TIMERANGE: \"autocomplete:useTimeRange\"; readonly AUTOCOMPLETE_VALUE_SUGGESTION_METHOD: \"autocomplete:valueSuggestionMethod\"; readonly DATE_FORMAT: \"dateFormat\"; readonly DATEFORMAT_TZ: \"dateFormat:tz\"; }" - ], - "path": "src/plugins/data/common/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - } - ], - "setup": { - "parentPluginId": "data", - "id": "def-server.DataPluginSetup", - "type": "Interface", - "tags": [], - "label": "DataPluginSetup", - "description": [], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataPluginSetup.search", - "type": "Object", - "tags": [], - "label": "search", - "description": [], - "signature": [ - "ISearchSetup" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataPluginSetup.query", - "type": "Object", - "tags": [], - "label": "query", - "description": [], - "signature": [ - "QuerySetup" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataPluginSetup.fieldFormats", - "type": "Object", - "tags": [ - "deprecated" - ], - "label": "fieldFormats", - "description": [], - "signature": [ - { - "pluginId": "fieldFormats", - "scope": "server", - "docId": "kibFieldFormatsPluginApi", - "section": "def-server.FieldFormatsSetup", - "text": "FieldFormatsSetup" - } - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": true, - "trackAdoption": false, - "references": [] - } - ], - "lifecycle": "setup", - "initialIsOpen": true - }, - "start": { - "parentPluginId": "data", - "id": "def-server.DataPluginStart", - "type": "Interface", - "tags": [], - "label": "DataPluginStart", - "description": [], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-server.DataPluginStart.search", - "type": "Object", - "tags": [], - "label": "search", - "description": [], - "signature": [ - "ISearchStart", - "<", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IEsSearchRequest", - "text": "IEsSearchRequest" - }, - ", ", - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.IEsSearchResponse", - "text": "IEsSearchResponse" - }, - ">" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataPluginStart.fieldFormats", - "type": "Object", - "tags": [ - "deprecated" - ], - "label": "fieldFormats", - "description": [], - "signature": [ - { - "pluginId": "fieldFormats", - "scope": "server", - "docId": "kibFieldFormatsPluginApi", - "section": "def-server.FieldFormatsStart", - "text": "FieldFormatsStart" - } - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": true, - "trackAdoption": false, - "references": [] - }, - { - "parentPluginId": "data", - "id": "def-server.DataPluginStart.indexPatterns", - "type": "Object", - "tags": [], - "label": "indexPatterns", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "server", - "docId": "kibDataViewsPluginApi", - "section": "def-server.DataViewsServerPluginStart", - "text": "DataViewsServerPluginStart" - } - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-server.DataPluginStart.datatableUtilities", - "type": "Object", - "tags": [], - "label": "datatableUtilities", - "description": [ - "\nDatatable type utility functions." - ], - "signature": [ - "DatatableUtilitiesService" - ], - "path": "src/plugins/data/server/plugin.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "lifecycle": "start", - "initialIsOpen": true - } - }, - "common": { - "classes": [ - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService", - "type": "Class", - "tags": [], - "label": "DatatableUtilitiesService", - "description": [], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [], - "signature": [ - "any" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + "trackAdoption": false + } + ] + }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.Unnamed.$1", - "type": "Object", + "id": "def-public.search.aggs.siblingPipelineType", + "type": "Any", "tags": [], - "label": "aggs", + "label": "siblingPipelineType", "description": [], "signature": [ - { - "pluginId": "data", - "scope": "common", - "docId": "kibDataSearchPluginApi", - "section": "def-common.AggsCommonStart", - "text": "AggsCommonStart" - } + "any" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.Unnamed.$2", - "type": "Object", + "id": "def-public.search.aggs.termsAggFilter", + "type": "Array", "tags": [], - "label": "dataViews", + "label": "termsAggFilter", "description": [], "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewsContract", - "text": "DataViewsContract" - } + "string[]" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.Unnamed.$3", - "type": "Object", + "id": "def-public.search.aggs.toAbsoluteDates", + "type": "Function", "tags": [], - "label": "fieldFormats", + "label": "toAbsoluteDates", "description": [], "signature": [ + "(range: ", { - "pluginId": "fieldFormats", + "pluginId": "@kbn/es-query", "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormatsStartCommon", - "text": "FieldFormatsStartCommon" - } + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.TimeRange", + "text": "TimeRange" + }, + ") => { from: Date; to: Date; } | undefined" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.clearField", - "type": "Function", - "tags": [], - "label": "clearField", - "description": [], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.toAbsoluteDates.$1", + "type": "Object", + "tags": [], + "label": "range", + "description": [], + "signature": [ + "{ from: string; to: string; mode?: \"absolute\" | \"relative\" | undefined; }" + ], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/to_absolute_dates.ts", + "deprecated": false, + "trackAdoption": false + } + ] }, - ") => void" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.clearField.$1", - "type": "Object", + "id": "def-public.search.aggs.boundsDescendingRaw", + "type": "Array", "tags": [], - "label": "column", + "label": "boundsDescendingRaw", "description": [], "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } + "({ bound: number; interval: moment.Duration; boundLabel: any; intervalLabel: any; } | { bound: moment.Duration; interval: moment.Duration; boundLabel: any; intervalLabel: any; })[]" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.clearFieldFormat", - "type": "Function", - "tags": [], - "label": "clearFieldFormat", - "description": [], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" + "trackAdoption": false }, - ") => void" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.clearFieldFormat.$1", - "type": "Object", + "id": "def-public.search.aggs.calcAutoIntervalLessThan", + "type": "Function", "tags": [], - "label": "column", + "label": "calcAutoIntervalLessThan", "description": [], "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } + "(maxBucketCount: number, duration: number) => moment.Duration" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-public.search.aggs.calcAutoIntervalLessThan.$1", + "type": "number", + "tags": [], + "label": "maxBucketCount", + "description": [], + "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.aggs.calcAutoIntervalLessThan.$2", + "type": "number", + "tags": [], + "label": "duration", + "description": [], + "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] } - ], - "returnComment": [] + ] }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getAggConfig", + "id": "def-public.search.getResponseInspectorStats", "type": "Function", "tags": [], - "label": "getAggConfig", + "label": "getResponseInspectorStats", "description": [], "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ") => Promise<", + "(resp?: ", + "SearchResponse", + "> | undefined, searchSource?: ", { "pluginId": "data", "scope": "common", "docId": "kibDataSearchPluginApi", - "section": "def-common.AggConfig", - "text": "AggConfig" + "section": "def-common.ISearchSource", + "text": "ISearchSource" }, - " | undefined>" + " | undefined) => ", + { + "pluginId": "inspector", + "scope": "common", + "docId": "kibInspectorPluginApi", + "section": "def-common.RequestStatistics", + "text": "RequestStatistics" + } ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, + "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getAggConfig.$1", + "id": "def-public.search.getResponseInspectorStats.$1", "type": "Object", "tags": [], - "label": "column", + "label": "resp", "description": [], "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } + "SearchResponse", + "> | undefined" + ], + "path": "src/plugins/data/common/search/search_source/inspect/inspector_stats.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.getResponseInspectorStats.$2", + "type": "Object", + "tags": [], + "label": "searchSource", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.ISearchSource", + "text": "ISearchSource" + }, + " | undefined" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/common/search/search_source/inspect/inspector_stats.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false } - ], - "returnComment": [] + ] }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getDateHistogramMeta", + "id": "def-public.search.tabifyAggResponse", "type": "Function", "tags": [], - "label": "getDateHistogramMeta", - "description": [ - "\nHelper function returning the used interval, used time zone and applied time filters for data table column created by the date_histogramm agg type.\n\"auto\" will get expanded to the actually used interval.\nIf the column is not a column created by a date_histogram aggregation of the esaggs data source,\nthis function will return undefined." - ], + "label": "tabifyAggResponse", + "description": [], "signature": [ - "(column: ", + "(aggConfigs: ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfigs", + "text": "AggConfigs" + }, + ", esResponse: Record, respOpts?: Partial<", + "TabbedResponseWriterOptions", + "> | undefined) => ", { "pluginId": "expressions", "scope": "common", "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ", defaults?: Partial<{ timeZone: string; }>) => DateHistogramMeta | undefined" + "section": "def-common.Datatable", + "text": "Datatable" + } ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, + "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getDateHistogramMeta.$1", + "id": "def-public.search.tabifyAggResponse.$1", "type": "Object", "tags": [], - "label": "column", + "label": "aggConfigs", "description": [], "signature": [ { - "pluginId": "expressions", + "pluginId": "data", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfigs", + "text": "AggConfigs" } ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/common/search/tabify/tabify.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getDateHistogramMeta.$2", + "id": "def-public.search.tabifyAggResponse.$2", "type": "Object", "tags": [], - "label": "defaults", + "label": "esResponse", "description": [], "signature": [ - "Partial<{ timeZone: string; }>" + "{ [x: string]: any; }" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/common/search/tabify/tabify.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.tabifyAggResponse.$3", + "type": "Object", + "tags": [], + "label": "respOpts", + "description": [], + "signature": [ + "Partial<", + "TabbedResponseWriterOptions", + "> | undefined" + ], + "path": "src/plugins/data/common/search/tabify/tabify.ts", + "deprecated": false, + "trackAdoption": false } - ], - "returnComment": [] + ] }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getDataView", + "id": "def-public.search.tabifyGetColumns", "type": "Function", "tags": [], - "label": "getDataView", + "label": "tabifyGetColumns", "description": [], "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ") => Promise<", + "(aggs: ", { - "pluginId": "dataViews", + "pluginId": "data", "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" }, - " | undefined>" + "[], minimalColumns: boolean) => ", + "TabbedAggColumn", + "[]" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/public/index.ts", "deprecated": false, "trackAdoption": false, + "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getDataView.$1", - "type": "Object", + "id": "def-public.search.tabifyGetColumns.$1", + "type": "Array", "tags": [], - "label": "column", + "label": "aggs", "description": [], "signature": [ { - "pluginId": "expressions", + "pluginId": "data", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + }, + "[]" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/common/search/tabify/get_columns.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.search.tabifyGetColumns.$2", + "type": "boolean", + "tags": [], + "label": "minimalColumns", + "description": [], + "path": "src/plugins/data/common/search/tabify/get_columns.ts", + "deprecated": false, + "trackAdoption": false } - ], - "returnComment": [] - }, + ] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-public.UI_SETTINGS", + "type": "Object", + "tags": [], + "label": "UI_SETTINGS", + "description": [], + "signature": [ + "{ readonly META_FIELDS: \"metaFields\"; readonly DOC_HIGHLIGHT: \"doc_table:highlight\"; readonly QUERY_STRING_OPTIONS: \"query:queryString:options\"; readonly QUERY_ALLOW_LEADING_WILDCARDS: \"query:allowLeadingWildcards\"; readonly SEARCH_QUERY_LANGUAGE: \"search:queryLanguage\"; readonly SORT_OPTIONS: \"sort:options\"; readonly COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX: \"courier:ignoreFilterIfFieldNotInIndex\"; readonly COURIER_SET_REQUEST_PREFERENCE: \"courier:setRequestPreference\"; readonly COURIER_CUSTOM_REQUEST_PREFERENCE: \"courier:customRequestPreference\"; readonly COURIER_MAX_CONCURRENT_SHARD_REQUESTS: \"courier:maxConcurrentShardRequests\"; readonly SEARCH_INCLUDE_FROZEN: \"search:includeFrozen\"; readonly SEARCH_TIMEOUT: \"search:timeout\"; readonly HISTOGRAM_BAR_TARGET: \"histogram:barTarget\"; readonly HISTOGRAM_MAX_BARS: \"histogram:maxBars\"; readonly HISTORY_LIMIT: \"history:limit\"; readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: \"timepicker:refreshIntervalDefaults\"; readonly TIMEPICKER_QUICK_RANGES: \"timepicker:quickRanges\"; readonly TIMEPICKER_TIME_DEFAULTS: \"timepicker:timeDefaults\"; readonly FILTERS_PINNED_BY_DEFAULT: \"filters:pinnedByDefault\"; readonly FILTERS_EDITOR_SUGGEST_VALUES: \"filterEditor:suggestValues\"; readonly AUTOCOMPLETE_USE_TIMERANGE: \"autocomplete:useTimeRange\"; readonly AUTOCOMPLETE_VALUE_SUGGESTION_METHOD: \"autocomplete:valueSuggestionMethod\"; readonly DATE_FORMAT: \"dateFormat\"; readonly DATEFORMAT_TZ: \"dateFormat:tz\"; }" + ], + "path": "src/plugins/data/common/constants.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + } + ], + "setup": { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginSetup", + "type": "Interface", + "tags": [], + "label": "DataPublicPluginSetup", + "description": [ + "\nData plugin public Setup contract" + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginSetup.search", + "type": "Object", + "tags": [], + "label": "search", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataSearchPluginApi", + "section": "def-public.ISearchSetup", + "text": "ISearchSetup" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginSetup.query", + "type": "Object", + "tags": [], + "label": "query", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QuerySetup", + "text": "QuerySetup" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "lifecycle": "setup", + "initialIsOpen": true + }, + "start": { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart", + "type": "Interface", + "tags": [], + "label": "DataPublicPluginStart", + "description": [ + "\nData plugin public Start contract" + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.actions", + "type": "Object", + "tags": [], + "label": "actions", + "description": [ + "\nfilter creation utilities\n{@link DataPublicPluginStartActions}" + ], + "signature": [ + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataPluginApi", + "section": "def-public.DataPublicPluginStartActions", + "text": "DataPublicPluginStartActions" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.dataViews", + "type": "Object", + "tags": [], + "label": "dataViews", + "description": [ + "\ndata views service\n{@link DataViewsContract}" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "public", + "docId": "kibDataViewsPluginApi", + "section": "def-public.DataViewsServicePublic", + "text": "DataViewsServicePublic" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.datatableUtilities", + "type": "Object", + "tags": [], + "label": "datatableUtilities", + "description": [ + "\nDatatable type utility functions." + ], + "signature": [ + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataPluginApi", + "section": "def-common.DatatableUtilitiesService", + "text": "DatatableUtilitiesService" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.indexPatterns", + "type": "Object", + "tags": [ + "deprecated" + ], + "label": "indexPatterns", + "description": [ + "\nindex patterns service\n{@link DataViewsContract}" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "public", + "docId": "kibDataViewsPluginApi", + "section": "def-public.DataViewsServicePublic", + "text": "DataViewsServicePublic" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/hooks/use_kibana_index_patterns.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/plugin.ts" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/boundary_index_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/entity_index_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "inputControlVis", + "path": "src/plugins/input_control_vis/public/control/list_control_factory.ts" + }, + { + "plugin": "inputControlVis", + "path": "src/plugins/input_control_vis/public/control/range_control_factory.ts" + }, + { + "plugin": "inputControlVis", + "path": "src/plugins/input_control_vis/public/components/editor/controls_tab.tsx" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/mock/endpoint/dependencies_start_mock.ts" + }, + { + "plugin": "savedObjects", + "path": "src/plugins/saved_objects/public/saved_object/saved_object.test.ts" + }, + { + "plugin": "savedObjects", + "path": "src/plugins/saved_objects/public/saved_object/saved_object.test.ts" + } + ] + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.search", + "type": "Object", + "tags": [], + "label": "search", + "description": [ + "\nsearch service\n{@link ISearchStart}" + ], + "signature": [ + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataSearchPluginApi", + "section": "def-public.ISearchStart", + "text": "ISearchStart" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.fieldFormats", + "type": "CompoundType", + "tags": [ + "deprecated" + ], + "label": "fieldFormats", + "description": [], + "signature": [ + "Omit<", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormatsRegistry", + "text": "FieldFormatsRegistry" + }, + ", \"init\" | \"register\"> & { deserialize: ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FormatFactory", + "text": "FormatFactory" + }, + "; }" + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "dashboard", + "path": "src/plugins/dashboard/public/services/data/types.ts" + }, + { + "plugin": "dashboard", + "path": "src/plugins/dashboard/public/services/data/data_service.ts" + }, + { + "plugin": "dataVisualizer", + "path": "x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_row/document_stats.tsx" + }, + { + "plugin": "dataVisualizer", + "path": "x-pack/plugins/data_visualizer/public/application/common/components/top_values/top_values.tsx" + }, + { + "plugin": "dataVisualizer", + "path": "x-pack/plugins/data_visualizer/public/application/common/components/stats_table/components/field_data_expanded_row/choropleth_map.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/threshold/expression.tsx" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + }, + { + "plugin": "expressionPartitionVis", + "path": "src/plugins/chart_expressions/expression_partition_vis/public/utils/layers/get_layers.test.ts" + } + ] + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.query", + "type": "Object", + "tags": [], + "label": "query", + "description": [ + "\nquery service\n{@link QueryStart}" + ], + "signature": [ + { + "pluginId": "data", + "scope": "public", + "docId": "kibDataQueryPluginApi", + "section": "def-public.QueryStart", + "text": "QueryStart" + } + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-public.DataPublicPluginStart.nowProvider", + "type": "Object", + "tags": [], + "label": "nowProvider", + "description": [], + "signature": [ + "{ get: () => Date; }" + ], + "path": "src/plugins/data/public/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "lifecycle": "start", + "initialIsOpen": true + } + }, + "server": { + "classes": [ + { + "parentPluginId": "data", + "id": "def-server.DataServerPlugin", + "type": "Class", + "tags": [], + "label": "DataServerPlugin", + "description": [], + "signature": [ { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getField", - "type": "Function", - "tags": [], - "label": "getField", - "description": [], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ") => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | undefined>" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getField.$1", - "type": "Object", - "tags": [], - "label": "column", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "pluginId": "data", + "scope": "server", + "docId": "kibDataPluginApi", + "section": "def-server.DataServerPlugin", + "text": "DataServerPlugin" }, + " implements ", { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getFieldFormat", - "type": "Function", - "tags": [], - "label": "getFieldFormat", - "description": [], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ") => ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormat", - "text": "FieldFormat" - }, - " | undefined" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getFieldFormat.$1", - "type": "Object", - "tags": [], - "label": "column", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "pluginId": "@kbn/core-plugins-server", + "scope": "common", + "docId": "kibKbnCorePluginsServerPluginApi", + "section": "def-common.Plugin", + "text": "Plugin" }, + "<", { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getInterval", - "type": "Function", - "tags": [], - "label": "getInterval", - "description": [], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ") => string | undefined" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getInterval.$1", - "type": "Object", - "tags": [], - "label": "column", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "pluginId": "data", + "scope": "server", + "docId": "kibDataPluginApi", + "section": "def-server.DataPluginSetup", + "text": "DataPluginSetup" }, + ", ", { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getNumberHistogramInterval", - "type": "Function", - "tags": [], - "label": "getNumberHistogramInterval", - "description": [ - "\nHelper function returning the used interval for data table column created by the histogramm agg type.\n\"auto\" will get expanded to the actually used interval.\nIf the column is not a column created by a histogram aggregation of the esaggs data source,\nthis function will return undefined." - ], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - ") => number | undefined" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getNumberHistogramInterval.$1", - "type": "Object", - "tags": [], - "label": "column", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "pluginId": "data", + "scope": "server", + "docId": "kibDataPluginApi", + "section": "def-server.DataPluginStart", + "text": "DataPluginStart" }, + ", ", + "DataPluginSetupDependencies", + ", ", + "DataPluginStartDependencies", + ">" + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getTotalCount", + "id": "def-server.DataServerPlugin.Unnamed", "type": "Function", "tags": [], - "label": "getTotalCount", + "label": "Constructor", "description": [], "signature": [ - "(table: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - }, - ") => number | undefined" + "any" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.getTotalCount.$1", + "id": "def-server.DataServerPlugin.Unnamed.$1", "type": "Object", "tags": [], - "label": "table", + "label": "initializerContext", "description": [], "signature": [ { - "pluginId": "expressions", + "pluginId": "@kbn/core-plugins-server", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - } + "docId": "kibKbnCorePluginsServerPluginApi", + "section": "def-common.PluginInitializerContext", + "text": "PluginInitializerContext" + }, + "; }>; asyncSearch: Readonly<{ pollInterval?: number | undefined; } & { waitForCompletion: moment.Duration; keepAlive: moment.Duration; batchedReduceSize: number; }>; sessions: Readonly<{} & { enabled: boolean; notTouchedTimeout: moment.Duration; maxUpdateRetries: number; defaultExpiration: moment.Duration; management: Readonly<{} & { refreshInterval: moment.Duration; maxSessions: number; refreshTimeout: moment.Duration; expiresSoonWarning: moment.Duration; }>; }>; }>; }>>" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "isRequired": true @@ -21892,96 +13328,93 @@ }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.hasPrecisionError", + "id": "def-server.DataServerPlugin.setup", "type": "Function", "tags": [], - "label": "hasPrecisionError", + "label": "setup", "description": [], "signature": [ - "(column: ", + "(core: ", { - "pluginId": "expressions", + "pluginId": "@kbn/core-lifecycle-server", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" + "docId": "kibKbnCoreLifecycleServerPluginApi", + "section": "def-common.CoreSetup", + "text": "CoreSetup" }, - ") => ", + "<", + "DataPluginStartDependencies", + ", ", { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.Serializable", - "text": "Serializable" - } + "pluginId": "data", + "scope": "server", + "docId": "kibDataPluginApi", + "section": "def-server.DataPluginStart", + "text": "DataPluginStart" + }, + ">, { bfetch, expressions, usageCollection, fieldFormats, taskManager, security, }: ", + "DataPluginSetupDependencies", + ") => { search: ", + "ISearchSetup", + "; query: ", + "QuerySetup", + "; fieldFormats: ", + { + "pluginId": "fieldFormats", + "scope": "server", + "docId": "kibFieldFormatsPluginApi", + "section": "def-server.FieldFormatsSetup", + "text": "FieldFormatsSetup" + }, + "; }" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.hasPrecisionError.$1", + "id": "def-server.DataServerPlugin.setup.$1", "type": "Object", "tags": [], - "label": "column", + "label": "core", "description": [], "signature": [ { - "pluginId": "expressions", + "pluginId": "@kbn/core-lifecycle-server", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } + "docId": "kibKbnCoreLifecycleServerPluginApi", + "section": "def-common.CoreSetup", + "text": "CoreSetup" + }, + "<", + "DataPluginStartDependencies", + ", ", + { + "pluginId": "data", + "scope": "server", + "docId": "kibDataPluginApi", + "section": "def-server.DataPluginStart", + "text": "DataPluginStart" + }, + ">" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.isFilterable", - "type": "Function", - "tags": [], - "label": "isFilterable", - "description": [], - "signature": [ - "(column: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" }, - ") => boolean" - ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.isFilterable.$1", + "id": "def-server.DataServerPlugin.setup.$2", "type": "Object", "tags": [], - "label": "column", + "label": "{\n bfetch,\n expressions,\n usageCollection,\n fieldFormats,\n taskManager,\n security,\n }", "description": [], "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - } + "DataPluginSetupDependencies" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "isRequired": true @@ -21991,85 +13424,125 @@ }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.setFieldFormat", + "id": "def-server.DataServerPlugin.start", "type": "Function", "tags": [], - "label": "setFieldFormat", + "label": "start", "description": [], "signature": [ - "(column: ", + "(core: ", { - "pluginId": "expressions", + "pluginId": "@kbn/core-lifecycle-server", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" + "docId": "kibKbnCoreLifecycleServerPluginApi", + "section": "def-common.CoreStart", + "text": "CoreStart" }, - ", fieldFormat: ", + ", { fieldFormats, dataViews, taskManager }: ", + "DataPluginStartDependencies", + ") => { datatableUtilities: ", + "DatatableUtilitiesService", + "; search: ", + "ISearchStart", + "<", { - "pluginId": "fieldFormats", + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IEsSearchRequest", + "text": "IEsSearchRequest" + }, + ", ", + { + "pluginId": "data", "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IEsSearchResponse", + "text": "IEsSearchResponse" + }, + ">; fieldFormats: ", + { + "pluginId": "fieldFormats", + "scope": "server", "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormat", - "text": "FieldFormat" + "section": "def-server.FieldFormatsStart", + "text": "FieldFormatsStart" }, - ") => void" + "; indexPatterns: ", + { + "pluginId": "dataViews", + "scope": "server", + "docId": "kibDataViewsPluginApi", + "section": "def-server.DataViewsServerPluginStart", + "text": "DataViewsServerPluginStart" + }, + "; }" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.setFieldFormat.$1", + "id": "def-server.DataServerPlugin.start.$1", "type": "Object", "tags": [], - "label": "column", + "label": "core", "description": [], "signature": [ { - "pluginId": "expressions", + "pluginId": "@kbn/core-lifecycle-server", "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" + "docId": "kibKbnCoreLifecycleServerPluginApi", + "section": "def-common.CoreStart", + "text": "CoreStart" } ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "isRequired": true }, { "parentPluginId": "data", - "id": "def-common.DatatableUtilitiesService.setFieldFormat.$2", + "id": "def-server.DataServerPlugin.start.$2", "type": "Object", "tags": [], - "label": "fieldFormat", + "label": "{ fieldFormats, dataViews, taskManager }", "description": [], "signature": [ - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormat", - "text": "FieldFormat" - } + "DataPluginStartDependencies" ], - "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "path": "src/plugins/data/server/plugin.ts", "deprecated": false, "trackAdoption": false, "isRequired": true } ], "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-server.DataServerPlugin.stop", + "type": "Function", + "tags": [], + "label": "stop", + "description": [], + "signature": [ + "() => void" + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] } ], "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.DataView", + "id": "def-server.DataView", "type": "Class", "tags": [], "label": "DataView", @@ -22099,7 +13572,7 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.id", + "id": "def-server.DataView.id", "type": "string", "tags": [], "label": "id", @@ -22115,7 +13588,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.title", + "id": "def-server.DataView.title", "type": "string", "tags": [ "deprecated" @@ -22376,14 +13849,6 @@ "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, { "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" @@ -22916,7 +14381,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.fieldFormatMap", + "id": "def-server.DataView.fieldFormatMap", "type": "Object", "tags": [], "label": "fieldFormatMap", @@ -22948,7 +14413,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.typeMeta", + "id": "def-server.DataView.typeMeta", "type": "Object", "tags": [], "label": "typeMeta", @@ -22971,7 +14436,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.fields", + "id": "def-server.DataView.fields", "type": "CompoundType", "tags": [], "label": "fields", @@ -23002,7 +14467,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.timeFieldName", + "id": "def-server.DataView.timeFieldName", "type": "string", "tags": [], "label": "timeFieldName", @@ -23018,7 +14483,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.type", + "id": "def-server.DataView.type", "type": "string", "tags": [], "label": "type", @@ -23034,7 +14499,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.flattenHit", + "id": "def-server.DataView.flattenHit", "type": "Function", "tags": [ "deprecated" @@ -23065,7 +14530,7 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.flattenHit.$1", + "id": "def-server.DataView.flattenHit.$1", "type": "Object", "tags": [], "label": "hit", @@ -23079,7 +14544,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.flattenHit.$2", + "id": "def-server.DataView.flattenHit.$2", "type": "CompoundType", "tags": [], "label": "deep", @@ -23095,7 +14560,7 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.metaFields", + "id": "def-server.DataView.metaFields", "type": "Array", "tags": [], "label": "metaFields", @@ -23103,333 +14568,118 @@ "\nList of meta fields by name" ], "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.version", - "type": "string", - "tags": [], - "label": "version", - "description": [ - "\nSavedObject version" - ], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.sourceFilters", - "type": "Array", - "tags": [], - "label": "sourceFilters", - "description": [ - "\nArray of filters - hides fields in discover" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.SourceFilter", - "text": "SourceFilter" - }, - "[] | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.namespaces", - "type": "Array", - "tags": [], - "label": "namespaces", - "description": [ - "\nArray of namespace ids" - ], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.allowNoIndex", - "type": "boolean", - "tags": [], - "label": "allowNoIndex", - "description": [ - "\nPrevents errors when index pattern exists before indices" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.name", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "\nName of the data view. Human readable name used to differentiate data view." - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.matchedIndices", - "type": "Array", - "tags": [], - "label": "matchedIndices", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [ - "\nconstructor" - ], - "signature": [ - "any" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.Unnamed.$1", - "type": "Object", - "tags": [], - "label": "config", - "description": [ - "- config data and dependencies" - ], - "signature": [ - "DataViewDeps" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.getName", - "type": "Function", - "tags": [], - "label": "getName", - "description": [ - "\nGet name of Data View" - ], - "signature": [ - "() => string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.getIndexPattern", - "type": "Function", - "tags": [], - "label": "getIndexPattern", - "description": [ - "\nGet index pattern" - ], - "signature": [ - "() => string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [ - "index pattern string" - ] - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.setIndexPattern", - "type": "Function", - "tags": [], - "label": "setIndexPattern", - "description": [ - "\nSet index pattern" - ], - "signature": [ - "(indexPattern: string) => void" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.setIndexPattern.$1", - "type": "string", - "tags": [], - "label": "indexPattern", - "description": [], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.getOriginalSavedObjectBody", - "type": "Function", - "tags": [], - "label": "getOriginalSavedObjectBody", - "description": [ - "\nGet last saved saved object fields" - ], - "signature": [ - "() => { fieldAttrs?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; fields?: string | undefined; sourceFilters?: string | undefined; fieldFormatMap?: string | undefined; typeMeta?: string | undefined; type?: string | undefined; }" + "string[]" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataView.resetOriginalSavedObjectBody", - "type": "Function", + "id": "def-server.DataView.version", + "type": "string", "tags": [], - "label": "resetOriginalSavedObjectBody", + "label": "version", "description": [ - "\nReset last saved saved object fields. Used after saving." + "\nSavedObject version" ], "signature": [ - "() => void" + "string | undefined" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataView.getFieldAttrs", - "type": "Function", + "id": "def-server.DataView.sourceFilters", + "type": "Array", "tags": [], - "label": "getFieldAttrs", + "label": "sourceFilters", "description": [ - "\nReturns field attributes map" + "\nArray of filters - hides fields in discover" ], "signature": [ - "() => { [x: string]: ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" + "section": "def-common.SourceFilter", + "text": "SourceFilter" }, - "; }" + "[] | undefined" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataView.getComputedFields", - "type": "Function", + "id": "def-server.DataView.namespaces", + "type": "Array", "tags": [], - "label": "getComputedFields", + "label": "namespaces", "description": [ - "\nReturns scripted fields" + "\nArray of namespace ids" ], "signature": [ - "() => { storedFields: string[]; scriptFields: Record; docvalueFields: { field: string; format: string; }[]; runtimeFields: ", - "MappingRuntimeFields", - "; }" + "string[]" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataView.isPersisted", - "type": "Function", + "id": "def-server.DataView.allowNoIndex", + "type": "boolean", "tags": [], - "label": "isPersisted", + "label": "allowNoIndex", + "description": [ + "\nPrevents errors when index pattern exists before indices" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the data view. Human readable name used to differentiate data view." + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.matchedIndices", + "type": "Array", + "tags": [], + "label": "matchedIndices", "description": [], "signature": [ - "() => boolean" + "string[]" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataView.toSpec", + "id": "def-server.DataView.Unnamed", "type": "Function", "tags": [], - "label": "toSpec", + "label": "Constructor", "description": [ - "\nCreates static representation of the data view." + "\nconstructor" ], "signature": [ - "(includeFields?: boolean) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } + "any" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23437,15 +14687,15 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.toSpec.$1", - "type": "boolean", + "id": "def-server.DataView.Unnamed.$1", + "type": "Object", "tags": [], - "label": "includeFields", + "label": "config", "description": [ - "Whether or not to include the `fields` list as part of this spec. If not included, the list\nwill be fetched from Elasticsearch when instantiating a new Data View with this spec." + "- config data and dependencies" ], "signature": [ - "boolean" + "DataViewDeps" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23457,15 +14707,15 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.getSourceFiltering", + "id": "def-server.DataView.getName", "type": "Function", "tags": [], - "label": "getSourceFiltering", + "label": "getName", "description": [ - "\nGet the source filtering configuration for that index." + "\nGet name of Data View" ], "signature": [ - "() => { excludes: string[]; }" + "() => string" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23475,211 +14725,87 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.removeScriptedField", + "id": "def-server.DataView.getIndexPattern", "type": "Function", - "tags": [ - "deprecated" - ], - "label": "removeScriptedField", + "tags": [], + "label": "getIndexPattern", "description": [ - "\nRemoves scripted field from field list." + "\nGet index pattern" ], "signature": [ - "(fieldName: string) => void" + "() => string" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, + "deprecated": false, "trackAdoption": false, - "references": [ - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/field_editor/field_editor.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - } - ], - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.removeScriptedField.$1", - "type": "string", - "tags": [], - "label": "fieldName", - "description": [ - "name of scripted field to remove" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "children": [], + "returnComment": [ + "index pattern string" + ] }, { "parentPluginId": "data", - "id": "def-common.DataView.getNonScriptedFields", + "id": "def-server.DataView.setIndexPattern", "type": "Function", - "tags": [ - "deprecated" - ], - "label": "getNonScriptedFields", + "tags": [], + "label": "setIndexPattern", "description": [ - "\n" + "\nSet index pattern" ], "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - "[]" + "(indexPattern: string) => void" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, + "deprecated": false, "trackAdoption": false, - "references": [ - { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/state_management/datasource.test.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" - }, - { - "plugin": "graph", - "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, + "children": [ { - "plugin": "visTypeTimeseries", - "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts" + "parentPluginId": "data", + "id": "def-server.DataView.setIndexPattern.$1", + "type": "string", + "tags": [], + "label": "indexPattern", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true } ], - "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.getScriptedFields", + "id": "def-server.DataView.getOriginalSavedObjectBody", "type": "Function", - "tags": [ - "deprecated" - ], - "label": "getScriptedFields", + "tags": [], + "label": "getOriginalSavedObjectBody", "description": [ - "\n" + "\nGet last saved saved object fields" ], "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - "[]" + "() => { fieldAttrs?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; fields?: string | undefined; sourceFilters?: string | undefined; fieldFormatMap?: string | undefined; typeMeta?: string | undefined; type?: string | undefined; }" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": true, + "deprecated": false, "trackAdoption": false, - "references": [ - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/register_index_pattern_usage_collection.ts" - }, - { - "plugin": "dataViewManagement", - "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_view.test.ts" - } - ], "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.isTSDBMode", + "id": "def-server.DataView.resetOriginalSavedObjectBody", "type": "Function", "tags": [], - "label": "isTSDBMode", + "label": "resetOriginalSavedObjectBody", "description": [ - "\nreturns true if dataview contains TSDB fields" + "\nReset last saved saved object fields. Used after saving." ], "signature": [ - "() => boolean" + "() => void" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23689,22 +14815,23 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.isTimeBased", + "id": "def-server.DataView.getFieldAttrs", "type": "Function", "tags": [], - "label": "isTimeBased", + "label": "getFieldAttrs", "description": [ - "\nDoes the data view have a timestamp field?" + "\nReturns field attributes map" ], "signature": [ - "() => this is ", + "() => { [x: string]: ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.TimeBasedDataView", - "text": "TimeBasedDataView" - } + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" + }, + "; }" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23714,22 +14841,19 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.isTimeNanosBased", + "id": "def-server.DataView.getComputedFields", "type": "Function", "tags": [], - "label": "isTimeNanosBased", + "label": "getComputedFields", "description": [ - "\nDoes the data view have a timestamp field and is it a date nanos field?" + "\nReturns scripted fields" ], "signature": [ - "() => this is ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TimeBasedDataView", - "text": "TimeBasedDataView" - } + "() => { storedFields: string[]; scriptFields: Record; docvalueFields: { field: string; format: string; }[]; runtimeFields: ", + "MappingRuntimeFields", + "; }" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23739,23 +14863,13 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.getTimeField", + "id": "def-server.DataView.isPersisted", "type": "Function", "tags": [], - "label": "getTimeField", - "description": [ - "\nGet timestamp field as DataViewField or return undefined" - ], + "label": "isPersisted", + "description": [], "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | undefined" + "() => boolean" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23765,23 +14879,22 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.getFieldByName", + "id": "def-server.DataView.toSpec", "type": "Function", "tags": [], - "label": "getFieldByName", + "label": "toSpec", "description": [ - "\nGet field by name." + "\nCreates static representation of the data view." ], "signature": [ - "(name: string) => ", + "(includeFields?: boolean) => ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | undefined" + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23789,15 +14902,15 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.getFieldByName.$1", - "type": "string", + "id": "def-server.DataView.toSpec.$1", + "type": "boolean", "tags": [], - "label": "name", + "label": "includeFields", "description": [ - "field name" + "Whether or not to include the `fields` list as part of this spec. If not included, the list\nwill be fetched from Elasticsearch when instantiating a new Data View with this spec." ], "signature": [ - "string" + "boolean" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23809,23 +14922,15 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.getAggregationRestrictions", + "id": "def-server.DataView.getSourceFiltering", "type": "Function", "tags": [], - "label": "getAggregationRestrictions", + "label": "getSourceFiltering", "description": [ - "\nGet aggregation restrictions. Rollup fields can only perform a subset of aggregations." + "\nGet the source filtering configuration for that index." ], "signature": [ - "() => Record | undefined" + "() => { excludes: string[]; }" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23835,93 +14940,47 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.getAsSavedObjectBody", + "id": "def-server.DataView.removeScriptedField", "type": "Function", - "tags": [], - "label": "getAsSavedObjectBody", + "tags": [ + "deprecated" + ], + "label": "removeScriptedField", "description": [ - "\nReturns index pattern as saved object body for saving" + "\nRemoves scripted field from field list." ], "signature": [ - "() => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" - } + "(fieldName: string) => void" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, + "deprecated": true, "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.getFormatterForField", - "type": "Function", - "tags": [], - "label": "getFormatterForField", - "description": [ - "\nProvide a field, get its formatter" - ], - "signature": [ - "(field: ", + "references": [ { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" }, - " | ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/field_editor/field_editor.tsx" }, - ") => ", { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.FieldFormat", - "text": "FieldFormat" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" } ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.getFormatterForField.$1", - "type": "CompoundType", + "id": "def-server.DataView.removeScriptedField.$1", + "type": "string", "tags": [], - "label": "field", - "description": [ - "field to get formatter for" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - } + "label": "fieldName", + "description": [ + "name of scripted field to remove" + ], + "signature": [ + "string" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -23933,23 +14992,91 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.addRuntimeField", + "id": "def-server.DataView.getNonScriptedFields", "type": "Function", - "tags": [], - "label": "addRuntimeField", + "tags": [ + "deprecated" + ], + "label": "getNonScriptedFields", "description": [ - "\nAdd a runtime field - Appended to existing mapped field or a new field is\ncreated as appropriate." + "\n" ], "signature": [ - "(name: string, runtimeField: ", + "() => ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + "[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/state_management/datasource.test.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" }, - ") => ", + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts" + } + ], + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.getScriptedFields", + "type": "Function", + "tags": [ + "deprecated" + ], + "label": "getScriptedFields", + "description": [ + "\n" + ], + "signature": [ + "() => ", { "pluginId": "dataViews", "scope": "common", @@ -23960,171 +15087,132 @@ "[]" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, + "deprecated": true, "trackAdoption": false, - "children": [ + "references": [ { - "parentPluginId": "data", - "id": "def-common.DataView.addRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "Field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" }, { - "parentPluginId": "data", - "id": "def-common.DataView.addRuntimeField.$2", - "type": "Object", - "tags": [], - "label": "runtimeField", - "description": [ - "Runtime field definition" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" - } - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/server/register_index_pattern_usage_collection.ts" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" } ], + "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.hasRuntimeField", + "id": "def-server.DataView.isTSDBMode", "type": "Function", "tags": [], - "label": "hasRuntimeField", + "label": "isTSDBMode", "description": [ - "\nChecks if runtime field exists" + "\nreturns true if dataview contains TSDB fields" ], "signature": [ - "(name: string) => boolean" + "() => boolean" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.hasRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], + "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.getRuntimeField", + "id": "def-server.DataView.isTimeBased", "type": "Function", "tags": [], - "label": "getRuntimeField", + "label": "isTimeBased", "description": [ - "\nReturns runtime field if exists" + "\nDoes the data view have a timestamp field?" ], "signature": [ - "(name: string) => ", + "() => this is ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" - }, - " | null" + "section": "def-common.TimeBasedDataView", + "text": "TimeBasedDataView" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.getRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "Runtime field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], + "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.getAllRuntimeFields", + "id": "def-server.DataView.isTimeNanosBased", "type": "Function", "tags": [], - "label": "getAllRuntimeFields", + "label": "isTimeNanosBased", "description": [ - "\nGet all runtime field definitions.\nNOTE: this does not strip out runtime fields that match mapped field names" + "\nDoes the data view have a timestamp field and is it a date nanos field?" ], "signature": [ - "() => Record this is ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" - }, - ">" + "section": "def-common.TimeBasedDataView", + "text": "TimeBasedDataView" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, "children": [], - "returnComment": [ - "map of runtime field definitions by field name" - ] + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.getFieldsByRuntimeFieldName", + "id": "def-server.DataView.getTimeField", "type": "Function", "tags": [], - "label": "getFieldsByRuntimeFieldName", + "label": "getTimeField", "description": [ - "\nReturns data view fields backed by runtime fields." + "\nGet timestamp field as DataViewField or return undefined" ], "signature": [ - "(name: string) => Record ", { "pluginId": "dataViews", "scope": "common", @@ -24132,53 +15220,33 @@ "section": "def-common.DataViewField", "text": "DataViewField" }, - "> | undefined" + " | undefined" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.getFieldsByRuntimeFieldName.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "runtime field name" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "map of DataViewFields (that are runtime fields) by field name" - ] + "children": [], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.replaceAllRuntimeFields", + "id": "def-server.DataView.getFieldByName", "type": "Function", "tags": [], - "label": "replaceAllRuntimeFields", + "label": "getFieldByName", "description": [ - "\nReplaces all existing runtime fields with new fields." + "\nGet field by name." ], "signature": [ - "(newFields: Record ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeField", - "text": "RuntimeField" + "section": "def-common.DataViewField", + "text": "DataViewField" }, - ">) => void" + " | undefined" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24186,23 +15254,15 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.replaceAllRuntimeFields.$1", - "type": "Object", + "id": "def-server.DataView.getFieldByName.$1", + "type": "string", "tags": [], - "label": "newFields", + "label": "name", "description": [ - "Map of runtime field definitions by field name" + "field name" ], "signature": [ - "Record" + "string" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24214,52 +15274,48 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.removeRuntimeField", + "id": "def-server.DataView.getAggregationRestrictions", "type": "Function", "tags": [], - "label": "removeRuntimeField", + "label": "getAggregationRestrictions", "description": [ - "\nRemove a runtime field - removed from mapped field or removed unmapped\nfield as appropriate. Doesn't clear associated field attributes." + "\nGet aggregation restrictions. Rollup fields can only perform a subset of aggregations." ], "signature": [ - "(name: string) => void" + "() => Record | undefined" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataView.removeRuntimeField.$1", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "- Field name to remove" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], + "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.getRuntimeMappings", + "id": "def-server.DataView.getAsSavedObjectBody", "type": "Function", "tags": [], - "label": "getRuntimeMappings", + "label": "getAsSavedObjectBody", "description": [ - "\nReturn the \"runtime_mappings\" section of the ES search query." + "\nReturns index pattern as saved object body for saving" ], "signature": [ "() => ", - "MappingRuntimeFields" + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24269,23 +15325,38 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.getFormatterForFieldNoDefault", + "id": "def-server.DataView.getFormatterForField", "type": "Function", "tags": [], - "label": "getFormatterForFieldNoDefault", + "label": "getFormatterForField", "description": [ - "\nGet formatter for a given field name. Return undefined if none exists." + "\nProvide a field, get its formatter" ], "signature": [ - "(fieldname: string) => ", + "(field: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + ") => ", { "pluginId": "fieldFormats", "scope": "common", "docId": "kibFieldFormatsPluginApi", "section": "def-common.FieldFormat", "text": "FieldFormat" - }, - " | undefined" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24293,15 +15364,29 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.getFormatterForFieldNoDefault.$1", - "type": "string", + "id": "def-server.DataView.getFormatterForField.$1", + "type": "CompoundType", "tags": [], - "label": "fieldname", + "label": "field", "description": [ - "name of field to get formatter for" + "field to get formatter for" ], "signature": [ - "string" + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24313,31 +15398,31 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.setFieldAttrs", + "id": "def-server.DataView.addRuntimeField", "type": "Function", "tags": [], - "label": "setFieldAttrs", + "label": "addRuntimeField", "description": [ - "\nSet field attribute" + "\nAdd a runtime field - Appended to existing mapped field or a new field is\ncreated as appropriate." ], "signature": [ - "(fieldName: string, attrName: K, value: ", + ") => ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" + "section": "def-common.DataViewField", + "text": "DataViewField" }, - "[K]) => void" + "[]" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24345,12 +15430,12 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.setFieldAttrs.$1", + "id": "def-server.DataView.addRuntimeField.$1", "type": "string", "tags": [], - "label": "fieldName", + "label": "name", "description": [ - "name of field to set attribute on" + "Field name" ], "signature": [ "string" @@ -24362,39 +15447,21 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.setFieldAttrs.$2", - "type": "Uncategorized", - "tags": [], - "label": "attrName", - "description": [ - "name of attribute to set" - ], - "signature": [ - "K" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.setFieldAttrs.$3", - "type": "Uncategorized", + "id": "def-server.DataView.addRuntimeField.$2", + "type": "Object", "tags": [], - "label": "value", + "label": "runtimeField", "description": [ - "value of attribute" + "Runtime field definition" ], "signature": [ { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" - }, - "[K]" + "section": "def-common.RuntimeField", + "text": "RuntimeField" + } ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24406,15 +15473,15 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.setFieldCustomLabel", + "id": "def-server.DataView.hasRuntimeField", "type": "Function", "tags": [], - "label": "setFieldCustomLabel", + "label": "hasRuntimeField", "description": [ - "\nSet field custom label" + "\nChecks if runtime field exists" ], "signature": [ - "(fieldName: string, customLabel: string | null | undefined) => void" + "(name: string) => boolean" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24422,12 +15489,12 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.setFieldCustomLabel.$1", + "id": "def-server.DataView.hasRuntimeField.$1", "type": "string", "tags": [], - "label": "fieldName", + "label": "name", "description": [ - "name of field to set custom label on" + "field name" ], "signature": [ "string" @@ -24436,38 +15503,29 @@ "deprecated": false, "trackAdoption": false, "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.setFieldCustomLabel.$2", - "type": "CompoundType", - "tags": [], - "label": "customLabel", - "description": [ - "custom label value. If undefined, custom label is removed" - ], - "signature": [ - "string | null | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false } ], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.setFieldCount", + "id": "def-server.DataView.getRuntimeField", "type": "Function", "tags": [], - "label": "setFieldCount", + "label": "getRuntimeField", "description": [ - "\nSet field count" + "\nReturns runtime field if exists" ], "signature": [ - "(fieldName: string, count: number | null | undefined) => void" + "(name: string) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeField", + "text": "RuntimeField" + }, + " | null" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24475,12 +15533,12 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.setFieldCount.$1", + "id": "def-server.DataView.getRuntimeField.$1", "type": "string", "tags": [], - "label": "fieldName", + "label": "name", "description": [ - "name of field to set count on" + "Runtime field name" ], "signature": [ "string" @@ -24489,54 +15547,57 @@ "deprecated": false, "trackAdoption": false, "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataView.setFieldCount.$2", - "type": "CompoundType", - "tags": [], - "label": "count", - "description": [ - "count value. If undefined, count is removed" - ], - "signature": [ - "number | null | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_view.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false } ], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataView.setFieldFormat", + "id": "def-server.DataView.getAllRuntimeFields", "type": "Function", "tags": [], - "label": "setFieldFormat", + "label": "getAllRuntimeFields", "description": [ - "\nSet field formatter" + "\nGet all runtime field definitions.\nNOTE: this does not strip out runtime fields that match mapped field names" ], "signature": [ - "(fieldName: string, format: ", + "() => Record" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [ + "map of runtime field definitions by field name" + ] + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.getFieldsByRuntimeFieldName", + "type": "Function", + "tags": [], + "label": "getFieldsByRuntimeFieldName", + "description": [ + "\nReturns data view fields backed by runtime fields." + ], + "signature": [ + "(name: string) => Record) => void" + "> | undefined" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24544,12 +15605,12 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.setFieldFormat.$1", + "id": "def-server.DataView.getFieldsByRuntimeFieldName.$1", "type": "string", "tags": [], - "label": "fieldName", + "label": "name", "description": [ - "name of field to set format on" + "runtime field name" ], "signature": [ "string" @@ -24558,31 +15619,53 @@ "deprecated": false, "trackAdoption": false, "isRequired": true + } + ], + "returnComment": [ + "map of DataViewFields (that are runtime fields) by field name" + ] + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.replaceAllRuntimeFields", + "type": "Function", + "tags": [], + "label": "replaceAllRuntimeFields", + "description": [ + "\nReplaces all existing runtime fields with new fields." + ], + "signature": [ + "(newFields: Record) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.setFieldFormat.$2", + "id": "def-server.DataView.replaceAllRuntimeFields.$1", "type": "Object", "tags": [], - "label": "format", + "label": "newFields", "description": [ - "field format in serialized form" + "Map of runtime field definitions by field name" ], "signature": [ + "Record" ], @@ -24596,15 +15679,15 @@ }, { "parentPluginId": "data", - "id": "def-common.DataView.deleteFieldFormat", + "id": "def-server.DataView.removeRuntimeField", "type": "Function", "tags": [], - "label": "deleteFieldFormat", + "label": "removeRuntimeField", "description": [ - "\nRemove field format from the field format map." + "\nRemove a runtime field - removed from mapped field or removed unmapped\nfield as appropriate. Doesn't clear associated field attributes." ], "signature": [ - "(fieldName: string) => void" + "(name: string) => void" ], "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, @@ -24612,12 +15695,12 @@ "children": [ { "parentPluginId": "data", - "id": "def-common.DataView.deleteFieldFormat.$1", + "id": "def-server.DataView.removeRuntimeField.$1", "type": "string", "tags": [], - "label": "fieldName", + "label": "name", "description": [ - "field name associated with the format for removal" + "- Field name to remove" ], "signature": [ "string" @@ -24629,122 +15712,63 @@ } ], "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField", - "type": "Class", - "tags": [], - "label": "DataViewField", - "description": [ - "\nData view field class" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" }, - " implements ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.DataViewFieldBase", - "text": "DataViewFieldBase" - } - ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewField.spec", - "type": "CompoundType", + "id": "def-server.DataView.getRuntimeMappings", + "type": "Function", "tags": [], - "label": "spec", - "description": [], + "label": "getRuntimeMappings", + "description": [ + "\nReturn the \"runtime_mappings\" section of the ES search query." + ], "signature": [ - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.DataViewFieldBase", - "text": "DataViewFieldBase" - }, - " & { count?: number | undefined; conflictDescriptions?: Record | undefined; format?: ", - { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.SerializedFieldFormat", - "text": "SerializedFieldFormat" - }, - "<{}, ", - { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - "> | undefined; esTypes?: string[] | undefined; searchable: boolean; aggregatable: boolean; readFromDocValues?: boolean | undefined; indexed?: boolean | undefined; customLabel?: string | undefined; runtimeField?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeFieldSpec", - "text": "RuntimeFieldSpec" - }, - " | undefined; fixedInterval?: string[] | undefined; timeZone?: string[] | undefined; timeSeriesDimension?: boolean | undefined; timeSeriesMetric?: \"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined; shortDotsEnable?: boolean | undefined; isMapped?: boolean | undefined; parentName?: string | undefined; }" + "() => ", + "MappingRuntimeFields" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.Unnamed", + "id": "def-server.DataView.getFormatterForFieldNoDefault", "type": "Function", - "tags": [ - "constructor" - ], - "label": "Constructor", + "tags": [], + "label": "getFormatterForFieldNoDefault", "description": [ - "\nDataView constructor" + "\nGet formatter for a given field name. Return undefined if none exists." ], "signature": [ - "any" + "(fieldname: string) => ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormat", + "text": "FieldFormat" + }, + " | undefined" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewField.Unnamed.$1", - "type": "CompoundType", + "id": "def-server.DataView.getFormatterForFieldNoDefault.$1", + "type": "string", "tags": [], - "label": "spec", + "label": "fieldname", "description": [ - "Configuration for the field" + "name of field to get formatter for" ], "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - } + "string" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, "isRequired": true @@ -24754,855 +15778,1810 @@ }, { "parentPluginId": "data", - "id": "def-common.DataViewField.count", - "type": "number", - "tags": [], - "label": "count", - "description": [ - "\nCount is used for field popularity in discover." - ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.count", - "type": "number", - "tags": [], - "label": "count", - "description": [ - "\nSet count, which is used for field popularity in discover." - ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.runtimeField", - "type": "CompoundType", + "id": "def-server.DataView.setFieldAttrs", + "type": "Function", "tags": [], - "label": "runtimeField", + "label": "setFieldAttrs", "description": [ - "\nReturns runtime field definition or undefined if field is not runtime field." + "\nSet field attribute" ], "signature": [ + "(fieldName: string, attrName: K, value: ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeFieldSpec", - "text": "RuntimeFieldSpec" + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" }, - " | undefined" + "[K]) => void" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldAttrs.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set attribute on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldAttrs.$2", + "type": "Uncategorized", + "tags": [], + "label": "attrName", + "description": [ + "name of attribute to set" + ], + "signature": [ + "K" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldAttrs.$3", + "type": "Uncategorized", + "tags": [], + "label": "value", + "description": [ + "value of attribute" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" + }, + "[K]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.script", - "type": "string", + "id": "def-server.DataView.setFieldCustomLabel", + "type": "Function", "tags": [], - "label": "script", + "label": "setFieldCustomLabel", "description": [ - "\nScript field code" + "\nSet field custom label" ], "signature": [ - "string | undefined" + "(fieldName: string, customLabel: string | null | undefined) => void" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldCustomLabel.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set custom label on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldCustomLabel.$2", + "type": "CompoundType", + "tags": [], + "label": "customLabel", + "description": [ + "custom label value. If undefined, custom label is removed" + ], + "signature": [ + "string | null | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.script", - "type": "string", + "id": "def-server.DataView.setFieldCount", + "type": "Function", "tags": [], - "label": "script", + "label": "setFieldCount", "description": [ - "\nSets scripted field painless code" + "\nSet field count" ], "signature": [ - "string | undefined" + "(fieldName: string, count: number | null | undefined) => void" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.lang", - "type": "string", - "tags": [], - "label": "lang", - "description": [ - "\nScript field language" - ], - "signature": [ - "string | undefined" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldCount.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set count on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldCount.$2", + "type": "CompoundType", + "tags": [], + "label": "count", + "description": [ + "count value. If undefined, count is removed" + ], + "signature": [ + "number | null | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.lang", - "type": "string", + "id": "def-server.DataView.setFieldFormat", + "type": "Function", "tags": [], - "label": "lang", + "label": "setFieldFormat", "description": [ - "\nSets scripted field langauge." + "\nSet field formatter" ], "signature": [ - "string | undefined" + "(fieldName: string, format: ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.SerializedFieldFormat", + "text": "SerializedFieldFormat" + }, + "<{}, ", + { + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" + }, + ">) => void" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldFormat.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set format on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataView.setFieldFormat.$2", + "type": "Object", + "tags": [], + "label": "format", + "description": [ + "field format in serialized form" + ], + "signature": [ + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.SerializedFieldFormat", + "text": "SerializedFieldFormat" + }, + "<{}, ", + { + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.customLabel", - "type": "string", + "id": "def-server.DataView.deleteFieldFormat", + "type": "Function", "tags": [], - "label": "customLabel", + "label": "deleteFieldFormat", "description": [ - "\nReturns custom label if set, otherwise undefined." + "\nRemove field format from the field format map." ], "signature": [ - "string | undefined" + "(fieldName: string) => void" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false - }, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataView.deleteFieldFormat.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "field name associated with the format for removal" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService", + "type": "Class", + "tags": [], + "label": "DataViewsService", + "description": [ + "\nData views service, providing CRUD operations for data views." + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewField.customLabel", - "type": "string", + "id": "def-server.DataViewsService.getCanSave", + "type": "Function", "tags": [], - "label": "customLabel", + "label": "getCanSave", "description": [ - "\nSets custom label for field, or unsets if passed undefined." + "\nCan the user save data views?" ], "signature": [ - "string | undefined" + "() => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "returnComment": [], + "children": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.conflictDescriptions", - "type": "Object", + "id": "def-server.DataViewsService.Unnamed", + "type": "Function", "tags": [], - "label": "conflictDescriptions", + "label": "Constructor", "description": [ - "\nDescription of field type conflicts across different indices in the same index pattern." + "\nDataViewsService constructor" ], "signature": [ - "Record | undefined" + "any" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.Unnamed.$1", + "type": "Object", + "tags": [], + "label": "deps", + "description": [ + "Service dependencies" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewsServiceDeps", + "text": "DataViewsServiceDeps" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.conflictDescriptions", - "type": "Object", + "id": "def-server.DataViewsService.getIds", + "type": "Function", "tags": [], - "label": "conflictDescriptions", + "label": "getIds", "description": [ - "\nSets conflict descriptions for field." + "\nGets list of index pattern ids." ], "signature": [ - "Record | undefined" - ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.name", - "type": "string", - "tags": [], - "label": "name", - "description": [ - "\nGet field name" + "(refresh?: boolean) => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.displayName", - "type": "string", - "tags": [], - "label": "displayName", - "description": [ - "\nGets display name, calcualted based on name, custom label and shortDotsEnable." + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getIds.$1", + "type": "boolean", + "tags": [], + "label": "refresh", + "description": [ + "Force refresh of index pattern list" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { - "parentPluginId": "data", - "id": "def-common.DataViewField.type", - "type": "string", + "parentPluginId": "data", + "id": "def-server.DataViewsService.getTitles", + "type": "Function", "tags": [], - "label": "type", + "label": "getTitles", "description": [ - "\nGets field type" + "\nGets list of index pattern titles." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "(refresh?: boolean) => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getTitles.$1", + "type": "boolean", + "tags": [], + "label": "refresh", + "description": [ + "Force refresh of index pattern list" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.esTypes", - "type": "Array", + "id": "def-server.DataViewsService.find", + "type": "Function", "tags": [], - "label": "esTypes", + "label": "find", "description": [ - "\nGets ES types as string array" + "\nFind and load index patterns by title." ], "signature": [ - "string[] | undefined" + "(search: string, size?: number) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + "[]>" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.find.$1", + "type": "string", + "tags": [], + "label": "search", + "description": [ + "Search string" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.find.$2", + "type": "number", + "tags": [], + "label": "size", + "description": [ + "Number of data views to return" + ], + "signature": [ + "number" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "DataView[]" + ] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.scripted", - "type": "boolean", + "id": "def-server.DataViewsService.getIdsWithTitle", + "type": "Function", "tags": [], - "label": "scripted", + "label": "getIdsWithTitle", "description": [ - "\nReturns true if scripted field" + "\nGets list of index pattern ids with titles." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "(refresh?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewListItem", + "text": "DataViewListItem" + }, + "[]>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getIdsWithTitle.$1", + "type": "boolean", + "tags": [], + "label": "refresh", + "description": [ + "Force refresh of index pattern list" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.searchable", - "type": "boolean", + "id": "def-server.DataViewsService.clearCache", + "type": "Function", "tags": [], - "label": "searchable", + "label": "clearCache", "description": [ - "\nReturns true if field is searchable" + "\nClear index pattern saved objects cache." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "() => void" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.aggregatable", - "type": "boolean", + "id": "def-server.DataViewsService.clearInstanceCache", + "type": "Function", "tags": [], - "label": "aggregatable", + "label": "clearInstanceCache", "description": [ - "\nReturns true if field is aggregatable" + "\nClear index pattern instance cache" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "(id?: string | undefined) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.clearInstanceCache.$1", + "type": "string", + "tags": [], + "label": "id", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.timeSeriesDimension", - "type": "boolean", + "id": "def-server.DataViewsService.getCache", + "type": "Function", "tags": [], - "label": "timeSeriesDimension", + "label": "getCache", "description": [ - "\nreturns true if field is a TSDB dimension field" + "\nGet cache, contains data view saved objects." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "() => Promise<", + { + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" + }, + "<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSavedObjectAttrs", + "text": "DataViewSavedObjectAttrs" + }, + ">[] | null | undefined>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.timeSeriesMetric", - "type": "CompoundType", + "id": "def-server.DataViewsService.getDefault", + "type": "Function", "tags": [], - "label": "timeSeriesMetric", + "label": "getDefault", "description": [ - "\nreturns type of TSDB metric or undefined" + "\nGet default index pattern" ], "signature": [ - "\"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined" + "(displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | null>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getDefault.$1", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.fixedInterval", - "type": "Array", + "id": "def-server.DataViewsService.getDefaultId", + "type": "Function", "tags": [], - "label": "fixedInterval", + "label": "getDefaultId", "description": [ - "\nreturns list of alloeed fixed intervals" + "\nGet default index pattern id" ], "signature": [ - "string[] | undefined" + "() => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.isRolledUpField", - "type": "CompoundType", + "id": "def-server.DataViewsService.setDefault", + "type": "Function", "tags": [], - "label": "isRolledUpField", + "label": "setDefault", "description": [ - "\nreturns true if the field is of rolled up type" + "\nOptionally set default index pattern, unless force = true" ], "signature": [ - "boolean | undefined" + "(id: string | null, force?: boolean) => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.setDefault.$1", + "type": "CompoundType", + "tags": [], + "label": "id", + "description": [ + "data view id" + ], + "signature": [ + "string | null" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.setDefault.$2", + "type": "boolean", + "tags": [], + "label": "force", + "description": [ + "set default data view even if there's an existing default" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.timeZone", - "type": "Array", + "id": "def-server.DataViewsService.hasUserDataView", + "type": "Function", "tags": [], - "label": "timeZone", + "label": "hasUserDataView", "description": [ - "\nreturn list of allowed time zones" + "\nChecks if current user has a user created index pattern ignoring fleet's server default index patterns." ], "signature": [ - "string[] | undefined" + "() => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.readFromDocValues", - "type": "boolean", + "id": "def-server.DataViewsService.getFieldsForWildcard", + "type": "Function", "tags": [], - "label": "readFromDocValues", + "label": "getFieldsForWildcard", "description": [ - "\nReturns true if field is available via doc values" + "\nGet field list by providing { pattern }." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "(options: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + ") => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getFieldsForWildcard.$1", + "type": "Object", + "tags": [], + "label": "options", + "description": [ + "options for getting field list" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "FieldSpec[]" + ] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.subType", - "type": "CompoundType", + "id": "def-server.DataViewsService.getFieldsForIndexPattern", + "type": "Function", "tags": [], - "label": "subType", + "label": "getFieldsForIndexPattern", "description": [ - "\nReturns field subtype, multi, nested, or undefined if neither" + "\nGet field list by providing an index patttern (or spec)." ], "signature": [ + "(indexPattern: ", { - "pluginId": "@kbn/es-query", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, - " | undefined" + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + }, + ", options?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + " | undefined) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]>" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getFieldsForIndexPattern.$1", + "type": "CompoundType", + "tags": [], + "label": "indexPattern", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.getFieldsForIndexPattern.$2", + "type": "Object", + "tags": [], + "label": "options", + "description": [ + "options for getting field list" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [ + "FieldSpec[]" + ] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.isMapped", - "type": "CompoundType", + "id": "def-server.DataViewsService.refreshFields", + "type": "Function", "tags": [], - "label": "isMapped", + "label": "refreshFields", "description": [ - "\nIs the field part of the index mapping?" + "\nRefresh field list for a given index pattern." ], "signature": [ - "boolean | undefined" + "(dataView: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ", displayErrors?: boolean) => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.isRuntimeField", - "type": "boolean", - "tags": [], - "label": "isRuntimeField", - "description": [ - "\nReturns true if runtime field defined on data view" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.refreshFields.$1", + "type": "Object", + "tags": [], + "label": "dataView", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.refreshFields.$2", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.sortable", - "type": "boolean", + "id": "def-server.DataViewsService.fieldArrayToMap", + "type": "Function", "tags": [], - "label": "sortable", + "label": "fieldArrayToMap", "description": [ - "\nReturns true if field is sortable" + "\nConverts field array to map." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.filterable", - "type": "boolean", - "tags": [], - "label": "filterable", - "description": [ - "\nReturns true if field is filterable" + "signature": [ + "(fields: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[], fieldAttrs?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" + }, + " | undefined) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewFieldMap", + "text": "DataViewFieldMap" + } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.fieldArrayToMap.$1", + "type": "Array", + "tags": [], + "label": "fields", + "description": [ + ": FieldSpec[]" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.fieldArrayToMap.$2", + "type": "Object", + "tags": [], + "label": "fieldAttrs", + "description": [ + ": FieldAttrs" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [ + "Record" + ] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.visualizable", - "type": "boolean", + "id": "def-server.DataViewsService.savedObjectToSpec", + "type": "Function", "tags": [], - "label": "visualizable", + "label": "savedObjectToSpec", "description": [ - "\nReturns true if field is visualizable" + "\nConverts data view saved object to data view spec." ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "signature": [ + "(savedObject: ", + { + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" + }, + "<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" + }, + ">) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.savedObjectToSpec.$1", + "type": "Object", + "tags": [], + "label": "savedObject", + "description": [], + "signature": [ + { + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" + }, + "<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "DataViewSpec" + ] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.isSubtypeNested", + "id": "def-server.DataViewsService.get", "type": "Function", "tags": [], - "label": "isSubtypeNested", + "label": "get", "description": [ - "\nReturns true if field is subtype nested" + "\nGet an index pattern by id, cache optimized." ], "signature": [ - "() => boolean" + "(id: string, displayErrors?: boolean, refreshFields?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, - "children": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.get.$1", + "type": "string", + "tags": [], + "label": "id", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.get.$2", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.get.$3", + "type": "boolean", + "tags": [], + "label": "refreshFields", + "description": [ + "- If set true, will fetch fields from the index pattern" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.isSubtypeMulti", + "id": "def-server.DataViewsService.create", "type": "Function", "tags": [], - "label": "isSubtypeMulti", + "label": "create", "description": [ - "\nReturns true if field is subtype multi" + "\nCreate data view instance." ], "signature": [ - "() => boolean" + "(spec: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + }, + ", skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, - "children": [], - "returnComment": [] + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.create.$1", + "type": "Object", + "tags": [], + "label": "spec", + "description": [ + "data view spec" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.create.$2", + "type": "boolean", + "tags": [], + "label": "skipFetchFields", + "description": [ + "if true, will not fetch fields" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.create.$3", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "DataView" + ] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.getSubtypeNested", + "id": "def-server.DataViewsService.createAndSave", "type": "Function", "tags": [], - "label": "getSubtypeNested", + "label": "createAndSave", "description": [ - "\nReturns subtype nested data if exists" + "\nCreate a new data view and save it right away." ], "signature": [ - "() => ", + "(spec: ", { - "pluginId": "@kbn/es-query", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubTypeNested", - "text": "IFieldSubTypeNested" + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" }, - " | undefined" + ", override?: boolean, skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createAndSave.$1", + "type": "Object", + "tags": [], + "label": "spec", + "description": [ + "data view spec" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createAndSave.$2", + "type": "boolean", + "tags": [], + "label": "override", + "description": [ + "Overwrite if existing index pattern exists." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createAndSave.$3", + "type": "boolean", + "tags": [], + "label": "skipFetchFields", + "description": [ + "Whether to skip field refresh step." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createAndSave.$4", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.getSubtypeMulti", + "id": "def-server.DataViewsService.createSavedObject", "type": "Function", "tags": [], - "label": "getSubtypeMulti", + "label": "createSavedObject", "description": [ - "\nReturns subtype multi data if exists" + "\nSave a new data view." ], "signature": [ - "() => ", + "(dataView: ", { - "pluginId": "@kbn/es-query", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubTypeMulti", - "text": "IFieldSubTypeMulti" + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, - " | undefined" - ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.deleteCount", - "type": "Function", - "tags": [], - "label": "deleteCount", - "description": [ - "\nDeletes count value. Popularity as used by discover" - ], - "signature": [ - "() => void" - ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewField.toJSON", - "type": "Function", - "tags": [], - "label": "toJSON", - "description": [ - "\nJSON version of field" - ], - "signature": [ - "() => { count: number; script: string | undefined; lang: string | undefined; conflictDescriptions: Record | undefined; name: string; type: string; esTypes: string[] | undefined; scripted: boolean; searchable: boolean; aggregatable: boolean; readFromDocValues: boolean; subType: ", + ", override?: boolean, displayErrors?: boolean) => Promise<", { - "pluginId": "@kbn/es-query", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, - " | undefined; customLabel: string | undefined; }" + ">" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, - "children": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createSavedObject.$1", + "type": "Object", + "tags": [], + "label": "dataView", + "description": [ + "data view instance" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createSavedObject.$2", + "type": "boolean", + "tags": [], + "label": "override", + "description": [ + "Overwrite if existing index pattern exists" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.createSavedObject.$3", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.toSpec", + "id": "def-server.DataViewsService.updateSavedObject", "type": "Function", "tags": [], - "label": "toSpec", + "label": "updateSavedObject", "description": [ - "\nGet field in serialized form - fieldspec." + "\nSave existing data view. Will attempt to merge differences if there are conflicts." ], "signature": [ - "(config?: ", + "(indexPattern: ", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.ToSpecConfig", - "text": "ToSpecConfig" + "section": "def-common.DataView", + "text": "DataView" }, - ") => ", + ", saveAttempts?: number, ignoreErrors?: boolean, displayErrors?: boolean) => Promise" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewField.toSpec.$1", + "id": "def-server.DataViewsService.updateSavedObject.$1", "type": "Object", "tags": [], - "label": "config", - "description": [ - "provide a method to get a field formatter" - ], + "label": "indexPattern", + "description": [], "signature": [ { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.ToSpecConfig", - "text": "ToSpecConfig" + "section": "def-common.DataView", + "text": "DataView" } ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.updateSavedObject.$2", + "type": "number", + "tags": [], + "label": "saveAttempts", + "description": [], + "signature": [ + "number" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.updateSavedObject.$3", + "type": "boolean", + "tags": [], + "label": "ignoreErrors", + "description": [], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.updateSavedObject.$4", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, "isRequired": true } ], - "returnComment": [ - "field in serialized form - field spec" - ] + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewField.isRuntimeCompositeSubField", + "id": "def-server.DataViewsService.delete", "type": "Function", "tags": [], - "label": "isRuntimeCompositeSubField", + "label": "delete", "description": [ - "\nReturns true if composite runtime field" + "\nDeletes an index pattern from .kibana index." ], "signature": [ - "() => boolean" + "(indexPatternId: string) => Promise<{}>" ], - "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, - "children": [], - "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewSavedObjectConflictError", - "type": "Class", - "tags": [], - "label": "DataViewSavedObjectConflictError", - "description": [ - "\nError thrown when saved object has been changed when attempting to save." - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSavedObjectConflictError", - "text": "DataViewSavedObjectConflictError" + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsService.delete.$1", + "type": "string", + "tags": [], + "label": "indexPatternId", + "description": [ + ": Id of kibana Index Pattern to delete" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - " extends Error" - ], - "path": "src/plugins/data_views/common/errors/data_view_saved_object_conflict.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewSavedObjectConflictError.Unnamed", + "id": "def-server.DataViewsService.getDefaultDataView", "type": "Function", "tags": [], - "label": "Constructor", + "label": "getDefaultDataView", "description": [ - "\nconstructor" + "\nReturns the default data view as an object.\nIf no default is found, or it is missing\nanother data view is selected as default and returned.\nIf no possible data view found to become a default returns null.\n" ], "signature": [ - "any" + "(refreshFields?: boolean | undefined) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | null>" ], - "path": "src/plugins/data_views/common/errors/data_view_saved_object_conflict.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewSavedObjectConflictError.Unnamed.$1", - "type": "string", + "id": "def-server.DataViewsService.getDefaultDataView.$1", + "type": "CompoundType", "tags": [], - "label": "savedObjectId", + "label": "refreshFields", "description": [ - "saved object id with conflict" + "- if true, will refresh the fields of the default data view" ], "signature": [ - "string" + "boolean | undefined" ], - "path": "src/plugins/data_views/common/errors/data_view_saved_object_conflict.ts", + "path": "src/plugins/data_views/common/data_views/data_views.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true + "isRequired": false } ], - "returnComment": [] + "returnComment": [ + "default data view" + ] } ], "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService", + "id": "def-server.IndexPatternsFetcher", "type": "Class", "tags": [], - "label": "DataViewsService", - "description": [ - "\nData views service, providing CRUD operations for data views." - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "label": "IndexPatternsFetcher", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getCanSave", - "type": "Function", - "tags": [], - "label": "getCanSave", - "description": [ - "\nCan the user save data views?" - ], - "signature": [ - "() => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.Unnamed", + "id": "def-server.IndexPatternsFetcher.Unnamed", "type": "Function", "tags": [], "label": "Constructor", - "description": [ - "\nDataViewsService constructor" - ], + "description": [], "signature": [ "any" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.Unnamed.$1", + "id": "def-server.IndexPatternsFetcher.Unnamed.$1", "type": "Object", "tags": [], - "label": "deps", - "description": [ - "Service dependencies" - ], + "label": "elasticsearchClient", + "description": [], "signature": [ { - "pluginId": "dataViews", + "pluginId": "@kbn/core-elasticsearch-server", "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewsServiceDeps", - "text": "DataViewsServiceDeps" + "docId": "kibKbnCoreElasticsearchServerPluginApi", + "section": "def-common.ElasticsearchClient", + "text": "ElasticsearchClient" } ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.getIds", - "type": "Function", - "tags": [], - "label": "getIds", - "description": [ - "\nGets list of index pattern ids." - ], - "signature": [ - "(refresh?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.getIds.$1", + "id": "def-server.IndexPatternsFetcher.Unnamed.$2", "type": "boolean", "tags": [], - "label": "refresh", - "description": [ - "Force refresh of index pattern list" - ], + "label": "allowNoIndices", + "description": [], "signature": [ "boolean" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "isRequired": true @@ -25612,244 +17591,374 @@ }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.getTitles", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard", "type": "Function", - "tags": [], - "label": "getTitles", + "tags": [ + "property", + "property", + "return" + ], + "label": "getFieldsForWildcard", "description": [ - "\nGets list of index pattern titles." + "\n Get a list of field objects for an index pattern that may contain wildcards\n" ], "signature": [ - "(refresh?: boolean) => Promise" + "(options: { pattern: string | string[]; metaFields?: string[] | undefined; fieldCapsOptions?: { allow_no_indices: boolean; includeUnmapped?: boolean | undefined; } | undefined; type?: string | undefined; rollupIndex?: string | undefined; indexFilter?: ", + "QueryDslQueryContainer", + " | undefined; fields?: string[] | undefined; }) => Promise<{ fields: ", + { + "pluginId": "dataViews", + "scope": "server", + "docId": "kibDataViewsPluginApi", + "section": "def-server.FieldDescriptor", + "text": "FieldDescriptor" + }, + "[]; indices: string[]; }>" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getTitles.$1", - "type": "boolean", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1", + "type": "Object", "tags": [], - "label": "refresh", - "description": [ - "Force refresh of index pattern list" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "label": "options", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true + "children": [ + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.pattern", + "type": "CompoundType", + "tags": [], + "label": "pattern", + "description": [], + "signature": [ + "string | string[]" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.metaFields", + "type": "Array", + "tags": [], + "label": "metaFields", + "description": [], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.fieldCapsOptions", + "type": "Object", + "tags": [], + "label": "fieldCapsOptions", + "description": [], + "signature": [ + "{ allow_no_indices: boolean; includeUnmapped?: boolean | undefined; } | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.rollupIndex", + "type": "string", + "tags": [], + "label": "rollupIndex", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.indexFilter", + "type": "Object", + "tags": [], + "label": "indexFilter", + "description": [], + "signature": [ + "QueryDslQueryContainer", + " | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.IndexPatternsFetcher.getFieldsForWildcard.$1.fields", + "type": "Array", + "tags": [], + "label": "fields", + "description": [], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + } + ] } ], "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.find", + "id": "def-server.IndexPatternsFetcher.validatePatternListActive", "type": "Function", - "tags": [], - "label": "find", - "description": [ - "\nFind and load index patterns by title." - ], - "signature": [ - "(search: string, size?: number) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - "[]>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.find.$1", - "type": "string", - "tags": [], - "label": "search", - "description": [ - "Search string" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.find.$2", - "type": "number", - "tags": [], - "label": "size", - "description": [ - "Number of data views to return" - ], - "signature": [ - "number" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } + "tags": [ + "return" ], - "returnComment": [ - "DataView[]" - ] - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.getIdsWithTitle", - "type": "Function", - "tags": [], - "label": "getIdsWithTitle", + "label": "validatePatternListActive", "description": [ - "\nGets list of index pattern ids with titles." + "\n Returns an index pattern list of only those index pattern strings in the given list that return indices\n" ], "signature": [ - "(refresh?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewListItem", - "text": "DataViewListItem" - }, - "[]>" + "(patternList: string[]) => Promise" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getIdsWithTitle.$1", - "type": "boolean", + "id": "def-server.IndexPatternsFetcher.validatePatternListActive.$1", + "type": "Array", "tags": [], - "label": "refresh", + "label": "patternList", "description": [ - "Force refresh of index pattern list" + "string[]" ], "signature": [ - "boolean" + "string[]" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, "trackAdoption": false, "isRequired": true } ], "returnComment": [] - }, + } + ], + "initialIsOpen": false + } + ], + "functions": [ + { + "parentPluginId": "data", + "id": "def-server.getCapabilitiesForRollupIndices", + "type": "Function", + "tags": [], + "label": "getCapabilitiesForRollupIndices", + "description": [ + "\nGet rollup job capabilities" + ], + "signature": [ + "(indices: ", + "RollupGetRollupIndexCapsResponse", + ") => ", + { + "pluginId": "dataViews", + "scope": "server", + "docId": "kibDataViewsPluginApi", + "section": "def-server.RollupIndexCapability", + "text": "RollupIndexCapability" + } + ], + "path": "src/plugins/data_views/server/fetcher/lib/map_capabilities.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.clearCache", - "type": "Function", + "id": "def-server.getCapabilitiesForRollupIndices.$1", + "type": "Object", "tags": [], - "label": "clearCache", + "label": "indices", "description": [ - "\nClear index pattern saved objects cache." + "rollup job index capabilites" ], "signature": [ - "() => void" + "RollupGetRollupIndexCapsResponse" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/lib/map_capabilities.ts", "deprecated": false, "trackAdoption": false, - "children": [], - "returnComment": [] - }, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.getEsQueryConfig", + "type": "Function", + "tags": [], + "label": "getEsQueryConfig", + "description": [], + "signature": [ + "(config: KibanaConfig) => ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.EsQueryConfig", + "text": "EsQueryConfig" + } + ], + "path": "src/plugins/data/common/es_query/get_es_query_config.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.clearInstanceCache", - "type": "Function", + "id": "def-server.getEsQueryConfig.$1", + "type": "Object", "tags": [], - "label": "clearInstanceCache", - "description": [ - "\nClear index pattern instance cache" - ], + "label": "config", + "description": [], "signature": [ - "(id?: string | undefined) => void" + "KibanaConfig" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/es_query/get_es_query_config.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.clearInstanceCache.$1", - "type": "string", - "tags": [], - "label": "id", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [] - }, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.getRequestAbortedSignal", + "type": "Function", + "tags": [], + "label": "getRequestAbortedSignal", + "description": [ + "\nA simple utility function that returns an `AbortSignal` corresponding to an `AbortController`\nwhich aborts when the given request is aborted." + ], + "signature": [ + "(aborted$: ", + "Observable", + ") => AbortSignal" + ], + "path": "src/plugins/data/server/lib/get_request_aborted_signal.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getCache", - "type": "Function", + "id": "def-server.getRequestAbortedSignal.$1", + "type": "Object", "tags": [], - "label": "getCache", + "label": "aborted$", "description": [ - "\nGet cache, contains data view saved objects." + "The observable of abort events (usually `request.events.aborted$`)" ], "signature": [ - "() => Promise<", - { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" - }, - "<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSavedObjectAttrs", - "text": "DataViewSavedObjectAttrs" - }, - ">[] | null | undefined>" + "Observable", + "" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/server/lib/get_request_aborted_signal.ts", "deprecated": false, "trackAdoption": false, - "children": [], - "returnComment": [] + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.getTime", + "type": "Function", + "tags": [], + "label": "getTime", + "description": [], + "signature": [ + "(indexPattern: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | undefined, timeRange: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.TimeRange", + "text": "TimeRange" + }, + ", options: { forceNow?: Date | undefined; fieldName?: string | undefined; } | undefined) => ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.RangeFilter", + "text": "RangeFilter" + }, + " | ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.ScriptedRangeFilter", + "text": "ScriptedRangeFilter" }, + " | ", + "MatchAllRangeFilter", + " | undefined" + ], + "path": "src/plugins/data/common/query/timefilter/get_time.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getDefault", - "type": "Function", + "id": "def-server.getTime.$1", + "type": "Object", "tags": [], - "label": "getDefault", - "description": [ - "\nGet default index pattern" - ], + "label": "indexPattern", + "description": [], "signature": [ - "(displayErrors?: boolean) => Promise<", { "pluginId": "dataViews", "scope": "common", @@ -25857,1039 +17966,1813 @@ "section": "def-common.DataView", "text": "DataView" }, - " | null>" + " | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/query/timefilter/get_time.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.getDefault.$1", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "isRequired": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.getDefaultId", - "type": "Function", + "id": "def-server.getTime.$2", + "type": "Object", "tags": [], - "label": "getDefaultId", - "description": [ - "\nGet default index pattern id" - ], + "label": "timeRange", + "description": [], "signature": [ - "() => Promise" + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.TimeRange", + "text": "TimeRange" + } ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/query/timefilter/get_time.ts", "deprecated": false, "trackAdoption": false, - "children": [], - "returnComment": [] + "isRequired": true }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.setDefault", - "type": "Function", + "id": "def-server.getTime.$3", + "type": "Object", "tags": [], - "label": "setDefault", - "description": [ - "\nOptionally set default index pattern, unless force = true" - ], - "signature": [ - "(id: string | null, force?: boolean) => Promise" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "label": "options", + "description": [], + "path": "src/plugins/data/common/query/timefilter/get_time.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.setDefault.$1", - "type": "CompoundType", + "id": "def-server.getTime.$3.forceNow", + "type": "Object", "tags": [], - "label": "id", - "description": [ - "data view id" - ], + "label": "forceNow", + "description": [], "signature": [ - "string | null" + "Date | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/query/timefilter/get_time.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": false + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.setDefault.$2", - "type": "boolean", + "id": "def-server.getTime.$3.fieldName", + "type": "string", "tags": [], - "label": "force", - "description": [ - "set default data view even if there's an existing default" - ], + "label": "fieldName", + "description": [], "signature": [ - "boolean" + "string | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/query/timefilter/get_time.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false } - ], - "returnComment": [] - }, + ] + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.parseInterval", + "type": "Function", + "tags": [], + "label": "parseInterval", + "description": [], + "signature": [ + "(interval: string) => moment.Duration | null" + ], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_interval.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.hasUserDataView", - "type": "Function", + "id": "def-server.parseInterval.$1", + "type": "string", "tags": [], - "label": "hasUserDataView", - "description": [ - "\nChecks if current user has a user created index pattern ignoring fleet's server default index patterns." - ], + "label": "interval", + "description": [], "signature": [ - "() => Promise" + "string" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_interval.ts", "deprecated": false, "trackAdoption": false, - "children": [], - "returnComment": [] - }, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + } + ], + "interfaces": [ + { + "parentPluginId": "data", + "id": "def-server.DataViewsServerPluginStart", + "type": "Interface", + "tags": [], + "label": "DataViewsServerPluginStart", + "description": [ + "\nDataViews server plugin start api" + ], + "path": "src/plugins/data_views/server/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getFieldsForWildcard", + "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory", "type": "Function", "tags": [], - "label": "getFieldsForWildcard", + "label": "dataViewsServiceFactory", "description": [ - "\nGet field list by providing { pattern }." + "\nReturns a DataViews service instance" ], "signature": [ - "(options: ", + "(savedObjectsClient: ", { - "pluginId": "dataViews", + "pluginId": "@kbn/core-saved-objects-api-server", "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" + "docId": "kibKbnCoreSavedObjectsApiServerPluginApi", + "section": "def-common.SavedObjectsClientContract", + "text": "SavedObjectsClientContract" }, - ") => Promise<", + ", elasticsearchClient: ", + { + "pluginId": "@kbn/core-elasticsearch-server", + "scope": "common", + "docId": "kibKbnCoreElasticsearchServerPluginApi", + "section": "def-common.ElasticsearchClient", + "text": "ElasticsearchClient" + }, + ", request?: ", + { + "pluginId": "@kbn/core-http-server", + "scope": "common", + "docId": "kibKbnCoreHttpServerPluginApi", + "section": "def-common.KibanaRequest", + "text": "KibanaRequest" + }, + " | undefined, byPassCapabilities?: boolean | undefined) => Promise<", { "pluginId": "dataViews", "scope": "common", "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" + "section": "def-common.DataViewsService", + "text": "DataViewsService" }, - "[]>" + ">" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/types.ts", "deprecated": false, "trackAdoption": false, + "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getFieldsForWildcard.$1", + "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$1", "type": "Object", "tags": [], - "label": "options", - "description": [ - "options for getting field list" - ], + "label": "savedObjectsClient", + "description": [], "signature": [ { - "pluginId": "dataViews", + "pluginId": "@kbn/core-saved-objects-api-server", "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" + "docId": "kibKbnCoreSavedObjectsApiServerPluginApi", + "section": "def-common.SavedObjectsClientContract", + "text": "SavedObjectsClientContract" } ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/types.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "FieldSpec[]" - ] - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.getFieldsForIndexPattern", - "type": "Function", - "tags": [], - "label": "getFieldsForIndexPattern", - "description": [ - "\nGet field list by providing an index patttern (or spec)." - ], - "signature": [ - "(indexPattern: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", options?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" + "trackAdoption": false }, - " | undefined) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" + "parentPluginId": "data", + "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$2", + "type": "Object", + "tags": [], + "label": "elasticsearchClient", + "description": [], + "signature": [ + "{ name: string | symbol; get: { (this: That, params: ", + "GetRequest", + " | ", + "GetRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "GetResponse", + ">; (this: That, params: ", + "GetRequest", + " | ", + "GetRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "GetResponse", + ", unknown>>; (this: That, params: ", + "GetRequest", + " | ", + "GetRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "GetResponse", + ">; }; delete: { (this: That, params: ", + "DeleteRequest", + " | ", + "DeleteRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "WriteResponseBase", + ">; (this: That, params: ", + "DeleteRequest", + " | ", + "DeleteRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "WriteResponseBase", + ", unknown>>; (this: That, params: ", + "DeleteRequest", + " | ", + "DeleteRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "WriteResponseBase", + ">; }; cluster: ", + "default", + "; eql: ", + "default", + "; search: { >(this: That, params?: ", + "SearchRequest", + " | ", + "SearchRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "SearchResponse", + ">; >(this: That, params?: ", + "SearchRequest", + " | ", + "SearchRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "SearchResponse", + ", unknown>>; >(this: That, params?: ", + "SearchRequest", + " | ", + "SearchRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "SearchResponse", + ">; }; create: { (this: That, params: ", + "CreateRequest", + " | ", + "CreateRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "WriteResponseBase", + ">; (this: That, params: ", + "CreateRequest", + " | ", + "CreateRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "WriteResponseBase", + ", unknown>>; (this: That, params: ", + "CreateRequest", + " | ", + "CreateRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "WriteResponseBase", + ">; }; monitoring: ", + "default", + "; security: ", + "default", + "; index: { (this: That, params: ", + "IndexRequest", + " | ", + "IndexRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "WriteResponseBase", + ">; (this: That, params: ", + "IndexRequest", + " | ", + "IndexRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "WriteResponseBase", + ", unknown>>; (this: That, params: ", + "IndexRequest", + " | ", + "IndexRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "WriteResponseBase", + ">; }; update: { (this: That, params: ", + "UpdateRequest", + " | ", + "UpdateRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "UpdateResponse", + ">; (this: That, params: ", + "UpdateRequest", + " | ", + "UpdateRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "UpdateResponse", + ", unknown>>; (this: That, params: ", + "UpdateRequest", + " | ", + "UpdateRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "UpdateResponse", + ">; }; asyncSearch: ", + "default", + "; [kAsyncSearch]: symbol | null; [kAutoscaling]: symbol | null; [kCat]: symbol | null; [kCcr]: symbol | null; [kCluster]: symbol | null; [kDanglingIndices]: symbol | null; [kEnrich]: symbol | null; [kEql]: symbol | null; [kFeatures]: symbol | null; [kFleet]: symbol | null; [kGraph]: symbol | null; [kIlm]: symbol | null; [kIndices]: symbol | null; [kIngest]: symbol | null; [kLicense]: symbol | null; [kLogstash]: symbol | null; [kMigration]: symbol | null; [kMl]: symbol | null; [kMonitoring]: symbol | null; [kNodes]: symbol | null; [kRollup]: symbol | null; [kSearchableSnapshots]: symbol | null; [kSecurity]: symbol | null; [kShutdown]: symbol | null; [kSlm]: symbol | null; [kSnapshot]: symbol | null; [kSql]: symbol | null; [kSsl]: symbol | null; [kTasks]: symbol | null; [kTextStructure]: symbol | null; [kTransform]: symbol | null; [kWatcher]: symbol | null; [kXpack]: symbol | null; transport: ", + "default", + "; helpers: ", + "default", + "; child: (opts: ", + "ClientOptions", + ") => ", + "default", + "; autoscaling: ", + "default", + "; bulk: { (this: That, params: ", + "BulkRequest", + " | ", + "BulkRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "BulkResponse", + ">; (this: That, params: ", + "BulkRequest", + " | ", + "BulkRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "BulkResponse", + ", unknown>>; (this: That, params: ", + "BulkRequest", + " | ", + "BulkRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "BulkResponse", + ">; }; cat: ", + "default", + "; ccr: ", + "default", + "; clearScroll: { (this: That, params?: ", + "ClearScrollRequest", + " | ", + "ClearScrollRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ClearScrollResponse", + ">; (this: That, params?: ", + "ClearScrollRequest", + " | ", + "ClearScrollRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ClearScrollResponse", + ", unknown>>; (this: That, params?: ", + "ClearScrollRequest", + " | ", + "ClearScrollRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ClearScrollResponse", + ">; }; closePointInTime: { (this: That, params: ", + "ClosePointInTimeRequest", + " | ", + "ClosePointInTimeRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ClosePointInTimeResponse", + ">; (this: That, params: ", + "ClosePointInTimeRequest", + " | ", + "ClosePointInTimeRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ClosePointInTimeResponse", + ", unknown>>; (this: That, params: ", + "ClosePointInTimeRequest", + " | ", + "ClosePointInTimeRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ClosePointInTimeResponse", + ">; }; count: { (this: That, params?: ", + "CountRequest", + " | ", + "CountRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "CountResponse", + ">; (this: That, params?: ", + "CountRequest", + " | ", + "CountRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "CountResponse", + ", unknown>>; (this: That, params?: ", + "CountRequest", + " | ", + "CountRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "CountResponse", + ">; }; danglingIndices: ", + "default", + "; deleteByQuery: { (this: That, params: ", + "DeleteByQueryRequest", + " | ", + "DeleteByQueryRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "DeleteByQueryResponse", + ">; (this: That, params: ", + "DeleteByQueryRequest", + " | ", + "DeleteByQueryRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "DeleteByQueryResponse", + ", unknown>>; (this: That, params: ", + "DeleteByQueryRequest", + " | ", + "DeleteByQueryRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "DeleteByQueryResponse", + ">; }; deleteByQueryRethrottle: { (this: That, params: ", + "DeleteByQueryRethrottleRequest", + " | ", + "DeleteByQueryRethrottleRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "TasksTaskListResponseBase", + ">; (this: That, params: ", + "DeleteByQueryRethrottleRequest", + " | ", + "DeleteByQueryRethrottleRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "TasksTaskListResponseBase", + ", unknown>>; (this: That, params: ", + "DeleteByQueryRethrottleRequest", + " | ", + "DeleteByQueryRethrottleRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "TasksTaskListResponseBase", + ">; }; deleteScript: { (this: That, params: ", + "DeleteScriptRequest", + " | ", + "DeleteScriptRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "AcknowledgedResponseBase", + ">; (this: That, params: ", + "DeleteScriptRequest", + " | ", + "DeleteScriptRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "AcknowledgedResponseBase", + ", unknown>>; (this: That, params: ", + "DeleteScriptRequest", + " | ", + "DeleteScriptRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "AcknowledgedResponseBase", + ">; }; enrich: ", + "default", + "; exists: { (this: That, params: ", + "ExistsRequest", + " | ", + "ExistsRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise; (this: That, params: ", + "ExistsRequest", + " | ", + "ExistsRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + ">; (this: That, params: ", + "ExistsRequest", + " | ", + "ExistsRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise; }; existsSource: { (this: That, params: ", + "ExistsSourceRequest", + " | ", + "ExistsSourceRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise; (this: That, params: ", + "ExistsSourceRequest", + " | ", + "ExistsSourceRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + ">; (this: That, params: ", + "ExistsSourceRequest", + " | ", + "ExistsSourceRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise; }; explain: { (this: That, params: ", + "ExplainRequest", + " | ", + "ExplainRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ExplainResponse", + ">; (this: That, params: ", + "ExplainRequest", + " | ", + "ExplainRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ExplainResponse", + ", unknown>>; (this: That, params: ", + "ExplainRequest", + " | ", + "ExplainRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ExplainResponse", + ">; }; features: ", + "default", + "; fieldCaps: { (this: That, params: ", + "FieldCapsRequest", + " | ", + "FieldCapsRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "FieldCapsResponse", + ">; (this: That, params: ", + "FieldCapsRequest", + " | ", + "FieldCapsRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "FieldCapsResponse", + ", unknown>>; (this: That, params: ", + "FieldCapsRequest", + " | ", + "FieldCapsRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "FieldCapsResponse", + ">; }; fleet: ", + "default", + "; getScript: { (this: That, params: ", + "GetScriptRequest", + " | ", + "GetScriptRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "GetScriptResponse", + ">; (this: That, params: ", + "GetScriptRequest", + " | ", + "GetScriptRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "GetScriptResponse", + ", unknown>>; (this: That, params: ", + "GetScriptRequest", + " | ", + "GetScriptRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "GetScriptResponse", + ">; }; getScriptContext: { (this: That, params?: ", + "GetScriptContextRequest", + " | ", + "GetScriptContextRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "GetScriptContextResponse", + ">; (this: That, params?: ", + "GetScriptContextRequest", + " | ", + "GetScriptContextRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "GetScriptContextResponse", + ", unknown>>; (this: That, params?: ", + "GetScriptContextRequest", + " | ", + "GetScriptContextRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "GetScriptContextResponse", + ">; }; getScriptLanguages: { (this: That, params?: ", + "GetScriptLanguagesRequest", + " | ", + "GetScriptLanguagesRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "GetScriptLanguagesResponse", + ">; (this: That, params?: ", + "GetScriptLanguagesRequest", + " | ", + "GetScriptLanguagesRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "GetScriptLanguagesResponse", + ", unknown>>; (this: That, params?: ", + "GetScriptLanguagesRequest", + " | ", + "GetScriptLanguagesRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "GetScriptLanguagesResponse", + ">; }; getSource: { (this: That, params: ", + "GetSourceRequest", + " | ", + "GetSourceRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise; (this: That, params: ", + "GetSourceRequest", + " | ", + "GetSourceRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + ">; (this: That, params: ", + "GetSourceRequest", + " | ", + "GetSourceRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise; }; graph: ", + "default", + "; ilm: ", + "default", + "; indices: ", + "default", + "; info: { (this: That, params?: ", + "InfoRequest", + " | ", + "InfoRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "InfoResponse", + ">; (this: That, params?: ", + "InfoRequest", + " | ", + "InfoRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "InfoResponse", + ", unknown>>; (this: That, params?: ", + "InfoRequest", + " | ", + "InfoRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "InfoResponse", + ">; }; ingest: ", + "default", + "; knnSearch: { (this: That, params: ", + "KnnSearchRequest", + " | ", + "KnnSearchRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "KnnSearchResponse", + ">; (this: That, params: ", + "KnnSearchRequest", + " | ", + "KnnSearchRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "KnnSearchResponse", + ", unknown>>; (this: That, params: ", + "KnnSearchRequest", + " | ", + "KnnSearchRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "KnnSearchResponse", + ">; }; license: ", + "default", + "; logstash: ", + "default", + "; mget: { (this: That, params?: ", + "MgetRequest", + " | ", + "MgetRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "MgetResponse", + ">; (this: That, params?: ", + "MgetRequest", + " | ", + "MgetRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "MgetResponse", + ", unknown>>; (this: That, params?: ", + "MgetRequest", + " | ", + "MgetRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "MgetResponse", + ">; }; migration: ", + "default", + "; ml: ", + "default", + "; msearch: { >(this: That, params: ", + "MsearchRequest", + " | ", + "MsearchRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "MsearchResponse", + ">; >(this: That, params: ", + "MsearchRequest", + " | ", + "MsearchRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "MsearchResponse", + ", unknown>>; >(this: That, params: ", + "MsearchRequest", + " | ", + "MsearchRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "MsearchResponse", + ">; }; msearchTemplate: { >(this: That, params: ", + "MsearchTemplateRequest", + " | ", + "MsearchTemplateRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "MsearchTemplateResponse", + ">; >(this: That, params: ", + "MsearchTemplateRequest", + " | ", + "MsearchTemplateRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "MsearchTemplateResponse", + ", unknown>>; >(this: That, params: ", + "MsearchTemplateRequest", + " | ", + "MsearchTemplateRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "MsearchTemplateResponse", + ">; }; mtermvectors: { (this: That, params?: ", + "MtermvectorsRequest", + " | ", + "MtermvectorsRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "MtermvectorsResponse", + ">; (this: That, params?: ", + "MtermvectorsRequest", + " | ", + "MtermvectorsRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "MtermvectorsResponse", + ", unknown>>; (this: That, params?: ", + "MtermvectorsRequest", + " | ", + "MtermvectorsRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "MtermvectorsResponse", + ">; }; nodes: ", + "default", + "; openPointInTime: { (this: That, params: ", + "OpenPointInTimeRequest", + " | ", + "OpenPointInTimeRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "OpenPointInTimeResponse", + ">; (this: That, params: ", + "OpenPointInTimeRequest", + " | ", + "OpenPointInTimeRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "OpenPointInTimeResponse", + ", unknown>>; (this: That, params: ", + "OpenPointInTimeRequest", + " | ", + "OpenPointInTimeRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "OpenPointInTimeResponse", + ">; }; ping: { (this: That, params?: ", + "PingRequest", + " | ", + "PingRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise; (this: That, params?: ", + "PingRequest", + " | ", + "PingRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + ">; (this: That, params?: ", + "PingRequest", + " | ", + "PingRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise; }; putScript: { (this: That, params: ", + "PutScriptRequest", + " | ", + "PutScriptRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "AcknowledgedResponseBase", + ">; (this: That, params: ", + "PutScriptRequest", + " | ", + "PutScriptRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "AcknowledgedResponseBase", + ", unknown>>; (this: That, params: ", + "PutScriptRequest", + " | ", + "PutScriptRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "AcknowledgedResponseBase", + ">; }; rankEval: { (this: That, params: ", + "RankEvalRequest", + " | ", + "RankEvalRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "RankEvalResponse", + ">; (this: That, params: ", + "RankEvalRequest", + " | ", + "RankEvalRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "RankEvalResponse", + ", unknown>>; (this: That, params: ", + "RankEvalRequest", + " | ", + "RankEvalRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "RankEvalResponse", + ">; }; reindex: { (this: That, params: ", + "ReindexRequest", + " | ", + "ReindexRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ReindexResponse", + ">; (this: That, params: ", + "ReindexRequest", + " | ", + "ReindexRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ReindexResponse", + ", unknown>>; (this: That, params: ", + "ReindexRequest", + " | ", + "ReindexRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ReindexResponse", + ">; }; reindexRethrottle: { (this: That, params: ", + "ReindexRethrottleRequest", + " | ", + "ReindexRethrottleRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ReindexRethrottleResponse", + ">; (this: That, params: ", + "ReindexRethrottleRequest", + " | ", + "ReindexRethrottleRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ReindexRethrottleResponse", + ", unknown>>; (this: That, params: ", + "ReindexRethrottleRequest", + " | ", + "ReindexRethrottleRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ReindexRethrottleResponse", + ">; }; renderSearchTemplate: { (this: That, params?: ", + "RenderSearchTemplateRequest", + " | ", + "RenderSearchTemplateRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "RenderSearchTemplateResponse", + ">; (this: That, params?: ", + "RenderSearchTemplateRequest", + " | ", + "RenderSearchTemplateRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "RenderSearchTemplateResponse", + ", unknown>>; (this: That, params?: ", + "RenderSearchTemplateRequest", + " | ", + "RenderSearchTemplateRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "RenderSearchTemplateResponse", + ">; }; rollup: ", + "default", + "; scriptsPainlessExecute: { (this: That, params?: ", + "ScriptsPainlessExecuteRequest", + " | ", + "ScriptsPainlessExecuteRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ScriptsPainlessExecuteResponse", + ">; (this: That, params?: ", + "ScriptsPainlessExecuteRequest", + " | ", + "ScriptsPainlessExecuteRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ScriptsPainlessExecuteResponse", + ", unknown>>; (this: That, params?: ", + "ScriptsPainlessExecuteRequest", + " | ", + "ScriptsPainlessExecuteRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ScriptsPainlessExecuteResponse", + ">; }; scroll: { >(this: That, params: ", + "ScrollRequest", + " | ", + "ScrollRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "ScrollResponse", + ">; >(this: That, params: ", + "ScrollRequest", + " | ", + "ScrollRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "ScrollResponse", + ", unknown>>; >(this: That, params: ", + "ScrollRequest", + " | ", + "ScrollRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "ScrollResponse", + ">; }; searchMvt: { (this: That, params: ", + "SearchMvtRequest", + " | ", + "SearchMvtRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise; (this: That, params: ", + "SearchMvtRequest", + " | ", + "SearchMvtRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + ">; (this: That, params: ", + "SearchMvtRequest", + " | ", + "SearchMvtRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise; }; searchShards: { (this: That, params?: ", + "SearchShardsRequest", + " | ", + "SearchShardsRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "SearchShardsResponse", + ">; (this: That, params?: ", + "SearchShardsRequest", + " | ", + "SearchShardsRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "SearchShardsResponse", + ", unknown>>; (this: That, params?: ", + "SearchShardsRequest", + " | ", + "SearchShardsRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "SearchShardsResponse", + ">; }; searchTemplate: { (this: That, params?: ", + "SearchTemplateRequest", + " | ", + "SearchTemplateRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "SearchTemplateResponse", + ">; (this: That, params?: ", + "SearchTemplateRequest", + " | ", + "SearchTemplateRequest", + " | undefined, options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "SearchTemplateResponse", + ", unknown>>; (this: That, params?: ", + "SearchTemplateRequest", + " | ", + "SearchTemplateRequest", + " | undefined, options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "SearchTemplateResponse", + ">; }; searchableSnapshots: ", + "default", + "; shutdown: ", + "default", + "; slm: ", + "default", + "; snapshot: ", + "default", + "; sql: ", + "default", + "; ssl: ", + "default", + "; tasks: ", + "default", + "; termsEnum: { (this: That, params: ", + "TermsEnumRequest", + " | ", + "TermsEnumRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "TermsEnumResponse", + ">; (this: That, params: ", + "TermsEnumRequest", + " | ", + "TermsEnumRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "TermsEnumResponse", + ", unknown>>; (this: That, params: ", + "TermsEnumRequest", + " | ", + "TermsEnumRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "TermsEnumResponse", + ">; }; termvectors: { (this: That, params: ", + "TermvectorsRequest", + " | ", + "TermvectorsRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "TermvectorsResponse", + ">; (this: That, params: ", + "TermvectorsRequest", + " | ", + "TermvectorsRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "TermvectorsResponse", + ", unknown>>; (this: That, params: ", + "TermvectorsRequest", + " | ", + "TermvectorsRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "TermvectorsResponse", + ">; }; textStructure: ", + "default", + "; transform: ", + "default", + "; updateByQuery: { (this: That, params: ", + "UpdateByQueryRequest", + " | ", + "UpdateByQueryRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "UpdateByQueryResponse", + ">; (this: That, params: ", + "UpdateByQueryRequest", + " | ", + "UpdateByQueryRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "UpdateByQueryResponse", + ", unknown>>; (this: That, params: ", + "UpdateByQueryRequest", + " | ", + "UpdateByQueryRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "UpdateByQueryResponse", + ">; }; updateByQueryRethrottle: { (this: That, params: ", + "UpdateByQueryRethrottleRequest", + " | ", + "UpdateByQueryRethrottleRequest", + ", options?: ", + "TransportRequestOptionsWithOutMeta", + " | undefined): Promise<", + "UpdateByQueryRethrottleResponse", + ">; (this: That, params: ", + "UpdateByQueryRethrottleRequest", + " | ", + "UpdateByQueryRethrottleRequest", + ", options?: ", + "TransportRequestOptionsWithMeta", + " | undefined): Promise<", + "TransportResult", + "<", + "UpdateByQueryRethrottleResponse", + ", unknown>>; (this: That, params: ", + "UpdateByQueryRethrottleRequest", + " | ", + "UpdateByQueryRethrottleRequest", + ", options?: ", + "TransportRequestOptions", + " | undefined): Promise<", + "UpdateByQueryRethrottleResponse", + ">; }; watcher: ", + "default", + "; xpack: ", + "default", + "; }" + ], + "path": "src/plugins/data_views/server/types.ts", + "deprecated": false, + "trackAdoption": false }, - "[]>" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.getFieldsForIndexPattern.$1", - "type": "CompoundType", + "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$3", + "type": "Object", "tags": [], - "label": "indexPattern", + "label": "request", "description": [], "signature": [ { - "pluginId": "dataViews", + "pluginId": "@kbn/core-http-server", "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "docId": "kibKbnCoreHttpServerPluginApi", + "section": "def-common.KibanaRequest", + "text": "KibanaRequest" }, - " | ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } + " | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/types.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.getFieldsForIndexPattern.$2", - "type": "Object", + "id": "def-server.DataViewsServerPluginStart.dataViewsServiceFactory.$4", + "type": "CompoundType", "tags": [], - "label": "options", - "description": [ - "options for getting field list" - ], + "label": "byPassCapabilities", + "description": [], "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" - }, - " | undefined" + "boolean | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/types.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": false + "trackAdoption": false } - ], - "returnComment": [ - "FieldSpec[]" ] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor", + "type": "Interface", + "tags": [], + "label": "FieldDescriptor", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.aggregatable", + "type": "boolean", + "tags": [], + "label": "aggregatable", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.refreshFields", - "type": "Function", + "id": "def-server.FieldDescriptor.name", + "type": "string", "tags": [], - "label": "refreshFields", - "description": [ - "\nRefresh field list for a given index pattern." + "label": "name", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.readFromDocValues", + "type": "boolean", + "tags": [], + "label": "readFromDocValues", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.searchable", + "type": "boolean", + "tags": [], + "label": "searchable", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.esTypes", + "type": "Array", + "tags": [], + "label": "esTypes", + "description": [], + "signature": [ + "string[]" ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.subType", + "type": "Object", + "tags": [], + "label": "subType", + "description": [], "signature": [ - "(dataView: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ", displayErrors?: boolean) => Promise" + "FieldSubType | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.refreshFields.$1", - "type": "Object", - "tags": [], - "label": "dataView", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.refreshFields.$2", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.metadata_field", + "type": "CompoundType", + "tags": [], + "label": "metadata_field", + "description": [], + "signature": [ + "boolean | undefined" ], - "returnComment": [] + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.FieldDescriptor.fixedInterval", + "type": "Array", + "tags": [], + "label": "fixedInterval", + "description": [], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", + "deprecated": false, + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.fieldArrayToMap", - "type": "Function", + "id": "def-server.FieldDescriptor.timeZone", + "type": "Array", "tags": [], - "label": "fieldArrayToMap", - "description": [ - "\nConverts field array to map." - ], + "label": "timeZone", + "description": [], "signature": [ - "(fields: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[], fieldAttrs?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" - }, - " | undefined) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewFieldMap", - "text": "DataViewFieldMap" - } + "string[] | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.fieldArrayToMap.$1", - "type": "Array", - "tags": [], - "label": "fields", - "description": [ - ": FieldSpec[]" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[]" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.fieldArrayToMap.$2", - "type": "Object", - "tags": [], - "label": "fieldAttrs", - "description": [ - ": FieldAttrs" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } - ], - "returnComment": [ - "Record" - ] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.savedObjectToSpec", - "type": "Function", + "id": "def-server.FieldDescriptor.timeSeriesMetric", + "type": "CompoundType", "tags": [], - "label": "savedObjectToSpec", - "description": [ - "\nConverts data view saved object to data view spec." - ], + "label": "timeSeriesMetric", + "description": [], "signature": [ - "(savedObject: ", - { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" - }, - "<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" - }, - ">) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } + "\"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.savedObjectToSpec.$1", - "type": "Object", - "tags": [], - "label": "savedObject", - "description": [], - "signature": [ - { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" - }, - "<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" - }, - ">" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "DataViewSpec" - ] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.get", - "type": "Function", + "id": "def-server.FieldDescriptor.timeSeriesDimension", + "type": "CompoundType", "tags": [], - "label": "get", - "description": [ - "\nGet an index pattern by id, cache optimized." - ], + "label": "timeSeriesDimension", + "description": [], "signature": [ - "(id: string, displayErrors?: boolean, refreshFields?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" + "boolean | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/server/fetcher/index_patterns_fetcher.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.get.$1", - "type": "string", - "tags": [], - "label": "id", - "description": [], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.get.$2", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.get.$3", - "type": "boolean", - "tags": [], - "label": "refreshFields", - "description": [ - "- If set true, will fetch fields from the index pattern" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.IEsSearchRequest", + "type": "Interface", + "tags": [], + "label": "IEsSearchRequest", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IEsSearchRequest", + "text": "IEsSearchRequest" + }, + " extends ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IKibanaSearchRequest", + "text": "IKibanaSearchRequest" + }, + "<", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.ISearchRequestParams", + "text": "ISearchRequestParams" }, + ">" + ], + "path": "src/plugins/data/common/search/strategies/es_search/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewsService.create", - "type": "Function", + "id": "def-server.IEsSearchRequest.indexType", + "type": "string", "tags": [], - "label": "create", + "label": "indexType", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data/common/search/strategies/es_search/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.ISearchOptions", + "type": "Interface", + "tags": [], + "label": "ISearchOptions", + "description": [], + "path": "src/plugins/data/common/search/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.ISearchOptions.abortSignal", + "type": "Object", + "tags": [], + "label": "abortSignal", "description": [ - "\nCreate data view instance." + "\nAn `AbortSignal` that allows the caller of `search` to abort a search request." ], "signature": [ - "(spec: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" + "AbortSignal | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/types.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.create.$1", - "type": "Object", - "tags": [], - "label": "spec", - "description": [ - "data view spec" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.create.$2", - "type": "boolean", - "tags": [], - "label": "skipFetchFields", - "description": [ - "if true, will not fetch fields" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.create.$3", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [ - "DataView" - ] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.createAndSave", - "type": "Function", + "id": "def-server.ISearchOptions.strategy", + "type": "string", "tags": [], - "label": "createAndSave", + "label": "strategy", "description": [ - "\nCreate a new data view and save it right away." + "\nUse this option to force using a specific server side search strategy. Leave empty to use the default strategy." ], "signature": [ - "(spec: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", override?: boolean, skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" + "string | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/types.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createAndSave.$1", - "type": "Object", - "tags": [], - "label": "spec", - "description": [ - "data view spec" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createAndSave.$2", - "type": "boolean", - "tags": [], - "label": "override", - "description": [ - "Overwrite if existing index pattern exists." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createAndSave.$3", - "type": "boolean", - "tags": [], - "label": "skipFetchFields", - "description": [ - "Whether to skip field refresh step." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createAndSave.$4", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.ISearchOptions.legacyHitsTotal", + "type": "CompoundType", + "tags": [], + "label": "legacyHitsTotal", + "description": [ + "\nRequest the legacy format for the total number of hits. If sending `rest_total_hits_as_int` to\nsomething other than `true`, this should be set to `false`." ], - "returnComment": [] + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data/common/search/types.ts", + "deprecated": false, + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.createSavedObject", - "type": "Function", + "id": "def-server.ISearchOptions.sessionId", + "type": "string", "tags": [], - "label": "createSavedObject", + "label": "sessionId", "description": [ - "\nSave a new data view." + "\nA session ID, grouping multiple search requests into a single session." ], "signature": [ - "(dataView: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ", override?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">" + "string | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/types.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createSavedObject.$1", - "type": "Object", - "tags": [], - "label": "dataView", - "description": [ - "data view instance" - ], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createSavedObject.$2", - "type": "boolean", - "tags": [], - "label": "override", - "description": [ - "Overwrite if existing index pattern exists" - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.createSavedObject.$3", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.updateSavedObject", - "type": "Function", + "id": "def-server.ISearchOptions.isStored", + "type": "CompoundType", "tags": [], - "label": "updateSavedObject", + "label": "isStored", "description": [ - "\nSave existing data view. Will attempt to merge differences if there are conflicts." + "\nWhether the session is already saved (i.e. sent to background)" ], "signature": [ - "(indexPattern: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ", saveAttempts?: number, ignoreErrors?: boolean, displayErrors?: boolean) => Promise" + "boolean | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/types.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.updateSavedObject.$1", - "type": "Object", - "tags": [], - "label": "indexPattern", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - } - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.updateSavedObject.$2", - "type": "number", - "tags": [], - "label": "saveAttempts", - "description": [], - "signature": [ - "number" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.updateSavedObject.$3", - "type": "boolean", - "tags": [], - "label": "ignoreErrors", - "description": [], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.updateSavedObject.$4", - "type": "boolean", - "tags": [], - "label": "displayErrors", - "description": [ - "- If set false, API consumer is responsible for displaying and handling errors." - ], - "signature": [ - "boolean" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.ISearchOptions.isSearchStored", + "type": "CompoundType", + "tags": [], + "label": "isSearchStored", + "description": [ + "\nWhether the search was successfully polled after session was saved. Search was added to a session saved object and keepAlive extended." ], - "returnComment": [] + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data/common/search/types.ts", + "deprecated": false, + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.delete", - "type": "Function", + "id": "def-server.ISearchOptions.isRestore", + "type": "CompoundType", "tags": [], - "label": "delete", + "label": "isRestore", "description": [ - "\nDeletes an index pattern from .kibana index." + "\nWhether the session is restored (i.e. search requests should re-use the stored search IDs,\nrather than starting from scratch)" ], "signature": [ - "(indexPatternId: string) => Promise<{}>" + "boolean | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/types.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.delete.$1", - "type": "string", - "tags": [], - "label": "indexPatternId", - "description": [ - ": Id of kibana Index Pattern to delete" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.ISearchOptions.executionContext", + "type": "Object", + "tags": [], + "label": "executionContext", + "description": [ + "\nRepresents a meta-information about a Kibana entity intitating a saerch request." ], - "returnComment": [] + "signature": [ + { + "pluginId": "@kbn/core-execution-context-common", + "scope": "common", + "docId": "kibKbnCoreExecutionContextCommonPluginApi", + "section": "def-common.KibanaExecutionContext", + "text": "KibanaExecutionContext" + }, + " | undefined" + ], + "path": "src/plugins/data/common/search/types.ts", + "deprecated": false, + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewsService.getDefaultDataView", - "type": "Function", + "id": "def-server.ISearchOptions.indexPattern", + "type": "Object", "tags": [], - "label": "getDefaultDataView", + "label": "indexPattern", "description": [ - "\nReturns the default data view as an object.\nIf no default is found, or it is missing\nanother data view is selected as default and returned.\nIf no possible data view found to become a default returns null.\n" + "\nIndex pattern reference is used for better error messages" ], "signature": [ - "(refreshFields?: boolean | undefined) => Promise<", { "pluginId": "dataViews", "scope": "common", @@ -26897,751 +19780,969 @@ "section": "def-common.DataView", "text": "DataView" }, - " | null>" + " | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data/common/search/types.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewsService.getDefaultDataView.$1", - "type": "CompoundType", - "tags": [], - "label": "refreshFields", - "description": [ - "- if true, will refresh the fields of the default data view" - ], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": false - } + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.ISearchOptions.transport", + "type": "Object", + "tags": [], + "label": "transport", + "description": [ + "\nTransportRequestOptions, other than `signal`, to pass through to the ES client.\nTo pass an abort signal, use {@link ISearchOptions.abortSignal}" ], - "returnComment": [ - "default data view" - ] + "signature": [ + "Omit<", + "TransportRequestOptions", + ", \"signal\"> | undefined" + ], + "path": "src/plugins/data/common/search/types.ts", + "deprecated": false, + "trackAdoption": false } ], "initialIsOpen": false + } + ], + "enums": [ + { + "parentPluginId": "data", + "id": "def-server.ES_FIELD_TYPES", + "type": "Enum", + "tags": [], + "label": "ES_FIELD_TYPES", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.DuplicateDataViewError", - "type": "Class", + "id": "def-server.KBN_FIELD_TYPES", + "type": "Enum", "tags": [], - "label": "DuplicateDataViewError", - "description": [ - "\nError thrown when attempting to create duplicate index pattern based on title." - ], + "label": "KBN_FIELD_TYPES", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.METRIC_TYPES", + "type": "Enum", + "tags": [], + "label": "METRIC_TYPES", + "description": [], + "path": "src/plugins/data/common/search/aggs/metrics/metric_agg_types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + } + ], + "misc": [ + { + "parentPluginId": "data", + "id": "def-server.DEFAULT_QUERY_LANGUAGE", + "type": "string", + "tags": [], + "label": "DEFAULT_QUERY_LANGUAGE", + "description": [], "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DuplicateDataViewError", - "text": "DuplicateDataViewError" - }, - " extends Error" + "\"kuery\"" ], - "path": "src/plugins/data_views/common/errors/duplicate_index_pattern.ts", + "path": "src/plugins/data/common/constants.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DuplicateDataViewError.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [ - "\nconstructor" - ], - "signature": [ - "any" - ], - "path": "src/plugins/data_views/common/errors/duplicate_index_pattern.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DuplicateDataViewError.Unnamed.$1", - "type": "string", - "tags": [], - "label": "message", - "description": [ - "- Error message" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/errors/duplicate_index_pattern.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - } - ], "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.KbnFieldType", - "type": "Class", + "id": "def-server.ES_SEARCH_STRATEGY", + "type": "string", "tags": [], - "label": "KbnFieldType", + "label": "ES_SEARCH_STRATEGY", "description": [], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "signature": [ + "\"es\"" + ], + "path": "src/plugins/data/common/search/strategies/es_search/types.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.KbnFieldType.name", - "type": "string", - "tags": [], - "label": "name", - "description": [], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", - "deprecated": false, - "trackAdoption": false - }, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.IEsSearchResponse", + "type": "Type", + "tags": [], + "label": "IEsSearchResponse", + "description": [], + "signature": [ { - "parentPluginId": "data", - "id": "def-common.KbnFieldType.sortable", - "type": "boolean", - "tags": [], - "label": "sortable", - "description": [], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", - "deprecated": false, - "trackAdoption": false + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IKibanaSearchResponse", + "text": "IKibanaSearchResponse" }, + "<", + "SearchResponse", + ">>" + ], + "path": "src/plugins/data/common/search/strategies/es_search/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-server.ParsedInterval", + "type": "Type", + "tags": [], + "label": "ParsedInterval", + "description": [], + "signature": [ + "{ value: number; unit: ", { - "parentPluginId": "data", - "id": "def-common.KbnFieldType.filterable", - "type": "boolean", - "tags": [], - "label": "filterable", - "description": [], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", - "deprecated": false, - "trackAdoption": false + "pluginId": "@kbn/datemath", + "scope": "common", + "docId": "kibKbnDatemathPluginApi", + "section": "def-common.Unit", + "text": "Unit" }, + "; type: \"fixed\" | \"calendar\"; }" + ], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_es_interval.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + } + ], + "objects": [ + { + "parentPluginId": "data", + "id": "def-server.exporters", + "type": "Object", + "tags": [], + "label": "exporters", + "description": [], + "path": "src/plugins/data/server/index.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { "parentPluginId": "data", - "id": "def-common.KbnFieldType.esTypes", - "type": "Object", + "id": "def-server.exporters.datatableToCSV", + "type": "Function", "tags": [], - "label": "esTypes", + "label": "datatableToCSV", "description": [], "signature": [ - "readonly ", + "({ columns, rows }: ", { - "pluginId": "@kbn/field-types", + "pluginId": "expressions", "scope": "common", - "docId": "kibKbnFieldTypesPluginApi", - "section": "def-common.ES_FIELD_TYPES", - "text": "ES_FIELD_TYPES" + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" }, - "[]" - ], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.KbnFieldType.Unnamed", - "type": "Function", - "tags": [], - "label": "Constructor", - "description": [], - "signature": [ - "any" + ", { csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }: CSVOptions) => string" ], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "path": "src/plugins/data/server/index.ts", "deprecated": false, "trackAdoption": false, + "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-common.KbnFieldType.Unnamed.$1", + "id": "def-server.exporters.datatableToCSV.$1", "type": "Object", "tags": [], - "label": "options", + "label": "__0", "description": [], "signature": [ - "Partial<", { - "pluginId": "@kbn/field-types", + "pluginId": "expressions", "scope": "common", - "docId": "kibKbnFieldTypesPluginApi", - "section": "def-common.KbnFieldTypeOptions", - "text": "KbnFieldTypeOptions" - }, - ">" + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + } ], - "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "path": "src/plugins/data/common/exports/export_csv.tsx", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.exporters.datatableToCSV.$2", + "type": "Object", + "tags": [], + "label": "__1", + "description": [], + "signature": [ + "CSVOptions" + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false } - ], - "returnComment": [] - } - ], - "initialIsOpen": false - } - ], - "functions": [ - { - "parentPluginId": "data", - "id": "def-common.cellHasFormulas", - "type": "Function", - "tags": [], - "label": "cellHasFormulas", - "description": [], - "signature": [ - "(val: string) => boolean" - ], - "path": "src/plugins/data/common/exports/formula_checks.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + ] + }, { "parentPluginId": "data", - "id": "def-common.cellHasFormulas.$1", + "id": "def-server.exporters.CSV_MIME_TYPE", "type": "string", "tags": [], - "label": "val", + "label": "CSV_MIME_TYPE", "description": [], - "signature": [ - "string" - ], - "path": "src/plugins/data/common/exports/formula_checks.ts", + "path": "src/plugins/data/server/index.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false } ], - "returnComment": [], "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.createEscapeValue", - "type": "Function", + "id": "def-server.search", + "type": "Object", "tags": [], - "label": "createEscapeValue", - "description": [ - "\nCreate a function that will escape CSV values like \"=\", \"@\" and \"+\" with a\n\"'\". This will also place CSV values in \"\" if contain non-alphanumeric chars.\n\nFor example:\n\nGiven: =1+1\nReturns: \"'=1+1\"\n\nSee OWASP: https://www.owasp.org/index.php/CSV_Injection." - ], - "signature": [ - "(quoteValues: boolean, escapeFormulas: boolean) => (val: RawValue) => string" - ], - "path": "src/plugins/data/common/exports/escape_value.ts", + "label": "search", + "description": [], + "path": "src/plugins/data/server/index.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.createEscapeValue.$1", - "type": "boolean", - "tags": [], - "label": "quoteValues", - "description": [], - "signature": [ - "boolean" - ], - "path": "src/plugins/data/common/exports/escape_value.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.createEscapeValue.$2", - "type": "boolean", + "id": "def-server.search.aggs", + "type": "Object", "tags": [], - "label": "escapeFormulas", + "label": "aggs", "description": [], - "signature": [ - "boolean" - ], - "path": "src/plugins/data/common/exports/escape_value.ts", + "path": "src/plugins/data/server/index.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true + "children": [ + { + "parentPluginId": "data", + "id": "def-server.search.aggs.CidrMask", + "type": "Object", + "tags": [], + "label": "CidrMask", + "description": [], + "signature": [ + "typeof ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.CidrMask", + "text": "CidrMask" + } + ], + "path": "src/plugins/data/server/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.search.aggs.dateHistogramInterval", + "type": "Function", + "tags": [], + "label": "dateHistogramInterval", + "description": [], + "signature": [ + "(interval: string, shouldForceFixed?: boolean | undefined) => Interval" + ], + "path": "src/plugins/data/server/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-server.search.aggs.dateHistogramInterval.$1", + "type": "string", + "tags": [], + "label": "interval", + "description": [], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.search.aggs.dateHistogramInterval.$2", + "type": "CompoundType", + "tags": [], + "label": "shouldForceFixed", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/date_histogram_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "data", + "id": "def-server.search.aggs.IpAddress", + "type": "Object", + "tags": [], + "label": "IpAddress", + "description": [], + "signature": [ + "typeof ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IpAddress", + "text": "IpAddress" + } + ], + "path": "src/plugins/data/server/index.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.search.aggs.parseInterval", + "type": "Function", + "tags": [], + "label": "parseInterval", + "description": [], + "signature": [ + "(interval: string) => moment.Duration | null" + ], + "path": "src/plugins/data/server/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-server.search.aggs.parseInterval.$1", + "type": "string", + "tags": [], + "label": "interval", + "description": [], + "path": "src/plugins/data/common/search/aggs/utils/date_interval_utils/parse_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "data", + "id": "def-server.search.aggs.calcAutoIntervalLessThan", + "type": "Function", + "tags": [], + "label": "calcAutoIntervalLessThan", + "description": [], + "signature": [ + "(maxBucketCount: number, duration: number) => moment.Duration" + ], + "path": "src/plugins/data/server/index.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ + { + "parentPluginId": "data", + "id": "def-server.search.aggs.calcAutoIntervalLessThan.$1", + "type": "number", + "tags": [], + "label": "maxBucketCount", + "description": [], + "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.search.aggs.calcAutoIntervalLessThan.$2", + "type": "number", + "tags": [], + "label": "duration", + "description": [], + "path": "src/plugins/data/common/search/aggs/buckets/lib/time_buckets/calc_auto_interval.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] } ], - "returnComment": [], "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.datatableToCSV", - "type": "Function", + "id": "def-server.UI_SETTINGS", + "type": "Object", "tags": [], - "label": "datatableToCSV", + "label": "UI_SETTINGS", "description": [], "signature": [ - "({ columns, rows }: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - }, - ", { csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }: CSVOptions) => string" + "{ readonly META_FIELDS: \"metaFields\"; readonly DOC_HIGHLIGHT: \"doc_table:highlight\"; readonly QUERY_STRING_OPTIONS: \"query:queryString:options\"; readonly QUERY_ALLOW_LEADING_WILDCARDS: \"query:allowLeadingWildcards\"; readonly SEARCH_QUERY_LANGUAGE: \"search:queryLanguage\"; readonly SORT_OPTIONS: \"sort:options\"; readonly COURIER_IGNORE_FILTER_IF_FIELD_NOT_IN_INDEX: \"courier:ignoreFilterIfFieldNotInIndex\"; readonly COURIER_SET_REQUEST_PREFERENCE: \"courier:setRequestPreference\"; readonly COURIER_CUSTOM_REQUEST_PREFERENCE: \"courier:customRequestPreference\"; readonly COURIER_MAX_CONCURRENT_SHARD_REQUESTS: \"courier:maxConcurrentShardRequests\"; readonly SEARCH_INCLUDE_FROZEN: \"search:includeFrozen\"; readonly SEARCH_TIMEOUT: \"search:timeout\"; readonly HISTOGRAM_BAR_TARGET: \"histogram:barTarget\"; readonly HISTOGRAM_MAX_BARS: \"histogram:maxBars\"; readonly HISTORY_LIMIT: \"history:limit\"; readonly TIMEPICKER_REFRESH_INTERVAL_DEFAULTS: \"timepicker:refreshIntervalDefaults\"; readonly TIMEPICKER_QUICK_RANGES: \"timepicker:quickRanges\"; readonly TIMEPICKER_TIME_DEFAULTS: \"timepicker:timeDefaults\"; readonly FILTERS_PINNED_BY_DEFAULT: \"filters:pinnedByDefault\"; readonly FILTERS_EDITOR_SUGGEST_VALUES: \"filterEditor:suggestValues\"; readonly AUTOCOMPLETE_USE_TIMERANGE: \"autocomplete:useTimeRange\"; readonly AUTOCOMPLETE_VALUE_SUGGESTION_METHOD: \"autocomplete:valueSuggestionMethod\"; readonly DATE_FORMAT: \"dateFormat\"; readonly DATEFORMAT_TZ: \"dateFormat:tz\"; }" ], - "path": "src/plugins/data/common/exports/export_csv.tsx", + "path": "src/plugins/data/common/constants.ts", "deprecated": false, "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.datatableToCSV.$1", - "type": "Object", - "tags": [], - "label": "{ columns, rows }", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.Datatable", - "text": "Datatable" - } - ], - "path": "src/plugins/data/common/exports/export_csv.tsx", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.datatableToCSV.$2", - "type": "Object", - "tags": [], - "label": "{ csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }", - "description": [], - "signature": [ - "CSVOptions" - ], - "path": "src/plugins/data/common/exports/export_csv.tsx", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], "initialIsOpen": false - }, + } + ], + "setup": { + "parentPluginId": "data", + "id": "def-server.DataPluginSetup", + "type": "Interface", + "tags": [], + "label": "DataPluginSetup", + "description": [], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataPluginSetup.search", + "type": "Object", + "tags": [], + "label": "search", + "description": [], + "signature": [ + "ISearchSetup" + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataPluginSetup.query", + "type": "Object", + "tags": [], + "label": "query", + "description": [], + "signature": [ + "QuerySetup" + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataPluginSetup.fieldFormats", + "type": "Object", + "tags": [ + "deprecated" + ], + "label": "fieldFormats", + "description": [], + "signature": [ + { + "pluginId": "fieldFormats", + "scope": "server", + "docId": "kibFieldFormatsPluginApi", + "section": "def-server.FieldFormatsSetup", + "text": "FieldFormatsSetup" + } + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": true, + "trackAdoption": false, + "references": [] + } + ], + "lifecycle": "setup", + "initialIsOpen": true + }, + "start": { + "parentPluginId": "data", + "id": "def-server.DataPluginStart", + "type": "Interface", + "tags": [], + "label": "DataPluginStart", + "description": [], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-server.DataPluginStart.search", + "type": "Object", + "tags": [], + "label": "search", + "description": [], + "signature": [ + "ISearchStart", + "<", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IEsSearchRequest", + "text": "IEsSearchRequest" + }, + ", ", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.IEsSearchResponse", + "text": "IEsSearchResponse" + }, + ">" + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataPluginStart.fieldFormats", + "type": "Object", + "tags": [ + "deprecated" + ], + "label": "fieldFormats", + "description": [], + "signature": [ + { + "pluginId": "fieldFormats", + "scope": "server", + "docId": "kibFieldFormatsPluginApi", + "section": "def-server.FieldFormatsStart", + "text": "FieldFormatsStart" + } + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": true, + "trackAdoption": false, + "references": [] + }, + { + "parentPluginId": "data", + "id": "def-server.DataPluginStart.indexPatterns", + "type": "Object", + "tags": [], + "label": "indexPatterns", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "server", + "docId": "kibDataViewsPluginApi", + "section": "def-server.DataViewsServerPluginStart", + "text": "DataViewsServerPluginStart" + } + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "data", + "id": "def-server.DataPluginStart.datatableUtilities", + "type": "Object", + "tags": [], + "label": "datatableUtilities", + "description": [ + "\nDatatable type utility functions." + ], + "signature": [ + "DatatableUtilitiesService" + ], + "path": "src/plugins/data/server/plugin.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "lifecycle": "start", + "initialIsOpen": true + } + }, + "common": { + "classes": [ { "parentPluginId": "data", - "id": "def-common.fieldList", - "type": "Function", + "id": "def-common.DatatableUtilitiesService", + "type": "Class", "tags": [], - "label": "fieldList", + "label": "DatatableUtilitiesService", "description": [], - "signature": [ - "(specs?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[], shortDotsEnable?: boolean) => ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.IIndexPatternFieldList", - "text": "IIndexPatternFieldList" - } - ], - "path": "src/plugins/data_views/common/fields/field_list.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.fieldList.$1", - "type": "Array", + "id": "def-common.DatatableUtilitiesService.Unnamed", + "type": "Function", "tags": [], - "label": "specs", + "label": "Constructor", "description": [], "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "[]" + "any" ], - "path": "src/plugins/data_views/common/fields/field_list.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true - }, - { - "parentPluginId": "data", - "id": "def-common.fieldList.$2", - "type": "boolean", - "tags": [], - "label": "shortDotsEnable", - "description": [], - "signature": [ - "boolean" + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.Unnamed.$1", + "type": "Object", + "tags": [], + "label": "aggs", + "description": [], + "signature": [ + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggsCommonStart", + "text": "AggsCommonStart" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.Unnamed.$2", + "type": "Object", + "tags": [], + "label": "dataViews", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewsContract", + "text": "DataViewsContract" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.Unnamed.$3", + "type": "Object", + "tags": [], + "label": "fieldFormats", + "description": [], + "signature": [ + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormatsStartCommon", + "text": "FieldFormatsStartCommon" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/fields/field_list.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.getEsQueryConfig", - "type": "Function", - "tags": [], - "label": "getEsQueryConfig", - "description": [], - "signature": [ - "(config: KibanaConfig) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.EsQueryConfig", - "text": "EsQueryConfig" - } - ], - "path": "src/plugins/data/common/es_query/get_es_query_config.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + "returnComment": [] + }, { "parentPluginId": "data", - "id": "def-common.getEsQueryConfig.$1", - "type": "Object", + "id": "def-common.DatatableUtilitiesService.clearField", + "type": "Function", "tags": [], - "label": "config", + "label": "clearField", "description": [], "signature": [ - "KibanaConfig" + "(column: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ") => void" ], - "path": "src/plugins/data/common/es_query/get_es_query_config.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.getFieldSubtypeMulti", - "type": "Function", - "tags": [], - "label": "getFieldSubtypeMulti", - "description": [], - "signature": [ - "(field: HasSubtype) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubTypeMulti", - "text": "IFieldSubTypeMulti" - }, - " | undefined" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.clearField.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + }, { "parentPluginId": "data", - "id": "def-common.getFieldSubtypeMulti.$1", - "type": "Object", + "id": "def-common.DatatableUtilitiesService.clearFieldFormat", + "type": "Function", "tags": [], - "label": "field", + "label": "clearFieldFormat", "description": [], "signature": [ - "{ subType?: ", + "(column: ", { - "pluginId": "@kbn/es-query", + "pluginId": "expressions", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" }, - " | undefined; }" + ") => void" ], - "path": "src/plugins/data_views/common/fields/utils.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.getFieldSubtypeNested", - "type": "Function", - "tags": [], - "label": "getFieldSubtypeNested", - "description": [], - "signature": [ - "(field: HasSubtype) => ", - { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubTypeNested", - "text": "IFieldSubTypeNested" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.clearFieldFormat.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - " | undefined" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ { "parentPluginId": "data", - "id": "def-common.getFieldSubtypeNested.$1", - "type": "Object", + "id": "def-common.DatatableUtilitiesService.getAggConfig", + "type": "Function", "tags": [], - "label": "field", + "label": "getAggConfig", "description": [], "signature": [ - "{ subType?: ", + "(column: ", { - "pluginId": "@kbn/es-query", + "pluginId": "expressions", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" }, - " | undefined; }" + ") => Promise<", + { + "pluginId": "data", + "scope": "common", + "docId": "kibDataSearchPluginApi", + "section": "def-common.AggConfig", + "text": "AggConfig" + }, + " | undefined>" ], - "path": "src/plugins/data_views/common/fields/utils.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.getIndexPatternLoadMeta", - "type": "Function", - "tags": [], - "label": "getIndexPatternLoadMeta", - "description": [], - "signature": [ - "() => Omit<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.IndexPatternLoadExpressionFunctionDefinition", - "text": "IndexPatternLoadExpressionFunctionDefinition" - }, - ", \"fn\">" - ], - "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.isFilterable", - "type": "Function", - "tags": [], - "label": "isFilterable", - "description": [], - "signature": [ - "(field: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getAggConfig.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - ") => boolean" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.isFilterable.$1", - "type": "Object", + "id": "def-common.DatatableUtilitiesService.getDateHistogramMeta", + "type": "Function", "tags": [], - "label": "field", - "description": [], + "label": "getDateHistogramMeta", + "description": [ + "\nHelper function returning the used interval, used time zone and applied time filters for data table column created by the date_histogramm agg type.\n\"auto\" will get expanded to the actually used interval.\nIf the column is not a column created by a date_histogram aggregation of the esaggs data source,\nthis function will return undefined." + ], "signature": [ + "(column: ", { - "pluginId": "dataViews", + "pluginId": "expressions", "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewField", - "text": "DataViewField" - } + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ", defaults?: Partial<{ timeZone: string; }>) => DateHistogramMeta | undefined" ], - "path": "src/plugins/data_views/common/fields/utils.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.isMultiField", - "type": "Function", - "tags": [], - "label": "isMultiField", - "description": [], - "signature": [ - "(field: HasSubtype) => boolean" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getDateHistogramMeta.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getDateHistogramMeta.$2", + "type": "Object", + "tags": [], + "label": "defaults", + "description": [], + "signature": [ + "Partial<{ timeZone: string; }>" + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + }, { "parentPluginId": "data", - "id": "def-common.isMultiField.$1", - "type": "Object", + "id": "def-common.DatatableUtilitiesService.getDataView", + "type": "Function", "tags": [], - "label": "field", + "label": "getDataView", "description": [], "signature": [ - "{ subType?: ", + "(column: ", { - "pluginId": "@kbn/es-query", + "pluginId": "expressions", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" }, - " | undefined; }" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.isNestedField", - "type": "Function", - "tags": [], - "label": "isNestedField", - "description": [], - "signature": [ - "(field: HasSubtype) => boolean" - ], - "path": "src/plugins/data_views/common/fields/utils.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ - { - "parentPluginId": "data", - "id": "def-common.isNestedField.$1", - "type": "Object", - "tags": [], - "label": "field", - "description": [], - "signature": [ - "{ subType?: ", + ") => Promise<", { - "pluginId": "@kbn/es-query", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.IFieldSubType", - "text": "IFieldSubType" + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, - " | undefined; }" + " | undefined>" ], - "path": "src/plugins/data_views/common/fields/utils.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.tableHasFormulas", - "type": "Function", - "tags": [], - "label": "tableHasFormulas", - "description": [], - "signature": [ - "(columns: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableColumn", - "text": "DatatableColumn" - }, - "[], rows: ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableRow", - "text": "DatatableRow" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getDataView.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - "[]) => boolean" - ], - "path": "src/plugins/data/common/exports/formula_checks.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { "parentPluginId": "data", - "id": "def-common.tableHasFormulas.$1", - "type": "Array", + "id": "def-common.DatatableUtilitiesService.getField", + "type": "Function", "tags": [], - "label": "columns", + "label": "getField", "description": [], "signature": [ + "(column: ", { "pluginId": "expressions", "scope": "common", @@ -27649,618 +20750,1265 @@ "section": "def-common.DatatableColumn", "text": "DatatableColumn" }, - "[]" + ") => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | undefined>" ], - "path": "src/plugins/data/common/exports/formula_checks.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getField.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.tableHasFormulas.$2", - "type": "Array", + "id": "def-common.DatatableUtilitiesService.getFieldFormat", + "type": "Function", "tags": [], - "label": "rows", + "label": "getFieldFormat", "description": [], "signature": [ + "(column: ", { "pluginId": "expressions", "scope": "common", "docId": "kibExpressionsPluginApi", - "section": "def-common.DatatableRow", - "text": "DatatableRow" + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" }, - "[]" + ") => ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormat", + "text": "FieldFormat" + }, + " | undefined" ], - "path": "src/plugins/data/common/exports/formula_checks.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [], - "initialIsOpen": false - } - ], - "interfaces": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewAttributes", - "type": "Interface", - "tags": [], - "label": "DataViewAttributes", - "description": [ - "\nInterface for the data view saved object" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewAttributes.fields", - "type": "string", - "tags": [], - "label": "fields", - "description": [ - "\nFields as a serialized array of field specs" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewAttributes.title", - "type": "string", - "tags": [], - "label": "title", - "description": [ - "\nData view title" + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getFieldFormat.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewAttributes.type", - "type": "string", + "id": "def-common.DatatableUtilitiesService.getInterval", + "type": "Function", "tags": [], - "label": "type", - "description": [ - "\nData view type, default or rollup" - ], + "label": "getInterval", + "description": [], "signature": [ - "string | undefined" + "(column: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ") => string | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewAttributes.typeMeta", - "type": "string", - "tags": [], - "label": "typeMeta", - "description": [ - "\nType metadata information, serialized. Only used by rollup data views." - ], - "signature": [ - "string | undefined" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getInterval.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewAttributes.timeFieldName", - "type": "string", + "id": "def-common.DatatableUtilitiesService.getNumberHistogramInterval", + "type": "Function", "tags": [], - "label": "timeFieldName", + "label": "getNumberHistogramInterval", "description": [ - "\nTime field name" + "\nHelper function returning the used interval for data table column created by the histogramm agg type.\n\"auto\" will get expanded to the actually used interval.\nIf the column is not a column created by a histogram aggregation of the esaggs data source,\nthis function will return undefined." ], "signature": [ - "string | undefined" + "(column: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ") => number | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewAttributes.sourceFilters", - "type": "string", - "tags": [], - "label": "sourceFilters", - "description": [ - "\nSerialized array of filters. Used by discover to hide fields." - ], - "signature": [ - "string | undefined" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getNumberHistogramInterval.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewAttributes.fieldFormatMap", - "type": "string", + "id": "def-common.DatatableUtilitiesService.getTotalCount", + "type": "Function", "tags": [], - "label": "fieldFormatMap", - "description": [ - "\nSerialized map of field formats by field name" - ], + "label": "getTotalCount", + "description": [], "signature": [ - "string | undefined" + "(table: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + }, + ") => number | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewAttributes.fieldAttrs", - "type": "string", - "tags": [], - "label": "fieldAttrs", - "description": [ - "\nSerialized map of field attributes, currently field count and name" - ], - "signature": [ - "string | undefined" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.getTotalCount.$1", + "type": "Object", + "tags": [], + "label": "table", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewAttributes.runtimeFieldMap", - "type": "string", + "id": "def-common.DatatableUtilitiesService.hasPrecisionError", + "type": "Function", "tags": [], - "label": "runtimeFieldMap", - "description": [ - "\nSerialized map of runtime field definitions, by field name" - ], + "label": "hasPrecisionError", + "description": [], "signature": [ - "string | undefined" + "(column: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ") => ", + { + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.Serializable", + "text": "Serializable" + } ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.hasPrecisionError.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewAttributes.allowNoIndex", - "type": "CompoundType", - "tags": [], - "label": "allowNoIndex", - "description": [ - "\nPrevents errors when index pattern exists before indices" - ], + "id": "def-common.DatatableUtilitiesService.isFilterable", + "type": "Function", + "tags": [], + "label": "isFilterable", + "description": [], "signature": [ - "boolean | undefined" + "(column: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ") => boolean" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.isFilterable.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.DataViewAttributes.name", - "type": "string", + "id": "def-common.DatatableUtilitiesService.setFieldFormat", + "type": "Function", "tags": [], - "label": "name", - "description": [ - "\nName of the data view. Human readable name used to differentiate data view." - ], + "label": "setFieldFormat", + "description": [], "signature": [ - "string | undefined" + "(column: ", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + ", fieldFormat: ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormat", + "text": "FieldFormat" + }, + ") => void" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.setFieldFormat.$1", + "type": "Object", + "tags": [], + "label": "column", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DatatableUtilitiesService.setFieldFormat.$2", + "type": "Object", + "tags": [], + "label": "fieldFormat", + "description": [], + "signature": [ + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormat", + "text": "FieldFormat" + } + ], + "path": "src/plugins/data/common/datatable_utilities/datatable_utilities_service.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] } ], "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.DataViewListItem", - "type": "Interface", + "id": "def-common.DataView", + "type": "Class", "tags": [], - "label": "DataViewListItem", + "label": "DataView", "description": [ - "\nResult from data view search - summary data." + "\nData view class. Central kibana abstraction around multiple indices." ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " implements ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.DataViewBase", + "text": "DataViewBase" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false, "children": [ { "parentPluginId": "data", - "id": "def-common.DataViewListItem.id", + "id": "def-common.DataView.id", "type": "string", "tags": [], "label": "id", "description": [ - "\nSaved object id (or generated id if in-memory only)" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewListItem.namespaces", - "type": "Array", - "tags": [], - "label": "namespaces", - "description": [ - "\nNamespace ids" + "\nSaved object id" ], "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewListItem.title", - "type": "string", - "tags": [], - "label": "title", - "description": [ - "\nData view title" + "string | undefined" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.DataViewListItem.type", + "id": "def-common.DataView.title", "type": "string", - "tags": [], - "label": "type", - "description": [ - "\nData view type" - ], - "signature": [ - "string | undefined" + "tags": [ + "deprecated" ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewListItem.typeMeta", - "type": "Object", - "tags": [], - "label": "typeMeta", + "label": "title", "description": [ - "\nData view type meta" + "\nTitle of data view" ], - "signature": [ + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/types.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/source/index.tsx" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/source/index.tsx" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/use_rule_from_timeline.tsx" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detections/containers/detection_engine/exceptions/get_es_query_filter.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detections/pages/detection_engine/rules/utils.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/management/pages/endpoint_hosts/store/middleware.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/detection_engine/signals/get_query_filter.ts" + }, + { + "plugin": "timelines", + "path": "x-pack/plugins/timelines/public/mock/index_pattern.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/mock/index_pattern.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "lists", + "path": "x-pack/plugins/lists/public/exceptions/components/builder/helpers.test.ts" + }, + { + "plugin": "threatIntelligence", + "path": "x-pack/plugins/threat_intelligence/public/common/mocks/mock_security_context.tsx" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detection_engine/rule_exceptions/components/flyout_components/alerts_actions/utils.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/build_es_query.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/from_combined_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/from_filters.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/from_filters.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/from_kuery.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/es_query/from_nested_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/build_filters/build_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/build_filters/exists_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/build_filters/get_filter_field.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/build_filters/phrase_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/build_filters/phrases_filter.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/helpers/compare_filters.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/helpers/compare_filters.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/filters/helpers/compare_filters.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/ast/ast.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/and.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/exists.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/is.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/nested.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/not.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/or.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/range.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/node_types/function.test.ts" + }, + { + "plugin": "@kbn/es-query", + "path": "packages/kbn-es-query/src/kuery/functions/utils/get_full_field_name_node.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/autocomplete/providers/value_suggestion_provider.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/query_string_input/fetch_index_patterns.ts" + }, + { + "plugin": "unifiedSearch", + "path": "src/plugins/unified_search/public/dataview_picker/change_dataview.tsx" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/server/rest_api_routes/update_data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/server/rest_api_routes/update_data_view.ts" + }, + { + "plugin": "triggersActionsUi", + "path": "x-pack/plugins/triggers_actions_ui/public/common/lib/data_apis.ts" + }, + { + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx" + }, + { + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/public/management_section/objects_table/components/flyout.tsx" + }, + { + "plugin": "controls", + "path": "src/plugins/controls/public/services/options_list/options_list_service.ts" + }, + { + "plugin": "controls", + "path": "src/plugins/controls/public/services/options_list/options_list_service.ts" + }, + { + "plugin": "unifiedFieldList", + "path": "src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts" + }, + { + "plugin": "unifiedFieldList", + "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" + }, + { + "plugin": "unifiedFieldList", + "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" + }, + { + "plugin": "unifiedFieldList", + "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" + }, + { + "plugin": "lens", + "path": "x-pack/plugins/lens/public/data_views_service/loader.ts" + }, + { + "plugin": "lens", + "path": "x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx" + }, + { + "plugin": "aiops", + "path": "x-pack/plugins/aiops/public/components/log_categorization/log_categorization_page.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/server/models/data_frame_analytics/index_patterns.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/server/models/job_service/new_job_caps/rollup.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/server/lib/alerts/alerting_service.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/server/models/data_recognizer/data_recognizer.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/common/log_views/resolved_log_view.ts" + }, + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/common/index_patterns_utils.ts" + }, + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/common/index_patterns_utils.ts" + }, + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/server/lib/get_fields.ts" + }, + { + "plugin": "apm", + "path": "x-pack/plugins/apm/server/routes/data_view/create_static_data_view.ts" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/report_definition_field.tsx" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/use_filter_values.ts" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx" + }, + { + "plugin": "dataVisualizer", + "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/hooks/use_data_visualizer_grid_data.ts" + }, + { + "plugin": "dataVisualizer", + "path": "x-pack/plugins/data_visualizer/public/application/index_data_visualizer/components/index_data_visualizer_view/index_data_visualizer_view.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_details.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/datavisualizer/index_based/data_loader/data_loader.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/hooks/use_index_data.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/components/configuration_step/configuration_step_form.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_creation/page.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/action_clone/clone_action_name.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/common/results_loader/categorization_examples_loader.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/index_or_search/preconfigured_job_redirect.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/job_type/page.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/bucket_span_estimator/estimate_bucket_span.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/components/datafeed_step/components/data_view/change_data_view.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/jobs/new_job/pages/new_job/wizard_steps.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/outlier_exploration/use_outlier_data.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_exploration/components/exploration_results_table/use_exploration_results.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/data_frame_analytics/pages/analytics_management/components/source_selection/source_selection.tsx" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/embeddables/anomaly_charts/anomaly_charts_embeddable.tsx" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/pages/logs/settings/validation_errors.ts" + }, + { + "plugin": "fleet", + "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx" + }, + { + "plugin": "fleet", + "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx" + }, + { + "plugin": "fleet", + "path": "x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.component.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/es_data_view_select/es_data_view_select.tsx" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/services/kibana/data_views.ts" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/services/kibana/data_views.ts" + }, + { + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/datasource/datasource_component.js" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/state_management/datasource.sagas.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/state_management/persistence.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/state_management/persistence.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/sourcerer/create_sourcerer_data_view.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detections/components/rules/eql_query_bar/validators.ts" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detections/components/rules/step_define_rule/index.tsx" + }, + { + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/detection_engine/rule_details_ui/pages/rule_details/index.tsx" + }, + { + "plugin": "timelines", + "path": "x-pack/plugins/timelines/server/search_strategy/index_fields/index.ts" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/boundary_index_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/expressions/entity_index_expression.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, + { + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/geo_containment/query_builder/index.tsx" + }, { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TypeMeta", - "text": "TypeMeta" + "plugin": "stackAlerts", + "path": "x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.tsx" + }, + { + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx" + }, + { + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx" + }, + { + "plugin": "transform", + "path": "x-pack/plugins/transform/public/app/sections/create_transform/components/step_define/common/filter_agg/components/filter_term_form.tsx" + }, + { + "plugin": "transform", + "path": "x-pack/plugins/transform/public/app/hooks/use_search_items/common.ts" + }, + { + "plugin": "transform", + "path": "x-pack/plugins/transform/public/app/services/es_index_service.ts" + }, + { + "plugin": "transform", + "path": "x-pack/plugins/transform/server/routes/api/transforms.ts" + }, + { + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/public/application/components/es_deprecation_logs/fix_deprecation_logs/external_links.tsx" + }, + { + "plugin": "ux", + "path": "x-pack/plugins/ux/public/components/app/rum_dashboard/local_uifilters/use_data_view.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/state_management/datasource.test.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/common/dependency_mocks/index_patterns.ts" + }, + { + "plugin": "maps", + "path": "x-pack/plugins/maps/public/classes/tooltips/es_tooltip_property.test.ts" + }, + { + "plugin": "ml", + "path": "x-pack/plugins/ml/public/application/services/new_job_capabilities/remove_nested_field_children.test.ts" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute.ts" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_kpi.ts" + }, + { + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_with_reference_lines.ts" }, - " | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewListItem.name", - "type": "string", - "tags": [], - "label": "name", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions", - "type": "Interface", - "tags": [], - "label": "GetFieldsOptions", - "description": [], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.pattern", - "type": "string", - "tags": [], - "label": "pattern", - "description": [], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.type", - "type": "string", - "tags": [], - "label": "type", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.lookBack", - "type": "CompoundType", - "tags": [], - "label": "lookBack", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.metaFields", - "type": "Array", - "tags": [], - "label": "metaFields", - "description": [], - "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.rollupIndex", - "type": "string", - "tags": [], - "label": "rollupIndex", - "description": [], - "signature": [ - "string | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.allowNoIndex", - "type": "CompoundType", - "tags": [], - "label": "allowNoIndex", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.indexFilter", - "type": "Object", - "tags": [], - "label": "indexFilter", - "description": [], - "signature": [ - "QueryDslQueryContainer", - " | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.includeUnmapped", - "type": "CompoundType", - "tags": [], - "label": "includeUnmapped", - "description": [], - "signature": [ - "boolean | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetFieldsOptions.fields", - "type": "Array", - "tags": [], - "label": "fields", - "description": [], - "signature": [ - "string[] | undefined" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.IDataViewsApiClient", - "type": "Interface", - "tags": [], - "label": "IDataViewsApiClient", - "description": [], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.IDataViewsApiClient.getFieldsForWildcard", - "type": "Function", - "tags": [], - "label": "getFieldsForWildcard", - "description": [], - "signature": [ - "(options: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/test_formula_metric_attribute.ts" }, - ") => Promise<", - "FieldsForWildcardResponse", - ">" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ { - "parentPluginId": "data", - "id": "def-common.IDataViewsApiClient.getFieldsForWildcard.$1", - "type": "Object", - "tags": [], - "label": "options", - "description": [], - "signature": [ - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" - } - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - }, - { - "parentPluginId": "data", - "id": "def-common.IDataViewsApiClient.hasUserDataView", - "type": "Function", - "tags": [], - "label": "hasUserDataView", - "description": [], - "signature": [ - "() => Promise" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.IndexPatternExpressionType", - "type": "Interface", - "tags": [], - "label": "IndexPatternExpressionType", - "description": [ - "\nIndex pattern expression interface" - ], - "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.IndexPatternExpressionType.type", - "type": "string", - "tags": [], - "label": "type", - "description": [ - "\nExpression type" - ], - "signature": [ - "\"index_pattern\"" - ], - "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.IndexPatternExpressionType.value", - "type": "Object", - "tags": [], - "label": "value", - "description": [ - "\nValue - DataViewSpec" - ], - "signature": [ - "{ id?: string | undefined; version?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; sourceFilters?: ", + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts" + }, { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.SourceFilter", - "text": "SourceFilter" + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts" }, - "[] | undefined; fields?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewFieldMap", - "text": "DataViewFieldMap" + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/mobile_test_attribute.ts" }, - " | undefined; typeMeta?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TypeMeta", - "text": "TypeMeta" + "plugin": "observability", + "path": "x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_cwv.ts" }, - " | undefined; type?: string | undefined; fieldFormats?: Record> | undefined; runtimeFieldMap?: Record | undefined; fieldAttrs?: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" - }, - " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }" + ">; }" ], - "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", - "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.KbnFieldTypeOptions", - "type": "Interface", - "tags": [], - "label": "KbnFieldTypeOptions", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.KbnFieldTypeOptions.sortable", - "type": "boolean", - "tags": [], - "label": "sortable", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", - "deprecated": false, - "trackAdoption": false - }, - { - "parentPluginId": "data", - "id": "def-common.KbnFieldTypeOptions.filterable", - "type": "boolean", - "tags": [], - "label": "filterable", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.KbnFieldTypeOptions.name", - "type": "string", + "id": "def-common.DataView.typeMeta", + "type": "Object", "tags": [], - "label": "name", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", + "label": "typeMeta", + "description": [ + "\nOnly used by rollup indices, used by rollup specific endpoint to load field list." + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.TypeMeta", + "text": "TypeMeta" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.KbnFieldTypeOptions.esTypes", - "type": "Array", + "id": "def-common.DataView.fields", + "type": "CompoundType", "tags": [], - "label": "esTypes", - "description": [], + "label": "fields", + "description": [ + "\nField list, in extended array format" + ], "signature": [ { - "pluginId": "@kbn/field-types", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnFieldTypesPluginApi", - "section": "def-common.ES_FIELD_TYPES", - "text": "ES_FIELD_TYPES" + "docId": "kibDataViewsPluginApi", + "section": "def-common.IIndexPatternFieldList", + "text": "IIndexPatternFieldList" }, - "[]" + " & { toSpec: () => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewFieldMap", + "text": "DataViewFieldMap" + }, + "; }" ], - "path": "packages/kbn-field-types/src/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.UiSettingsCommon", - "type": "Interface", - "tags": [], - "label": "UiSettingsCommon", - "description": [ - "\nInterface for UiSettings common interface {@link UiSettingsClient}" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ + }, { "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.get", - "type": "Function", + "id": "def-common.DataView.timeFieldName", + "type": "string", "tags": [], - "label": "get", + "label": "timeFieldName", "description": [ - "\nGet a setting value" + "\nTimestamp field name" ], "signature": [ - "(key: string) => Promise" + "string | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.get.$1", - "type": "string", - "tags": [], - "label": "key", - "description": [ - "name of value" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.getAll", - "type": "Function", + "id": "def-common.DataView.type", + "type": "string", "tags": [], - "label": "getAll", + "label": "type", "description": [ - "\nGet all settings values" + "\nType is used to identify rollup index patterns." ], "signature": [ - "() => Promise>" + "string | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [] + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.set", + "id": "def-common.DataView.flattenHit", "type": "Function", - "tags": [], - "label": "set", - "description": [ - "\nSet a setting value" + "tags": [ + "deprecated" ], + "label": "flattenHit", + "description": [], "signature": [ - "(key: string, value: T) => Promise" + "(hit: Record, deep?: boolean | undefined) => Record" ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": true, "trackAdoption": false, + "references": [ + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "maps", + "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" + }, + { + "plugin": "maps", + "path": "x-pack/plugins/maps/public/classes/sources/es_search_source/es_search_source.tsx" + } + ], + "returnComment": [], "children": [ { "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.set.$1", - "type": "string", + "id": "def-common.DataView.flattenHit.$1", + "type": "Object", "tags": [], - "label": "key", - "description": [ - "name of value" - ], + "label": "hit", + "description": [], "signature": [ - "string" + "{ [x: string]: unknown[]; }" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.set.$2", - "type": "Uncategorized", + "id": "def-common.DataView.flattenHit.$2", + "type": "CompoundType", "tags": [], - "label": "value", - "description": [ - "value to set" - ], + "label": "deep", + "description": [], "signature": [ - "T" + "boolean | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "isRequired": true + "trackAdoption": false } + ] + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.metaFields", + "type": "Array", + "tags": [], + "label": "metaFields", + "description": [ + "\nList of meta fields by name" ], - "returnComment": [] + "signature": [ + "string[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false }, { "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.remove", - "type": "Function", + "id": "def-common.DataView.version", + "type": "string", "tags": [], - "label": "remove", + "label": "version", "description": [ - "\nRemove a setting value" + "\nSavedObject version" ], "signature": [ - "(key: string) => Promise" + "string | undefined" ], - "path": "src/plugins/data_views/common/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "data", - "id": "def-common.UiSettingsCommon.remove.$1", - "type": "string", - "tags": [], - "label": "key", - "description": [ - "name of value" - ], - "signature": [ - "string" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] - } - ], - "initialIsOpen": false - } - ], - "enums": [ - { - "parentPluginId": "data", - "id": "def-common.DataViewType", - "type": "Enum", - "tags": [], - "label": "DataViewType", - "description": [ - "\nData View type. Default or rollup" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.ES_FIELD_TYPES", - "type": "Enum", - "tags": [], - "label": "ES_FIELD_TYPES", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.KBN_FIELD_TYPES", - "type": "Enum", - "tags": [], - "label": "KBN_FIELD_TYPES", - "description": [], - "path": "packages/kbn-field-types/src/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - } - ], - "misc": [ - { - "parentPluginId": "data", - "id": "def-common.AggregationRestrictions", - "type": "Type", - "tags": [], - "label": "AggregationRestrictions", - "description": [], - "signature": [ - "{ [x: string]: { agg?: string | undefined; interval?: number | undefined; fixed_interval?: string | undefined; calendar_interval?: string | undefined; delay?: string | undefined; time_zone?: string | undefined; }; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.CSV_FORMULA_CHARS", - "type": "Array", - "tags": [], - "label": "CSV_FORMULA_CHARS", - "description": [], - "signature": [ - "string[]" - ], - "path": "src/plugins/data/common/exports/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.CSV_MIME_TYPE", - "type": "string", - "tags": [], - "label": "CSV_MIME_TYPE", - "description": [], - "signature": [ - "\"text/plain;charset=utf-8\"" - ], - "path": "src/plugins/data/common/exports/export_csv.tsx", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DATA_VIEW_SAVED_OBJECT_TYPE", - "type": "string", - "tags": [], - "label": "DATA_VIEW_SAVED_OBJECT_TYPE", - "description": [ - "\nData view saved object type." - ], - "signature": [ - "\"index-pattern\"" - ], - "path": "src/plugins/data_views/common/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewFieldMap", - "type": "Type", - "tags": [], - "label": "DataViewFieldMap", - "description": [], - "signature": [ - "{ [x: string]: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" - }, - "; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewsContract", - "type": "Type", - "tags": [], - "label": "DataViewsContract", - "description": [ - "\nData views service interface" - ], - "signature": [ - "{ get: (id: string, displayErrors?: boolean, refreshFields?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" - }, - ", skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - ">; find: (search: string, size?: number) => Promise<", - { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "trackAdoption": false }, - "[]>; getCanSave: () => Promise; getIds: (refresh?: boolean) => Promise; getTitles: (refresh?: boolean) => Promise; getIdsWithTitle: (refresh?: boolean) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewListItem", - "text": "DataViewListItem" + "parentPluginId": "data", + "id": "def-common.DataView.sourceFilters", + "type": "Array", + "tags": [], + "label": "sourceFilters", + "description": [ + "\nArray of filters - hides fields in discover" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.SourceFilter", + "text": "SourceFilter" + }, + "[] | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false }, - "[]>; clearCache: () => void; clearInstanceCache: (id?: string | undefined) => void; getCache: () => Promise<", { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" + "parentPluginId": "data", + "id": "def-common.DataView.namespaces", + "type": "Array", + "tags": [], + "label": "namespaces", + "description": [ + "\nArray of namespace ids" + ], + "signature": [ + "string[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false }, - "<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSavedObjectAttrs", - "text": "DataViewSavedObjectAttrs" + "parentPluginId": "data", + "id": "def-common.DataView.allowNoIndex", + "type": "boolean", + "tags": [], + "label": "allowNoIndex", + "description": [ + "\nPrevents errors when index pattern exists before indices" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false }, - ">[] | null | undefined>; getDefault: (displayErrors?: boolean) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the data view. Human readable name used to differentiate data view." + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false }, - " | null>; getDefaultId: () => Promise; setDefault: (id: string | null, force?: boolean) => Promise; hasUserDataView: () => Promise; getFieldsForWildcard: (options: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" + "parentPluginId": "data", + "id": "def-common.DataView.matchedIndices", + "type": "Array", + "tags": [], + "label": "matchedIndices", + "description": [], + "signature": [ + "string[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false }, - ") => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" + "parentPluginId": "data", + "id": "def-common.DataView.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [ + "\nconstructor" + ], + "signature": [ + "any" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.Unnamed.$1", + "type": "Object", + "tags": [], + "label": "config", + "description": [ + "- config data and dependencies" + ], + "signature": [ + "DataViewDeps" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - "[]>; getFieldsForIndexPattern: (indexPattern: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.getName", + "type": "Function", + "tags": [], + "label": "getName", + "description": [ + "\nGet name of Data View" + ], + "signature": [ + "() => string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - " | ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" + "parentPluginId": "data", + "id": "def-common.DataView.getIndexPattern", + "type": "Function", + "tags": [], + "label": "getIndexPattern", + "description": [ + "\nGet index pattern" + ], + "signature": [ + "() => string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [ + "index pattern string" + ] }, - ", options?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.GetFieldsOptions", - "text": "GetFieldsOptions" + "parentPluginId": "data", + "id": "def-common.DataView.setIndexPattern", + "type": "Function", + "tags": [], + "label": "setIndexPattern", + "description": [ + "\nSet index pattern" + ], + "signature": [ + "(indexPattern: string) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.setIndexPattern.$1", + "type": "string", + "tags": [], + "label": "indexPattern", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - " | undefined) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" + "parentPluginId": "data", + "id": "def-common.DataView.getOriginalSavedObjectBody", + "type": "Function", + "tags": [], + "label": "getOriginalSavedObjectBody", + "description": [ + "\nGet last saved saved object fields" + ], + "signature": [ + "() => { fieldAttrs?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; fields?: string | undefined; sourceFilters?: string | undefined; fieldFormatMap?: string | undefined; typeMeta?: string | undefined; type?: string | undefined; }" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - "[]>; refreshFields: (dataView: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.resetOriginalSavedObjectBody", + "type": "Function", + "tags": [], + "label": "resetOriginalSavedObjectBody", + "description": [ + "\nReset last saved saved object fields. Used after saving." + ], + "signature": [ + "() => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - ", displayErrors?: boolean) => Promise; fieldArrayToMap: (fields: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldSpec", - "text": "FieldSpec" + "parentPluginId": "data", + "id": "def-common.DataView.getFieldAttrs", + "type": "Function", + "tags": [], + "label": "getFieldAttrs", + "description": [ + "\nReturns field attributes map" + ], + "signature": [ + "() => { [x: string]: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" + }, + "; }" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.getComputedFields", + "type": "Function", + "tags": [], + "label": "getComputedFields", + "description": [ + "\nReturns scripted fields" + ], + "signature": [ + "() => { storedFields: string[]; scriptFields: Record; docvalueFields: { field: string; format: string; }[]; runtimeFields: ", + "MappingRuntimeFields", + "; }" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - "[], fieldAttrs?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" + "parentPluginId": "data", + "id": "def-common.DataView.isPersisted", + "type": "Function", + "tags": [], + "label": "isPersisted", + "description": [], + "signature": [ + "() => boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - " | undefined) => ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewFieldMap", - "text": "DataViewFieldMap" + "parentPluginId": "data", + "id": "def-common.DataView.toSpec", + "type": "Function", + "tags": [], + "label": "toSpec", + "description": [ + "\nCreates static representation of the data view." + ], + "signature": [ + "(includeFields?: boolean) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.toSpec.$1", + "type": "boolean", + "tags": [], + "label": "includeFields", + "description": [ + "Whether or not to include the `fields` list as part of this spec. If not included, the list\nwill be fetched from Elasticsearch when instantiating a new Data View with this spec." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - "; savedObjectToSpec: (savedObject: ", { - "pluginId": "@kbn/core-saved-objects-common", - "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" + "parentPluginId": "data", + "id": "def-common.DataView.getSourceFiltering", + "type": "Function", + "tags": [], + "label": "getSourceFiltering", + "description": [ + "\nGet the source filtering configuration for that index." + ], + "signature": [ + "() => { excludes: string[]; }" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - "<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewAttributes", - "text": "DataViewAttributes" + "parentPluginId": "data", + "id": "def-common.DataView.removeScriptedField", + "type": "Function", + "tags": [ + "deprecated" + ], + "label": "removeScriptedField", + "description": [ + "\nRemoves scripted field from field list." + ], + "signature": [ + "(fieldName: string) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/field_editor/field_editor.tsx" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + } + ], + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.removeScriptedField.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of scripted field to remove" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - ">) => ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" + "parentPluginId": "data", + "id": "def-common.DataView.getNonScriptedFields", + "type": "Function", + "tags": [ + "deprecated" + ], + "label": "getNonScriptedFields", + "description": [ + "\n" + ], + "signature": [ + "() => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + "[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/server/lib/search_strategies/strategies/abstract_search_strategy.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/services/persistence/deserialize.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/state_management/datasource.test.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" + }, + { + "plugin": "graph", + "path": "x-pack/plugins/graph/public/services/persistence/deserialize.test.ts" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/source_filters_table/components/table/table.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/edit_index_pattern.tsx" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "visTypeTimeseries", + "path": "src/plugins/vis_types/timeseries/public/application/lib/fetch_fields.ts" + } + ], + "children": [], + "returnComment": [] }, - "; createAndSave: (spec: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewSpec", - "text": "DataViewSpec" + "parentPluginId": "data", + "id": "def-common.DataView.getScriptedFields", + "type": "Function", + "tags": [ + "deprecated" + ], + "label": "getScriptedFields", + "description": [ + "\n" + ], + "signature": [ + "() => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + "[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/server/register_index_pattern_usage_collection.ts" + }, + { + "plugin": "dataViewManagement", + "path": "src/plugins/data_view_management/public/components/edit_index_pattern/scripted_fields_table/scripted_fields_table.tsx" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + }, + { + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_view.test.ts" + } + ], + "children": [], + "returnComment": [] }, - ", override?: boolean, skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.isTSDBMode", + "type": "Function", + "tags": [], + "label": "isTSDBMode", + "description": [ + "\nreturns true if dataview contains TSDB fields" + ], + "signature": [ + "() => boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - ">; createSavedObject: (dataView: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.isTimeBased", + "type": "Function", + "tags": [], + "label": "isTimeBased", + "description": [ + "\nDoes the data view have a timestamp field?" + ], + "signature": [ + "() => this is ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.TimeBasedDataView", + "text": "TimeBasedDataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - ", override?: boolean, displayErrors?: boolean) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.isTimeNanosBased", + "type": "Function", + "tags": [], + "label": "isTimeNanosBased", + "description": [ + "\nDoes the data view have a timestamp field and is it a date nanos field?" + ], + "signature": [ + "() => this is ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.TimeBasedDataView", + "text": "TimeBasedDataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - ">; updateSavedObject: (indexPattern: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" + "parentPluginId": "data", + "id": "def-common.DataView.getTimeField", + "type": "Function", + "tags": [], + "label": "getTimeField", + "description": [ + "\nGet timestamp field as DataViewField or return undefined" + ], + "signature": [ + "() => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - ", saveAttempts?: number, ignoreErrors?: boolean, displayErrors?: boolean) => Promise ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.getFieldByName.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "field name" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - ">; getDefaultDataView: (refreshFields?: boolean | undefined) => Promise<", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataView", - "text": "DataView" - }, - " | null>; }" - ], - "path": "src/plugins/data_views/common/data_views/data_views.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DataViewSpec", - "type": "Type", - "tags": [], - "label": "DataViewSpec", - "description": [ - "\nStatic data view format\nSerialized data object, representing data view attributes and state" - ], - "signature": [ - "{ id?: string | undefined; version?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; sourceFilters?: ", + "parentPluginId": "data", + "id": "def-common.DataView.getAggregationRestrictions", + "type": "Function", + "tags": [], + "label": "getAggregationRestrictions", + "description": [ + "\nGet aggregation restrictions. Rollup fields can only perform a subset of aggregations." + ], + "signature": [ + "() => Record | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] + }, { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.SourceFilter", - "text": "SourceFilter" + "parentPluginId": "data", + "id": "def-common.DataView.getAsSavedObjectBody", + "type": "Function", + "tags": [], + "label": "getAsSavedObjectBody", + "description": [ + "\nReturns index pattern as saved object body for saving" + ], + "signature": [ + "() => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - "[] | undefined; fields?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.DataViewFieldMap", - "text": "DataViewFieldMap" + "parentPluginId": "data", + "id": "def-common.DataView.getFormatterForField", + "type": "Function", + "tags": [], + "label": "getFormatterForField", + "description": [ + "\nProvide a field, get its formatter" + ], + "signature": [ + "(field: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + ") => ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormat", + "text": "FieldFormat" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.getFormatterForField.$1", + "type": "CompoundType", + "tags": [], + "label": "field", + "description": [ + "field to get formatter for" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - " | undefined; typeMeta?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.TypeMeta", - "text": "TypeMeta" + "parentPluginId": "data", + "id": "def-common.DataView.addRuntimeField", + "type": "Function", + "tags": [], + "label": "addRuntimeField", + "description": [ + "\nAdd a runtime field - Appended to existing mapped field or a new field is\ncreated as appropriate." + ], + "signature": [ + "(name: string, runtimeField: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeField", + "text": "RuntimeField" + }, + ") => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + }, + "[]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.addRuntimeField.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "Field name" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.addRuntimeField.$2", + "type": "Object", + "tags": [], + "label": "runtimeField", + "description": [ + "Runtime field definition" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeField", + "text": "RuntimeField" + } + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - " | undefined; type?: string | undefined; fieldFormats?: Record boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.hasRuntimeField.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "field name" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - "<{}, ", { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" + "parentPluginId": "data", + "id": "def-common.DataView.getRuntimeField", + "type": "Function", + "tags": [], + "label": "getRuntimeField", + "description": [ + "\nReturns runtime field if exists" + ], + "signature": [ + "(name: string) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeField", + "text": "RuntimeField" + }, + " | null" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.getRuntimeField.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "Runtime field name" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - ">> | undefined; runtimeFieldMap?: Record Record" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [ + "map of runtime field definitions by field name" + ] }, - "> | undefined; fieldAttrs?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrs", - "text": "FieldAttrs" + "parentPluginId": "data", + "id": "def-common.DataView.getFieldsByRuntimeFieldName", + "type": "Function", + "tags": [], + "label": "getFieldsByRuntimeFieldName", + "description": [ + "\nReturns data view fields backed by runtime fields." + ], + "signature": [ + "(name: string) => Record | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.getFieldsByRuntimeFieldName.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "runtime field name" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "map of DataViewFields (that are runtime fields) by field name" + ] }, - " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.DEFAULT_QUERY_LANGUAGE", - "type": "string", - "tags": [], - "label": "DEFAULT_QUERY_LANGUAGE", - "description": [], - "signature": [ - "\"kuery\"" - ], - "path": "src/plugins/data/common/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.FieldAttrs", - "type": "Type", - "tags": [], - "label": "FieldAttrs", - "description": [ - "\nSet of field attributes" - ], - "signature": [ - "{ [key: string]: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.FieldAttrSet", - "text": "FieldAttrSet" + "parentPluginId": "data", + "id": "def-common.DataView.replaceAllRuntimeFields", + "type": "Function", + "tags": [], + "label": "replaceAllRuntimeFields", + "description": [ + "\nReplaces all existing runtime fields with new fields." + ], + "signature": [ + "(newFields: Record) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.replaceAllRuntimeFields.$1", + "type": "Object", + "tags": [], + "label": "newFields", + "description": [ + "Map of runtime field definitions by field name" + ], + "signature": [ + "Record" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - "; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.FieldAttrSet", - "type": "Type", - "tags": [], - "label": "FieldAttrSet", - "description": [ - "\nField attributes that are stored on the data view" - ], - "signature": [ - "{ customLabel?: string | undefined; count?: number | undefined; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.FieldSpec", - "type": "Type", - "tags": [], - "label": "FieldSpec", - "description": [ - "\nSerialized version of DataViewField" - ], - "signature": [ { - "pluginId": "@kbn/es-query", - "scope": "common", - "docId": "kibKbnEsQueryPluginApi", - "section": "def-common.DataViewFieldBase", - "text": "DataViewFieldBase" + "parentPluginId": "data", + "id": "def-common.DataView.removeRuntimeField", + "type": "Function", + "tags": [], + "label": "removeRuntimeField", + "description": [ + "\nRemove a runtime field - removed from mapped field or removed unmapped\nfield as appropriate. Doesn't clear associated field attributes." + ], + "signature": [ + "(name: string) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.removeRuntimeField.$1", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "- Field name to remove" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - " & { count?: number | undefined; conflictDescriptions?: Record | undefined; format?: ", { - "pluginId": "fieldFormats", - "scope": "common", - "docId": "kibFieldFormatsPluginApi", - "section": "def-common.SerializedFieldFormat", - "text": "SerializedFieldFormat" + "parentPluginId": "data", + "id": "def-common.DataView.getRuntimeMappings", + "type": "Function", + "tags": [], + "label": "getRuntimeMappings", + "description": [ + "\nReturn the \"runtime_mappings\" section of the ES search query." + ], + "signature": [ + "() => ", + "MappingRuntimeFields" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, - "<{}, ", { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" + "parentPluginId": "data", + "id": "def-common.DataView.getFormatterForFieldNoDefault", + "type": "Function", + "tags": [], + "label": "getFormatterForFieldNoDefault", + "description": [ + "\nGet formatter for a given field name. Return undefined if none exists." + ], + "signature": [ + "(fieldname: string) => ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.FieldFormat", + "text": "FieldFormat" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.getFormatterForFieldNoDefault.$1", + "type": "string", + "tags": [], + "label": "fieldname", + "description": [ + "name of field to get formatter for" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - "> | undefined; esTypes?: string[] | undefined; searchable: boolean; aggregatable: boolean; readFromDocValues?: boolean | undefined; indexed?: boolean | undefined; customLabel?: string | undefined; runtimeField?: ", { - "pluginId": "dataViews", - "scope": "common", - "docId": "kibDataViewsPluginApi", - "section": "def-common.RuntimeFieldSpec", - "text": "RuntimeFieldSpec" + "parentPluginId": "data", + "id": "def-common.DataView.setFieldAttrs", + "type": "Function", + "tags": [], + "label": "setFieldAttrs", + "description": [ + "\nSet field attribute" + ], + "signature": [ + "(fieldName: string, attrName: K, value: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" + }, + "[K]) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldAttrs.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set attribute on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldAttrs.$2", + "type": "Uncategorized", + "tags": [], + "label": "attrName", + "description": [ + "name of attribute to set" + ], + "signature": [ + "K" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldAttrs.$3", + "type": "Uncategorized", + "tags": [], + "label": "value", + "description": [ + "value of attribute" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" + }, + "[K]" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldCustomLabel", + "type": "Function", + "tags": [], + "label": "setFieldCustomLabel", + "description": [ + "\nSet field custom label" + ], + "signature": [ + "(fieldName: string, customLabel: string | null | undefined) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldCustomLabel.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set custom label on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldCustomLabel.$2", + "type": "CompoundType", + "tags": [], + "label": "customLabel", + "description": [ + "custom label value. If undefined, custom label is removed" + ], + "signature": [ + "string | null | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [] }, - " | undefined; fixedInterval?: string[] | undefined; timeZone?: string[] | undefined; timeSeriesDimension?: boolean | undefined; timeSeriesMetric?: \"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined; shortDotsEnable?: boolean | undefined; isMapped?: boolean | undefined; parentName?: string | undefined; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.FieldSpecConflictDescriptions", - "type": "Type", - "tags": [], - "label": "FieldSpecConflictDescriptions", - "description": [], - "signature": [ - "{ [x: string]: string[]; }" - ], - "path": "src/plugins/data_views/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.GetConfigFn", - "type": "Type", - "tags": [], - "label": "GetConfigFn", - "description": [ - "\nIf a service is being shared on both the client and the server, and\nthe client code requires synchronous access to uiSettings, both client\nand server should wrap the core uiSettings services in a function\nmatching this signature.\n\nThis matches the signature of the public `core.uiSettings.get`, and\nshould only be used in scenarios where async access to uiSettings is\nnot possible." - ], - "signature": [ - "(key: string, defaultOverride?: T | undefined) => T" - ], - "path": "src/plugins/data/common/types.ts", - "deprecated": false, - "trackAdoption": false, - "returnComment": [], - "children": [ { "parentPluginId": "data", - "id": "def-common.GetConfigFn.$1", - "type": "string", + "id": "def-common.DataView.setFieldCount", + "type": "Function", "tags": [], - "label": "key", - "description": [], - "path": "src/plugins/data/common/types.ts", + "label": "setFieldCount", + "description": [ + "\nSet field count" + ], + "signature": [ + "(fieldName: string, count: number | null | undefined) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldCount.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set count on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldCount.$2", + "type": "CompoundType", + "tags": [], + "label": "count", + "description": [ + "count value. If undefined, count is removed" + ], + "signature": [ + "number | null | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [] }, { "parentPluginId": "data", - "id": "def-common.GetConfigFn.$2", - "type": "Uncategorized", + "id": "def-common.DataView.setFieldFormat", + "type": "Function", "tags": [], - "label": "defaultOverride", - "description": [], + "label": "setFieldFormat", + "description": [ + "\nSet field formatter" + ], "signature": [ - "T | undefined" + "(fieldName: string, format: ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.SerializedFieldFormat", + "text": "SerializedFieldFormat" + }, + "<{}, ", + { + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" + }, + ">) => void" ], - "path": "src/plugins/data/common/types.ts", + "path": "src/plugins/data_views/common/data_views/data_view.ts", "deprecated": false, - "trackAdoption": false - } - ], - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.IndexPatternLoadExpressionFunctionDefinition", - "type": "Type", - "tags": [], - "label": "IndexPatternLoadExpressionFunctionDefinition", - "description": [], - "signature": [ - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.ExpressionFunctionDefinition", - "text": "ExpressionFunctionDefinition" - }, - "<\"indexPatternLoad\", null, Arguments, Output, ", - { - "pluginId": "expressions", - "scope": "common", - "docId": "kibExpressionsPluginApi", - "section": "def-common.ExecutionContext", - "text": "ExecutionContext" - }, - "<", - { - "pluginId": "inspector", - "scope": "common", - "docId": "kibInspectorPluginApi", - "section": "def-common.Adapters", - "text": "Adapters" + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldFormat.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "name of field to set format on" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataView.setFieldFormat.$2", + "type": "Object", + "tags": [], + "label": "format", + "description": [ + "field format in serialized form" + ], + "signature": [ + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.SerializedFieldFormat", + "text": "SerializedFieldFormat" + }, + "<{}, ", + { + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, - ", ", { - "pluginId": "@kbn/utility-types", - "scope": "common", - "docId": "kibKbnUtilityTypesPluginApi", - "section": "def-common.SerializableRecord", - "text": "SerializableRecord" - }, - ">>" - ], - "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.KIBANA_USER_QUERY_LANGUAGE_KEY", - "type": "string", - "tags": [], - "label": "KIBANA_USER_QUERY_LANGUAGE_KEY", - "description": [], - "signature": [ - "\"kibana.userQueryLanguage\"" - ], - "path": "src/plugins/data/common/constants.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.META_FIELDS", - "type": "string", - "tags": [], - "label": "META_FIELDS", - "description": [ - "\nUiSettings key for metaFields list." - ], - "signature": [ - "\"metaFields\"" + "parentPluginId": "data", + "id": "def-common.DataView.deleteFieldFormat", + "type": "Function", + "tags": [], + "label": "deleteFieldFormat", + "description": [ + "\nRemove field format from the field format map." + ], + "signature": [ + "(fieldName: string) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataView.deleteFieldFormat.$1", + "type": "string", + "tags": [], + "label": "fieldName", + "description": [ + "field name associated with the format for removal" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_view.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + } ], - "path": "src/plugins/data_views/common/constants.ts", - "deprecated": false, - "trackAdoption": false, "initialIsOpen": false }, { "parentPluginId": "data", - "id": "def-common.Query", - "type": "Type", + "id": "def-common.DataViewField", + "type": "Class", "tags": [], - "label": "Query", - "description": [], - "signature": [ - "{ query: string | { [key: string]: any; }; language: string; }" - ], - "path": "packages/kbn-es-query/src/filters/build_filters/types.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "data", - "id": "def-common.SavedObject", - "type": "Type", - "tags": [ - "deprecated" + "label": "DataViewField", + "description": [ + "\nData view field class" ], - "label": "SavedObject", - "description": [], "signature": [ { - "pluginId": "@kbn/core-saved-objects-common", + "pluginId": "dataViews", "scope": "common", - "docId": "kibKbnCoreSavedObjectsCommonPluginApi", - "section": "def-common.SavedObject", - "text": "SavedObject" + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" }, - "" + " implements ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.DataViewFieldBase", + "text": "DataViewFieldBase" + } ], - "path": "packages/core/saved-objects/core-saved-objects-common/src/saved_objects.ts", - "deprecated": true, + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, "trackAdoption": false, - "references": [ - { - "plugin": "@kbn/core-saved-objects-common", - "path": "packages/core/saved-objects/core-saved-objects-common/index.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-browser", - "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/base.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/base.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/resolve.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/resolve.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/update.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/update.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server", - "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" - }, + "children": [ { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.spec", + "type": "CompoundType", + "tags": [], + "label": "spec", + "description": [], + "signature": [ + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.DataViewFieldBase", + "text": "DataViewFieldBase" + }, + " & { count?: number | undefined; conflictDescriptions?: Record | undefined; format?: ", + { + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.SerializedFieldFormat", + "text": "SerializedFieldFormat" + }, + "<{}, ", + { + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" + }, + "> | undefined; esTypes?: string[] | undefined; searchable: boolean; aggregatable: boolean; readFromDocValues?: boolean | undefined; indexed?: boolean | undefined; customLabel?: string | undefined; runtimeField?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeFieldSpec", + "text": "RuntimeFieldSpec" + }, + " | undefined; fixedInterval?: string[] | undefined; timeZone?: string[] | undefined; timeSeriesDimension?: boolean | undefined; timeSeriesMetric?: \"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined; shortDotsEnable?: boolean | undefined; isMapped?: boolean | undefined; parentName?: string | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.Unnamed", + "type": "Function", + "tags": [ + "constructor" + ], + "label": "Constructor", + "description": [ + "\nDataView constructor" + ], + "signature": [ + "any" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewField.Unnamed.$1", + "type": "CompoundType", + "tags": [], + "label": "spec", + "description": [ + "Configuration for the field" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + } + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.count", + "type": "number", + "tags": [], + "label": "count", + "description": [ + "\nCount is used for field popularity in discover." + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.count", + "type": "number", + "tags": [], + "label": "count", + "description": [ + "\nSet count, which is used for field popularity in discover." + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.runtimeField", + "type": "CompoundType", + "tags": [], + "label": "runtimeField", + "description": [ + "\nReturns runtime field definition or undefined if field is not runtime field." + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeFieldSpec", + "text": "RuntimeFieldSpec" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.runtimeField", + "type": "CompoundType", + "tags": [], + "label": "runtimeField", + "description": [ + "\nSets runtime field definition or unsets if undefined is provided." + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeFieldSpec", + "text": "RuntimeFieldSpec" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.script", + "type": "string", + "tags": [], + "label": "script", + "description": [ + "\nScript field code" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.script", + "type": "string", + "tags": [], + "label": "script", + "description": [ + "\nSets scripted field painless code" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "core", - "path": "src/core/public/index.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.lang", + "type": "string", + "tags": [], + "label": "lang", + "description": [ + "\nScript field language" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "home", - "path": "src/plugins/home/server/services/sample_data/sample_data_registry.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.lang", + "type": "string", + "tags": [], + "label": "lang", + "description": [ + "\nSets scripted field langauge." + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "home", - "path": "src/plugins/home/server/services/sample_data/sample_data_registry.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.customLabel", + "type": "string", + "tags": [], + "label": "customLabel", + "description": [ + "\nReturns custom label if set, otherwise undefined." + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "home", - "path": "src/plugins/home/server/services/sample_data/sample_data_registry.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.customLabel", + "type": "string", + "tags": [], + "label": "customLabel", + "description": [ + "\nSets custom label for field, or unsets if passed undefined." + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.conflictDescriptions", + "type": "Object", + "tags": [], + "label": "conflictDescriptions", + "description": [ + "\nDescription of field type conflicts across different indices in the same index pattern." + ], + "signature": [ + "Record | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.conflictDescriptions", + "type": "Object", + "tags": [], + "label": "conflictDescriptions", + "description": [ + "\nSets conflict descriptions for field." + ], + "signature": [ + "Record | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nGet field name" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.displayName", + "type": "string", + "tags": [], + "label": "displayName", + "description": [ + "\nGets display name, calcualted based on name, custom label and shortDotsEnable." + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nGets field type" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.esTypes", + "type": "Array", + "tags": [], + "label": "esTypes", + "description": [ + "\nGets ES types as string array" + ], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/index.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.scripted", + "type": "boolean", + "tags": [], + "label": "scripted", + "description": [ + "\nReturns true if scripted field" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.searchable", + "type": "boolean", + "tags": [], + "label": "searchable", + "description": [ + "\nReturns true if field is searchable" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.aggregatable", + "type": "boolean", + "tags": [], + "label": "aggregatable", + "description": [ + "\nReturns true if field is aggregatable" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.timeSeriesDimension", + "type": "boolean", + "tags": [], + "label": "timeSeriesDimension", + "description": [ + "\nreturns true if field is a TSDB dimension field" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.timeSeriesMetric", + "type": "CompoundType", + "tags": [], + "label": "timeSeriesMetric", + "description": [ + "\nreturns type of TSDB metric or undefined" + ], + "signature": [ + "\"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.fixedInterval", + "type": "Array", + "tags": [], + "label": "fixedInterval", + "description": [ + "\nreturns list of alloeed fixed intervals" + ], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.isRolledUpField", + "type": "CompoundType", + "tags": [], + "label": "isRolledUpField", + "description": [ + "\nreturns true if the field is of rolled up type" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.timeZone", + "type": "Array", + "tags": [], + "label": "timeZone", + "description": [ + "\nreturn list of allowed time zones" + ], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.readFromDocValues", + "type": "boolean", + "tags": [], + "label": "readFromDocValues", + "description": [ + "\nReturns true if field is available via doc values" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.subType", + "type": "CompoundType", + "tags": [], + "label": "subType", + "description": [ + "\nReturns field subtype, multi, nested, or undefined if neither" + ], + "signature": [ + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/utils.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.isMapped", + "type": "CompoundType", + "tags": [], + "label": "isMapped", + "description": [ + "\nIs the field part of the index mapping?" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/utils.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.isRuntimeField", + "type": "boolean", + "tags": [], + "label": "isRuntimeField", + "description": [ + "\nReturns true if runtime field defined on data view" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/server/utils.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.sortable", + "type": "boolean", + "tags": [], + "label": "sortable", + "description": [ + "\nReturns true if field is sortable" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "discover", - "path": "src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.filterable", + "type": "boolean", + "tags": [], + "label": "filterable", + "description": [ + "\nReturns true if field is filterable" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "discover", - "path": "src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.visualizable", + "type": "boolean", + "tags": [], + "label": "visualizable", + "description": [ + "\nReturns true if field is visualizable" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.isSubtypeNested", + "type": "Function", + "tags": [], + "label": "isSubtypeNested", + "description": [ + "\nReturns true if field is subtype nested" + ], + "signature": [ + "() => boolean" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.isSubtypeMulti", + "type": "Function", + "tags": [], + "label": "isSubtypeMulti", + "description": [ + "\nReturns true if field is subtype multi" + ], + "signature": [ + "() => boolean" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.getSubtypeNested", + "type": "Function", + "tags": [], + "label": "getSubtypeNested", + "description": [ + "\nReturns subtype nested data if exists" + ], + "signature": [ + "() => ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubTypeNested", + "text": "IFieldSubTypeNested" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.getSubtypeMulti", + "type": "Function", + "tags": [], + "label": "getSubtypeMulti", + "description": [ + "\nReturns subtype multi data if exists" + ], + "signature": [ + "() => ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubTypeMulti", + "text": "IFieldSubTypeMulti" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.test.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.deleteCount", + "type": "Function", + "tags": [], + "label": "deleteCount", + "description": [ + "\nDeletes count value. Popularity as used by discover" + ], + "signature": [ + "() => void" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_views/data_views.test.ts" + "parentPluginId": "data", + "id": "def-common.DataViewField.toJSON", + "type": "Function", + "tags": [], + "label": "toJSON", + "description": [ + "\nJSON version of field" + ], + "signature": [ + "() => { count: number; script: string | undefined; lang: string | undefined; conflictDescriptions: Record | undefined; name: string; type: string; esTypes: string[] | undefined; scripted: boolean; searchable: boolean; aggregatable: boolean; readFromDocValues: boolean; subType: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; customLabel: string | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/ui_api/get_table_column_definition.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewField.toSpec", + "type": "Function", + "tags": [], + "label": "toSpec", + "description": [ + "\nGet field in serialized form - fieldspec." + ], + "signature": [ + "(config?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.ToSpecConfig", + "text": "ToSpecConfig" + }, + ") => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + } + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewField.toSpec.$1", + "type": "Object", + "tags": [], + "label": "config", + "description": [ + "provide a method to get a field formatter" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.ToSpecConfig", + "text": "ToSpecConfig" + } + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "field in serialized form - field spec" + ] }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/ui_api/get_table_column_definition.tsx" - }, + "parentPluginId": "data", + "id": "def-common.DataViewField.isRuntimeCompositeSubField", + "type": "Function", + "tags": [], + "label": "isRuntimeCompositeSubField", + "description": [ + "\nReturns true if composite runtime field" + ], + "signature": [ + "() => boolean" + ], + "path": "src/plugins/data_views/common/fields/data_view_field.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewSavedObjectConflictError", + "type": "Class", + "tags": [], + "label": "DataViewSavedObjectConflictError", + "description": [ + "\nError thrown when saved object has been changed when attempting to save." + ], + "signature": [ { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/ui_api/get_table_column_definition.tsx" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSavedObjectConflictError", + "text": "DataViewSavedObjectConflictError" }, + " extends Error" + ], + "path": "src/plugins/data_views/common/errors/data_view_saved_object_conflict.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "savedObjectsFinder", - "path": "src/plugins/saved_objects_finder/public/finder/saved_object_finder.tsx" - }, + "parentPluginId": "data", + "id": "def-common.DataViewSavedObjectConflictError.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [ + "\nconstructor" + ], + "signature": [ + "any" + ], + "path": "src/plugins/data_views/common/errors/data_view_saved_object_conflict.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewSavedObjectConflictError.Unnamed.$1", + "type": "string", + "tags": [], + "label": "savedObjectId", + "description": [ + "saved object id with conflict" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/errors/data_view_saved_object_conflict.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService", + "type": "Class", + "tags": [], + "label": "DataViewsService", + "description": [ + "\nData views service, providing CRUD operations for data views." + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "savedObjectsFinder", - "path": "src/plugins/saved_objects_finder/public/finder/saved_object_finder.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getCanSave", + "type": "Function", + "tags": [], + "label": "getCanSave", + "description": [ + "\nCan the user save data views?" + ], + "signature": [ + "() => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [] }, { - "plugin": "savedObjectsFinder", - "path": "src/plugins/saved_objects_finder/public/finder/saved_object_finder.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [ + "\nDataViewsService constructor" + ], + "signature": [ + "any" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.Unnamed.$1", + "type": "Object", + "tags": [], + "label": "deps", + "description": [ + "Service dependencies" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewsServiceDeps", + "text": "DataViewsServiceDeps" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/common/types/models/epm.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getIds", + "type": "Function", + "tags": [], + "label": "getIds", + "description": [ + "\nGets list of index pattern ids." + ], + "signature": [ + "(refresh?: boolean) => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getIds.$1", + "type": "boolean", + "tags": [], + "label": "refresh", + "description": [ + "Force refresh of index pattern list" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/common/types/models/epm.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getTitles", + "type": "Function", + "tags": [], + "label": "getTitles", + "description": [ + "\nGets list of index pattern titles." + ], + "signature": [ + "(refresh?: boolean) => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getTitles.$1", + "type": "boolean", + "tags": [], + "label": "refresh", + "description": [ + "Force refresh of index pattern list" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/common/types/models/epm.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.find", + "type": "Function", + "tags": [], + "label": "find", + "description": [ + "\nFind and load index patterns by title." + ], + "signature": [ + "(search: string, size?: number) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + "[]>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.find.$1", + "type": "string", + "tags": [], + "label": "search", + "description": [ + "Search string" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.find.$2", + "type": "number", + "tags": [], + "label": "size", + "description": [ + "Number of data views to return" + ], + "signature": [ + "number" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "DataView[]" + ] }, { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/shareable_runtime/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getIdsWithTitle", + "type": "Function", + "tags": [], + "label": "getIdsWithTitle", + "description": [ + "\nGets list of index pattern ids with titles." + ], + "signature": [ + "(refresh?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewListItem", + "text": "DataViewListItem" + }, + "[]>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getIdsWithTitle.$1", + "type": "boolean", + "tags": [], + "label": "refresh", + "description": [ + "Force refresh of index pattern list" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/shareable_runtime/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.clearCache", + "type": "Function", + "tags": [], + "label": "clearCache", + "description": [ + "\nClear index pattern saved objects cache." + ], + "signature": [ + "() => void" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/services/kibana/workpad.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.clearInstanceCache", + "type": "Function", + "tags": [], + "label": "clearInstanceCache", + "description": [ + "\nClear index pattern instance cache" + ], + "signature": [ + "(id?: string | undefined) => void" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.clearInstanceCache.$1", + "type": "string", + "tags": [], + "label": "id", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [] }, { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/services/kibana/workpad.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getCache", + "type": "Function", + "tags": [], + "label": "getCache", + "description": [ + "\nGet cache, contains data view saved objects." + ], + "signature": [ + "() => Promise<", + { + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" + }, + "<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSavedObjectAttrs", + "text": "DataViewSavedObjectAttrs" + }, + ">[] | null | undefined>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/home/hooks/use_upload_workpad.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getDefault", + "type": "Function", + "tags": [], + "label": "getDefault", + "description": [ + "\nGet default index pattern" + ], + "signature": [ + "(displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | null>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getDefault.$1", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "canvas", - "path": "x-pack/plugins/canvas/public/components/home/hooks/use_upload_workpad.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getDefaultId", + "type": "Function", + "tags": [], + "label": "getDefaultId", + "description": [ + "\nGet default index pattern id" + ], + "signature": [ + "() => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/packs/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.setDefault", + "type": "Function", + "tags": [], + "label": "setDefault", + "description": [ + "\nOptionally set default index pattern, unless force = true" + ], + "signature": [ + "(id: string | null, force?: boolean) => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.setDefault.$1", + "type": "CompoundType", + "tags": [], + "label": "id", + "description": [ + "data view id" + ], + "signature": [ + "string | null" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.setDefault.$2", + "type": "boolean", + "tags": [], + "label": "force", + "description": [ + "set default data view even if there's an existing default" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/packs/types.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.hasUserDataView", + "type": "Function", + "tags": [], + "label": "hasUserDataView", + "description": [ + "\nChecks if current user has a user created index pattern ignoring fleet's server default index patterns." + ], + "signature": [ + "() => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getFieldsForWildcard", + "type": "Function", + "tags": [], + "label": "getFieldsForWildcard", + "description": [ + "\nGet field list by providing { pattern }." + ], + "signature": [ + "(options: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + ") => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getFieldsForWildcard.$1", + "type": "Object", + "tags": [], + "label": "options", + "description": [ + "options for getting field list" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "FieldSpec[]" + ] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.getFieldsForIndexPattern", + "type": "Function", + "tags": [], + "label": "getFieldsForIndexPattern", + "description": [ + "\nGet field list by providing an index patttern (or spec)." + ], + "signature": [ + "(indexPattern: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + }, + ", options?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + " | undefined) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getFieldsForIndexPattern.$1", + "type": "CompoundType", + "tags": [], + "label": "indexPattern", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getFieldsForIndexPattern.$2", + "type": "Object", + "tags": [], + "label": "options", + "description": [ + "options for getting field list" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [ + "FieldSpec[]" + ] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.refreshFields", + "type": "Function", + "tags": [], + "label": "refreshFields", + "description": [ + "\nRefresh field list for a given index pattern." + ], + "signature": [ + "(dataView: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ", displayErrors?: boolean) => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.refreshFields.$1", + "type": "Object", + "tags": [], + "label": "dataView", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.refreshFields.$2", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.fieldArrayToMap", + "type": "Function", + "tags": [], + "label": "fieldArrayToMap", + "description": [ + "\nConverts field array to map." + ], + "signature": [ + "(fields: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[], fieldAttrs?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" + }, + " | undefined) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewFieldMap", + "text": "DataViewFieldMap" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.fieldArrayToMap.$1", + "type": "Array", + "tags": [], + "label": "fields", + "description": [ + ": FieldSpec[]" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.fieldArrayToMap.$2", + "type": "Object", + "tags": [], + "label": "fieldAttrs", + "description": [ + ": FieldAttrs" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [ + "Record" + ] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.savedObjectToSpec", + "type": "Function", + "tags": [], + "label": "savedObjectToSpec", + "description": [ + "\nConverts data view saved object to data view spec." + ], + "signature": [ + "(savedObject: ", + { + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" + }, + "<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" + }, + ">) => ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.savedObjectToSpec.$1", + "type": "Object", + "tags": [], + "label": "savedObject", + "description": [], + "signature": [ + { + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" + }, + "<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "DataViewSpec" + ] }, { - "plugin": "osquery", - "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.get", + "type": "Function", + "tags": [], + "label": "get", + "description": [ + "\nGet an index pattern by id, cache optimized." + ], + "signature": [ + "(id: string, displayErrors?: boolean, refreshFields?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.get.$1", + "type": "string", + "tags": [], + "label": "id", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.get.$2", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.get.$3", + "type": "boolean", + "tags": [], + "label": "refreshFields", + "description": [ + "- If set true, will fetch fields from the index pattern" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.create", + "type": "Function", + "tags": [], + "label": "create", + "description": [ + "\nCreate data view instance." + ], + "signature": [ + "(spec: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + }, + ", skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.create.$1", + "type": "Object", + "tags": [], + "label": "spec", + "description": [ + "data view spec" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.create.$2", + "type": "boolean", + "tags": [], + "label": "skipFetchFields", + "description": [ + "if true, will not fetch fields" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.create.$3", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [ + "DataView" + ] }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts" + "parentPluginId": "data", + "id": "def-common.DataViewsService.createAndSave", + "type": "Function", + "tags": [], + "label": "createAndSave", + "description": [ + "\nCreate a new data view and save it right away." + ], + "signature": [ + "(spec: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + }, + ", override?: boolean, skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createAndSave.$1", + "type": "Object", + "tags": [], + "label": "spec", + "description": [ + "data view spec" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createAndSave.$2", + "type": "boolean", + "tags": [], + "label": "override", + "description": [ + "Overwrite if existing index pattern exists." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createAndSave.$3", + "type": "boolean", + "tags": [], + "label": "skipFetchFields", + "description": [ + "Whether to skip field refresh step." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createAndSave.$4", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.createSavedObject", + "type": "Function", + "tags": [], + "label": "createSavedObject", + "description": [ + "\nSave a new data view." + ], + "signature": [ + "(dataView: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ", override?: boolean, displayErrors?: boolean) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ">" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createSavedObject.$1", + "type": "Object", + "tags": [], + "label": "dataView", + "description": [ + "data view instance" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createSavedObject.$2", + "type": "boolean", + "tags": [], + "label": "override", + "description": [ + "Overwrite if existing index pattern exists" + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.createSavedObject.$3", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.updateSavedObject", + "type": "Function", + "tags": [], + "label": "updateSavedObject", + "description": [ + "\nSave existing data view. Will attempt to merge differences if there are conflicts." + ], + "signature": [ + "(indexPattern: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + ", saveAttempts?: number, ignoreErrors?: boolean, displayErrors?: boolean) => Promise" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.updateSavedObject.$1", + "type": "Object", + "tags": [], + "label": "indexPattern", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + } + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.updateSavedObject.$2", + "type": "number", + "tags": [], + "label": "saveAttempts", + "description": [], + "signature": [ + "number" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.updateSavedObject.$3", + "type": "boolean", + "tags": [], + "label": "ignoreErrors", + "description": [], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.updateSavedObject.$4", + "type": "boolean", + "tags": [], + "label": "displayErrors", + "description": [ + "- If set false, API consumer is responsible for displaying and handling errors." + ], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx" + "parentPluginId": "data", + "id": "def-common.DataViewsService.delete", + "type": "Function", + "tags": [], + "label": "delete", + "description": [ + "\nDeletes an index pattern from .kibana index." + ], + "signature": [ + "(indexPatternId: string) => Promise<{}>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.delete.$1", + "type": "string", + "tags": [], + "label": "indexPatternId", + "description": [ + ": Id of kibana Index Pattern to delete" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx" - }, + "parentPluginId": "data", + "id": "def-common.DataViewsService.getDefaultDataView", + "type": "Function", + "tags": [], + "label": "getDefaultDataView", + "description": [ + "\nReturns the default data view as an object.\nIf no default is found, or it is missing\nanother data view is selected as default and returned.\nIf no possible data view found to become a default returns null.\n" + ], + "signature": [ + "(refreshFields?: boolean | undefined) => Promise<", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" + }, + " | null>" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewsService.getDefaultDataView.$1", + "type": "CompoundType", + "tags": [], + "label": "refreshFields", + "description": [ + "- if true, will refresh the fields of the default data view" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": false + } + ], + "returnComment": [ + "default data view" + ] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DuplicateDataViewError", + "type": "Class", + "tags": [], + "label": "DuplicateDataViewError", + "description": [ + "\nError thrown when attempting to create duplicate index pattern based on title." + ], + "signature": [ { - "plugin": "savedObjects", - "path": "src/plugins/saved_objects/public/saved_object/helpers/find_object_by_title.test.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DuplicateDataViewError", + "text": "DuplicateDataViewError" }, + " extends Error" + ], + "path": "src/plugins/data_views/common/errors/duplicate_index_pattern.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DuplicateDataViewError.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [ + "\nconstructor" + ], + "signature": [ + "any" + ], + "path": "src/plugins/data_views/common/errors/duplicate_index_pattern.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.DuplicateDataViewError.Unnamed.$1", + "type": "string", + "tags": [], + "label": "message", + "description": [ + "- Error message" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/errors/duplicate_index_pattern.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.KbnFieldType", + "type": "Class", + "tags": [], + "label": "KbnFieldType", + "description": [], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "savedObjects", - "path": "src/plugins/saved_objects/public/saved_object/helpers/find_object_by_title.test.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldType.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-mocks", - "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldType.sortable", + "type": "boolean", + "tags": [], + "label": "sortable", + "description": [], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-mocks", - "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldType.filterable", + "type": "boolean", + "tags": [], + "label": "filterable", + "description": [], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-browser-mocks", - "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldType.esTypes", + "type": "Object", + "tags": [], + "label": "esTypes", + "description": [], + "signature": [ + "readonly ", + { + "pluginId": "@kbn/field-types", + "scope": "common", + "docId": "kibKbnFieldTypesPluginApi", + "section": "def-common.ES_FIELD_TYPES", + "text": "ES_FIELD_TYPES" + }, + "[]" + ], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, + "parentPluginId": "data", + "id": "def-common.KbnFieldType.Unnamed", + "type": "Function", + "tags": [], + "label": "Constructor", + "description": [], + "signature": [ + "any" + ], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.KbnFieldType.Unnamed.$1", + "type": "Object", + "tags": [], + "label": "options", + "description": [], + "signature": [ + "Partial<", + { + "pluginId": "@kbn/field-types", + "scope": "common", + "docId": "kibKbnFieldTypesPluginApi", + "section": "def-common.KbnFieldTypeOptions", + "text": "KbnFieldTypeOptions" + }, + ">" + ], + "path": "packages/kbn-field-types/src/kbn_field_type.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + } + ], + "initialIsOpen": false + } + ], + "functions": [ + { + "parentPluginId": "data", + "id": "def-common.cellHasFormulas", + "type": "Function", + "tags": [], + "label": "cellHasFormulas", + "description": [], + "signature": [ + "(val: string) => boolean" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, + "parentPluginId": "data", + "id": "def-common.cellHasFormulas.$1", + "type": "string", + "tags": [], + "label": "val", + "description": [], + "signature": [ + "string" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.createEscapeValue", + "type": "Function", + "tags": [], + "label": "createEscapeValue", + "description": [ + "\nCreate a function that will escape CSV values like \"=\", \"@\" and \"+\" with a\n\"'\". This will also place CSV values in \"\" if contain non-alphanumeric chars.\n\nFor example:\n\nGiven: =1+1\nReturns: \"'=1+1\"\n\nSee OWASP: https://www.owasp.org/index.php/CSV_Injection." + ], + "signature": [ + "(quoteValues: boolean, escapeFormulas: boolean) => (val: RawValue) => string" + ], + "path": "src/plugins/data/common/exports/escape_value.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" + "parentPluginId": "data", + "id": "def-common.createEscapeValue.$1", + "type": "boolean", + "tags": [], + "label": "quoteValues", + "description": [], + "signature": [ + "boolean" + ], + "path": "src/plugins/data/common/exports/escape_value.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" - }, + "parentPluginId": "data", + "id": "def-common.createEscapeValue.$2", + "type": "boolean", + "tags": [], + "label": "escapeFormulas", + "description": [], + "signature": [ + "boolean" + ], + "path": "src/plugins/data/common/exports/escape_value.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.datatableToCSV", + "type": "Function", + "tags": [], + "label": "datatableToCSV", + "description": [], + "signature": [ + "({ columns, rows }: ", { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" }, + ", { csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }: CSVOptions) => string" + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" + "parentPluginId": "data", + "id": "def-common.datatableToCSV.$1", + "type": "Object", + "tags": [], + "label": "{ columns, rows }", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + } + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false, + "isRequired": true }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, + "parentPluginId": "data", + "id": "def-common.datatableToCSV.$2", + "type": "Object", + "tags": [], + "label": "{ csvSeparator, quoteValues, formatFactory, raw, escapeFormulaValues }", + "description": [], + "signature": [ + "CSVOptions" + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.fieldList", + "type": "Function", + "tags": [], + "label": "fieldList", + "description": [], + "signature": [ + "(specs?: ", { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" }, + "[], shortDotsEnable?: boolean) => ", { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.IIndexPatternFieldList", + "text": "IIndexPatternFieldList" + } + ], + "path": "src/plugins/data_views/common/fields/field_list.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "parentPluginId": "data", + "id": "def-common.fieldList.$1", + "type": "Array", + "tags": [], + "label": "specs", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" + }, + "[]" + ], + "path": "src/plugins/data_views/common/fields/field_list.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, + "parentPluginId": "data", + "id": "def-common.fieldList.$2", + "type": "boolean", + "tags": [], + "label": "shortDotsEnable", + "description": [], + "signature": [ + "boolean" + ], + "path": "src/plugins/data_views/common/fields/field_list.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.getEsQueryConfig", + "type": "Function", + "tags": [], + "label": "getEsQueryConfig", + "description": [], + "signature": [ + "(config: KibanaConfig) => ", { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.EsQueryConfig", + "text": "EsQueryConfig" + } + ], + "path": "src/plugins/data/common/es_query/get_es_query_config.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, + "parentPluginId": "data", + "id": "def-common.getEsQueryConfig.$1", + "type": "Object", + "tags": [], + "label": "config", + "description": [], + "signature": [ + "KibanaConfig" + ], + "path": "src/plugins/data/common/es_query/get_es_query_config.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.getFieldSubtypeMulti", + "type": "Function", + "tags": [], + "label": "getFieldSubtypeMulti", + "description": [], + "signature": [ + "(field: HasSubtype) => ", { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubTypeMulti", + "text": "IFieldSubTypeMulti" }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, + "parentPluginId": "data", + "id": "def-common.getFieldSubtypeMulti.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.getFieldSubtypeNested", + "type": "Function", + "tags": [], + "label": "getFieldSubtypeNested", + "description": [], + "signature": [ + "(field: HasSubtype) => ", { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubTypeNested", + "text": "IFieldSubTypeNested" }, + " | undefined" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, + "parentPluginId": "data", + "id": "def-common.getFieldSubtypeNested.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.getIndexPatternLoadMeta", + "type": "Function", + "tags": [], + "label": "getIndexPatternLoadMeta", + "description": [], + "signature": [ + "() => Omit<", { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.IndexPatternLoadExpressionFunctionDefinition", + "text": "IndexPatternLoadExpressionFunctionDefinition" }, + ", \"fn\">" + ], + "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.isFilterable", + "type": "Function", + "tags": [], + "label": "isFilterable", + "description": [], + "signature": [ + "(field: ", { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" }, + ") => boolean" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" - }, + "parentPluginId": "data", + "id": "def-common.isFilterable.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewField", + "text": "DataViewField" + } + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.isMultiField", + "type": "Function", + "tags": [], + "label": "isMultiField", + "description": [], + "signature": [ + "(field: HasSubtype) => boolean" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" - }, + "parentPluginId": "data", + "id": "def-common.isMultiField.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.isNestedField", + "type": "Function", + "tags": [], + "label": "isNestedField", + "description": [], + "signature": [ + "(field: HasSubtype) => boolean" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" - }, + "parentPluginId": "data", + "id": "def-common.isNestedField.$1", + "type": "Object", + "tags": [], + "label": "field", + "description": [], + "signature": [ + "{ subType?: ", + { + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.IFieldSubType", + "text": "IFieldSubType" + }, + " | undefined; }" + ], + "path": "src/plugins/data_views/common/fields/utils.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.tableHasFormulas", + "type": "Function", + "tags": [], + "label": "tableHasFormulas", + "description": [], + "signature": [ + "(columns: ", { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" }, + "[], rows: ", { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableRow", + "text": "DatatableRow" }, + "[]) => boolean" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "parentPluginId": "data", + "id": "def-common.tableHasFormulas.$1", + "type": "Array", + "tags": [], + "label": "columns", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableColumn", + "text": "DatatableColumn" + }, + "[]" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, + "parentPluginId": "data", + "id": "def-common.tableHasFormulas.$2", + "type": "Array", + "tags": [], + "label": "rows", + "description": [], + "signature": [ + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.DatatableRow", + "text": "DatatableRow" + }, + "[]" + ], + "path": "src/plugins/data/common/exports/formula_checks.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + } + ], + "interfaces": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewAttributes", + "type": "Interface", + "tags": [], + "label": "DataViewAttributes", + "description": [ + "\nInterface for the data view saved object" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.fields", + "type": "string", + "tags": [], + "label": "fields", + "description": [ + "\nFields as a serialized array of field specs" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.title", + "type": "string", + "tags": [], + "label": "title", + "description": [ + "\nData view title" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nData view type, default or rollup" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.typeMeta", + "type": "string", + "tags": [], + "label": "typeMeta", + "description": [ + "\nType metadata information, serialized. Only used by rollup data views." + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.timeFieldName", + "type": "string", + "tags": [], + "label": "timeFieldName", + "description": [ + "\nTime field name" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.sourceFilters", + "type": "string", + "tags": [], + "label": "sourceFilters", + "description": [ + "\nSerialized array of filters. Used by discover to hide fields." + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.fieldFormatMap", + "type": "string", + "tags": [], + "label": "fieldFormatMap", + "description": [ + "\nSerialized map of field formats by field name" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.fieldAttrs", + "type": "string", + "tags": [], + "label": "fieldAttrs", + "description": [ + "\nSerialized map of field attributes, currently field count and name" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.runtimeFieldMap", + "type": "string", + "tags": [], + "label": "runtimeFieldMap", + "description": [ + "\nSerialized map of runtime field definitions, by field name" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.allowNoIndex", + "type": "CompoundType", + "tags": [], + "label": "allowNoIndex", + "description": [ + "\nPrevents errors when index pattern exists before indices" + ], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, + "parentPluginId": "data", + "id": "def-common.DataViewAttributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the data view. Human readable name used to differentiate data view." + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewListItem", + "type": "Interface", + "tags": [], + "label": "DataViewListItem", + "description": [ + "\nResult from data view search - summary data." + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewListItem.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nSaved object id (or generated id if in-memory only)" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewListItem.namespaces", + "type": "Array", + "tags": [], + "label": "namespaces", + "description": [ + "\nNamespace ids" + ], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewListItem.title", + "type": "string", + "tags": [], + "label": "title", + "description": [ + "\nData view title" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewListItem.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nData view type" + ], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.DataViewListItem.typeMeta", + "type": "Object", + "tags": [], + "label": "typeMeta", + "description": [ + "\nData view type meta" + ], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.TypeMeta", + "text": "TypeMeta" + }, + " | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, + "parentPluginId": "data", + "id": "def-common.DataViewListItem.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions", + "type": "Interface", + "tags": [], + "label": "GetFieldsOptions", + "description": [], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.lookBack", + "type": "CompoundType", + "tags": [], + "label": "lookBack", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.metaFields", + "type": "Array", + "tags": [], + "label": "metaFields", + "description": [], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.rollupIndex", + "type": "string", + "tags": [], + "label": "rollupIndex", + "description": [], + "signature": [ + "string | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.allowNoIndex", + "type": "CompoundType", + "tags": [], + "label": "allowNoIndex", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.indexFilter", + "type": "Object", + "tags": [], + "label": "indexFilter", + "description": [], + "signature": [ + "QueryDslQueryContainer", + " | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.includeUnmapped", + "type": "CompoundType", + "tags": [], + "label": "includeUnmapped", + "description": [], + "signature": [ + "boolean | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, + "parentPluginId": "data", + "id": "def-common.GetFieldsOptions.fields", + "type": "Array", + "tags": [], + "label": "fields", + "description": [], + "signature": [ + "string[] | undefined" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.IDataViewsApiClient", + "type": "Interface", + "tags": [], + "label": "IDataViewsApiClient", + "description": [], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.IDataViewsApiClient.getFieldsForWildcard", + "type": "Function", + "tags": [], + "label": "getFieldsForWildcard", + "description": [], + "signature": [ + "(options: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + }, + ") => Promise<", + "FieldsForWildcardResponse", + ">" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.IDataViewsApiClient.getFieldsForWildcard.$1", + "type": "Object", + "tags": [], + "label": "options", + "description": [], + "signature": [ + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" + } + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, + "parentPluginId": "data", + "id": "def-common.IDataViewsApiClient.hasUserDataView", + "type": "Function", + "tags": [], + "label": "hasUserDataView", + "description": [], + "signature": [ + "() => Promise" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.IndexPatternExpressionType", + "type": "Interface", + "tags": [], + "label": "IndexPatternExpressionType", + "description": [ + "\nIndex pattern expression interface" + ], + "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "parentPluginId": "data", + "id": "def-common.IndexPatternExpressionType.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nExpression type" + ], + "signature": [ + "\"index_pattern\"" + ], + "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, + "parentPluginId": "data", + "id": "def-common.IndexPatternExpressionType.value", + "type": "Object", + "tags": [], + "label": "value", + "description": [ + "\nValue - DataViewSpec" + ], + "signature": [ + "{ id?: string | undefined; version?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; sourceFilters?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.SourceFilter", + "text": "SourceFilter" + }, + "[] | undefined; fields?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewFieldMap", + "text": "DataViewFieldMap" + }, + " | undefined; typeMeta?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.TypeMeta", + "text": "TypeMeta" + }, + " | undefined; type?: string | undefined; fieldFormats?: Record> | undefined; runtimeFieldMap?: Record | undefined; fieldAttrs?: ", + { + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" + }, + " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }" + ], + "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.KbnFieldTypeOptions", + "type": "Interface", + "tags": [], + "label": "KbnFieldTypeOptions", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldTypeOptions.sortable", + "type": "boolean", + "tags": [], + "label": "sortable", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldTypeOptions.filterable", + "type": "boolean", + "tags": [], + "label": "filterable", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "parentPluginId": "data", + "id": "def-common.KbnFieldTypeOptions.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, + "parentPluginId": "data", + "id": "def-common.KbnFieldTypeOptions.esTypes", + "type": "Array", + "tags": [], + "label": "esTypes", + "description": [], + "signature": [ + { + "pluginId": "@kbn/field-types", + "scope": "common", + "docId": "kibKbnFieldTypesPluginApi", + "section": "def-common.ES_FIELD_TYPES", + "text": "ES_FIELD_TYPES" + }, + "[]" + ], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon", + "type": "Interface", + "tags": [], + "label": "UiSettingsCommon", + "description": [ + "\nInterface for UiSettings common interface {@link UiSettingsClient}" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.get", + "type": "Function", + "tags": [], + "label": "get", + "description": [ + "\nGet a setting value" + ], + "signature": [ + "(key: string) => Promise" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.get.$1", + "type": "string", + "tags": [], + "label": "key", + "description": [ + "name of value" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.getAll", + "type": "Function", + "tags": [], + "label": "getAll", + "description": [ + "\nGet all settings values" + ], + "signature": [ + "() => Promise>" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [], + "returnComment": [] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.set", + "type": "Function", + "tags": [], + "label": "set", + "description": [ + "\nSet a setting value" + ], + "signature": [ + "(key: string, value: T) => Promise" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.set.$1", + "type": "string", + "tags": [], + "label": "key", + "description": [ + "name of value" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + }, + { + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.set.$2", + "type": "Uncategorized", + "tags": [], + "label": "value", + "description": [ + "value to set" + ], + "signature": [ + "T" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.remove", + "type": "Function", + "tags": [], + "label": "remove", + "description": [ + "\nRemove a setting value" + ], + "signature": [ + "(key: string) => Promise" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "data", + "id": "def-common.UiSettingsCommon.remove.$1", + "type": "string", + "tags": [], + "label": "key", + "description": [ + "name of value" + ], + "signature": [ + "string" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [] + } + ], + "initialIsOpen": false + } + ], + "enums": [ + { + "parentPluginId": "data", + "id": "def-common.DataViewType", + "type": "Enum", + "tags": [], + "label": "DataViewType", + "description": [ + "\nData View type. Default or rollup" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.ES_FIELD_TYPES", + "type": "Enum", + "tags": [], + "label": "ES_FIELD_TYPES", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.KBN_FIELD_TYPES", + "type": "Enum", + "tags": [], + "label": "KBN_FIELD_TYPES", + "description": [], + "path": "packages/kbn-field-types/src/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + } + ], + "misc": [ + { + "parentPluginId": "data", + "id": "def-common.AggregationRestrictions", + "type": "Type", + "tags": [], + "label": "AggregationRestrictions", + "description": [], + "signature": [ + "{ [x: string]: { agg?: string | undefined; interval?: number | undefined; fixed_interval?: string | undefined; calendar_interval?: string | undefined; delay?: string | undefined; time_zone?: string | undefined; }; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.CSV_FORMULA_CHARS", + "type": "Array", + "tags": [], + "label": "CSV_FORMULA_CHARS", + "description": [], + "signature": [ + "string[]" + ], + "path": "src/plugins/data/common/exports/constants.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.CSV_MIME_TYPE", + "type": "string", + "tags": [], + "label": "CSV_MIME_TYPE", + "description": [], + "signature": [ + "\"text/plain;charset=utf-8\"" + ], + "path": "src/plugins/data/common/exports/export_csv.tsx", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DATA_VIEW_SAVED_OBJECT_TYPE", + "type": "string", + "tags": [], + "label": "DATA_VIEW_SAVED_OBJECT_TYPE", + "description": [ + "\nData view saved object type." + ], + "signature": [ + "\"index-pattern\"" + ], + "path": "src/plugins/data_views/common/constants.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewFieldMap", + "type": "Type", + "tags": [], + "label": "DataViewFieldMap", + "description": [], + "signature": [ + "{ [x: string]: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" }, + "; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewsContract", + "type": "Type", + "tags": [], + "label": "DataViewsContract", + "description": [ + "\nData views service interface" + ], + "signature": [ + "{ get: (id: string, displayErrors?: boolean, refreshFields?: boolean) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ">; delete: (indexPatternId: string) => Promise<{}>; create: (spec: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" }, + ", skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ">; find: (search: string, size?: number) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + "[]>; getCanSave: () => Promise; getIds: (refresh?: boolean) => Promise; getTitles: (refresh?: boolean) => Promise; getIdsWithTitle: (refresh?: boolean) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewListItem", + "text": "DataViewListItem" }, + "[]>; clearCache: () => void; clearInstanceCache: (id?: string | undefined) => void; getCache: () => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" }, + "<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSavedObjectAttrs", + "text": "DataViewSavedObjectAttrs" }, + ">[] | null | undefined>; getDefault: (displayErrors?: boolean) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + " | null>; getDefaultId: () => Promise; setDefault: (id: string | null, force?: boolean) => Promise; hasUserDataView: () => Promise; getFieldsForWildcard: (options: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" }, + ") => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" }, + "[]>; getFieldsForIndexPattern: (indexPattern: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + " | ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" }, + ", options?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.GetFieldsOptions", + "text": "GetFieldsOptions" }, + " | undefined) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" }, + "[]>; refreshFields: (dataView: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ", displayErrors?: boolean) => Promise; fieldArrayToMap: (fields: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldSpec", + "text": "FieldSpec" }, + "[], fieldAttrs?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" }, + " | undefined) => ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewFieldMap", + "text": "DataViewFieldMap" }, + "; savedObjectToSpec: (savedObject: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" }, + "<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewAttributes", + "text": "DataViewAttributes" }, + ">) => ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" }, + "; createAndSave: (spec: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewSpec", + "text": "DataViewSpec" }, + ", override?: boolean, skipFetchFields?: boolean, displayErrors?: boolean) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ">; createSavedObject: (dataView: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ", override?: boolean, displayErrors?: boolean) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ">; updateSavedObject: (indexPattern: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + ", saveAttempts?: number, ignoreErrors?: boolean, displayErrors?: boolean) => Promise; getDefaultDataView: (refreshFields?: boolean | undefined) => Promise<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataView", + "text": "DataView" }, + " | null>; }" + ], + "path": "src/plugins/data_views/common/data_views/data_views.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DataViewSpec", + "type": "Type", + "tags": [], + "label": "DataViewSpec", + "description": [ + "\nStatic data view format\nSerialized data object, representing data view attributes and state" + ], + "signature": [ + "{ id?: string | undefined; version?: string | undefined; title?: string | undefined; timeFieldName?: string | undefined; sourceFilters?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.SourceFilter", + "text": "SourceFilter" }, + "[] | undefined; fields?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.DataViewFieldMap", + "text": "DataViewFieldMap" }, + " | undefined; typeMeta?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.TypeMeta", + "text": "TypeMeta" }, + " | undefined; type?: string | undefined; fieldFormats?: Record> | undefined; runtimeFieldMap?: Record | undefined; fieldAttrs?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrs", + "text": "FieldAttrs" }, + " | undefined; allowNoIndex?: boolean | undefined; namespaces?: string[] | undefined; name?: string | undefined; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.DEFAULT_QUERY_LANGUAGE", + "type": "string", + "tags": [], + "label": "DEFAULT_QUERY_LANGUAGE", + "description": [], + "signature": [ + "\"kuery\"" + ], + "path": "src/plugins/data/common/constants.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.FieldAttrs", + "type": "Type", + "tags": [], + "label": "FieldAttrs", + "description": [ + "\nSet of field attributes" + ], + "signature": [ + "{ [key: string]: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.FieldAttrSet", + "text": "FieldAttrSet" }, + "; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.FieldAttrSet", + "type": "Type", + "tags": [], + "label": "FieldAttrSet", + "description": [ + "\nField attributes that are stored on the data view" + ], + "signature": [ + "{ customLabel?: string | undefined; count?: number | undefined; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.FieldSpec", + "type": "Type", + "tags": [], + "label": "FieldSpec", + "description": [ + "\nSerialized version of DataViewField" + ], + "signature": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "@kbn/es-query", + "scope": "common", + "docId": "kibKbnEsQueryPluginApi", + "section": "def-common.DataViewFieldBase", + "text": "DataViewFieldBase" }, + " & { count?: number | undefined; conflictDescriptions?: Record | undefined; format?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "fieldFormats", + "scope": "common", + "docId": "kibFieldFormatsPluginApi", + "section": "def-common.SerializedFieldFormat", + "text": "SerializedFieldFormat" }, + "<{}, ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" }, + "> | undefined; esTypes?: string[] | undefined; searchable: boolean; aggregatable: boolean; readFromDocValues?: boolean | undefined; indexed?: boolean | undefined; customLabel?: string | undefined; runtimeField?: ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "dataViews", + "scope": "common", + "docId": "kibDataViewsPluginApi", + "section": "def-common.RuntimeFieldSpec", + "text": "RuntimeFieldSpec" }, + " | undefined; fixedInterval?: string[] | undefined; timeZone?: string[] | undefined; timeSeriesDimension?: boolean | undefined; timeSeriesMetric?: \"gauge\" | \"histogram\" | \"summary\" | \"counter\" | undefined; shortDotsEnable?: boolean | undefined; isMapped?: boolean | undefined; parentName?: string | undefined; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.FieldSpecConflictDescriptions", + "type": "Type", + "tags": [], + "label": "FieldSpecConflictDescriptions", + "description": [], + "signature": [ + "{ [x: string]: string[]; }" + ], + "path": "src/plugins/data_views/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.GetConfigFn", + "type": "Type", + "tags": [], + "label": "GetConfigFn", + "description": [ + "\nIf a service is being shared on both the client and the server, and\nthe client code requires synchronous access to uiSettings, both client\nand server should wrap the core uiSettings services in a function\nmatching this signature.\n\nThis matches the signature of the public `core.uiSettings.get`, and\nshould only be used in scenarios where async access to uiSettings is\nnot possible." + ], + "signature": [ + "(key: string, defaultOverride?: T | undefined) => T" + ], + "path": "src/plugins/data/common/types.ts", + "deprecated": false, + "trackAdoption": false, + "returnComment": [], + "children": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "parentPluginId": "data", + "id": "def-common.GetConfigFn.$1", + "type": "string", + "tags": [], + "label": "key", + "description": [], + "path": "src/plugins/data/common/types.ts", + "deprecated": false, + "trackAdoption": false }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, + "parentPluginId": "data", + "id": "def-common.GetConfigFn.$2", + "type": "Uncategorized", + "tags": [], + "label": "defaultOverride", + "description": [], + "signature": [ + "T | undefined" + ], + "path": "src/plugins/data/common/types.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.IndexPatternLoadExpressionFunctionDefinition", + "type": "Type", + "tags": [], + "label": "IndexPatternLoadExpressionFunctionDefinition", + "description": [], + "signature": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.ExpressionFunctionDefinition", + "text": "ExpressionFunctionDefinition" }, + "<\"indexPatternLoad\", null, Arguments, Output, ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.ExecutionContext", + "text": "ExecutionContext" }, + "<", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "pluginId": "inspector", + "scope": "common", + "docId": "kibInspectorPluginApi", + "section": "def-common.Adapters", + "text": "Adapters" }, + ", ", { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "pluginId": "@kbn/utility-types", + "scope": "common", + "docId": "kibKbnUtilityTypesPluginApi", + "section": "def-common.SerializableRecord", + "text": "SerializableRecord" }, + ">>" + ], + "path": "src/plugins/data_views/common/expressions/load_index_pattern.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.KIBANA_USER_QUERY_LANGUAGE_KEY", + "type": "string", + "tags": [], + "label": "KIBANA_USER_QUERY_LANGUAGE_KEY", + "description": [], + "signature": [ + "\"kibana.userQueryLanguage\"" + ], + "path": "src/plugins/data/common/constants.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.META_FIELDS", + "type": "string", + "tags": [], + "label": "META_FIELDS", + "description": [ + "\nUiSettings key for metaFields list." + ], + "signature": [ + "\"metaFields\"" + ], + "path": "src/plugins/data_views/common/constants.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.Query", + "type": "Type", + "tags": [], + "label": "Query", + "description": [], + "signature": [ + "{ query: string | { [key: string]: any; }; language: string; }" + ], + "path": "packages/kbn-es-query/src/filters/build_filters/types.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, + { + "parentPluginId": "data", + "id": "def-common.SavedObject", + "type": "Type", + "tags": [ + "deprecated" + ], + "label": "SavedObject", + "description": [], + "signature": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObject", + "text": "SavedObject" }, + "" + ], + "path": "packages/core/saved-objects/core-saved-objects-common/src/saved_objects.ts", + "deprecated": true, + "trackAdoption": false, + "references": [ { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-common", + "path": "packages/core/saved-objects/core-saved-objects-common/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-browser", + "path": "packages/core/saved-objects/core-saved-objects-api-browser/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/base.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/base.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/resolve.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/resolve.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/update.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/update.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/apis/find.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_repository.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" + "plugin": "@kbn/core-saved-objects-api-server", + "path": "packages/core/saved-objects/core-saved-objects-api-server/src/saved_objects_client.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "core", - "path": "src/core/types/index.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "apm", - "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.ts" }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" + { + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/saved_objects_client.ts" }, { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" + "plugin": "core", + "path": "src/core/public/index.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" + "plugin": "home", + "path": "src/plugins/home/server/services/sample_data/sample_data_registry.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" + "plugin": "home", + "path": "src/plugins/home/server/services/sample_data/sample_data_registry.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" + "plugin": "home", + "path": "src/plugins/home/server/services/sample_data/sample_data_registry.ts" }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/types.ts" }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/types.ts" }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/types.ts" }, { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/types.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/types.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/types.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/index.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_view.stub.ts" + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_view.stub.ts" + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.ts" }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/server/utils.ts" }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/server/utils.ts" }, { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/server/utils.ts" }, { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" + "plugin": "discover", + "path": "src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts" }, { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" + "plugin": "discover", + "path": "src/plugins/discover/public/application/main/components/layout/__stories__/get_layout_props.ts" }, { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" }, { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" }, { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" }, { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/public/saved_objects_client_wrapper.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.test.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_views/data_views.test.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/ui_api/get_table_column_definition.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/ui_api/get_table_column_definition.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/ui_api/get_table_column_definition.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" + "plugin": "savedObjectsFinder", + "path": "src/plugins/saved_objects_finder/public/finder/saved_object_finder.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" + "plugin": "savedObjectsFinder", + "path": "src/plugins/saved_objects_finder/public/finder/saved_object_finder.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" + "plugin": "savedObjectsFinder", + "path": "src/plugins/saved_objects_finder/public/finder/saved_object_finder.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" + "plugin": "fleet", + "path": "x-pack/plugins/fleet/common/types/models/epm.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" + "plugin": "fleet", + "path": "x-pack/plugins/fleet/common/types/models/epm.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" + "plugin": "fleet", + "path": "x-pack/plugins/fleet/common/types/models/epm.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" + "plugin": "canvas", + "path": "x-pack/plugins/canvas/shareable_runtime/types.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" + "plugin": "canvas", + "path": "x-pack/plugins/canvas/shareable_runtime/types.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/services/kibana/workpad.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/services/kibana/workpad.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/home/hooks/use_upload_workpad.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" + "plugin": "canvas", + "path": "x-pack/plugins/canvas/public/components/home/hooks/use_upload_workpad.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/packs/types.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/packs/types.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/routes/saved_queries/list/index.tsx" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" }, { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" + "plugin": "osquery", + "path": "x-pack/plugins/osquery/public/assets/use_assets_status.ts" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/utils.ts" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/public/common/containers/dashboards/use_security_dashboards_table.tsx" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx" }, { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "savedObjects", + "path": "src/plugins/saved_objects/public/saved_object/helpers/find_object_by_title.test.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "savedObjects", + "path": "src/plugins/saved_objects/public/saved_object/helpers/find_object_by_title.test.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-browser-mocks", + "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-browser-mocks", + "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-browser-mocks", + "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-server", + "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-server", + "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-server", + "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "core", + "path": "src/core/types/index.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "apm", + "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" }, { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_view.stub.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_view.stub.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" } ], "initialIsOpen": false diff --git a/api_docs/data.mdx b/api_docs/data.mdx index a43a56d4e200e..2f29be6aa8873 100644 --- a/api_docs/data.mdx +++ b/api_docs/data.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data title: "data" image: https://source.unsplash.com/400x175/?github description: API docs for the data plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data'] --- import dataObj from './data.devdocs.json'; diff --git a/api_docs/data_query.mdx b/api_docs/data_query.mdx index 80957dc35eba3..b9d92a96a5386 100644 --- a/api_docs/data_query.mdx +++ b/api_docs/data_query.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-query title: "data.query" image: https://source.unsplash.com/400x175/?github description: API docs for the data.query plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.query'] --- import dataQueryObj from './data_query.devdocs.json'; diff --git a/api_docs/data_search.mdx b/api_docs/data_search.mdx index 160106ebd12b2..375e1b76d4365 100644 --- a/api_docs/data_search.mdx +++ b/api_docs/data_search.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/data-search title: "data.search" image: https://source.unsplash.com/400x175/?github description: API docs for the data.search plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'data.search'] --- import dataSearchObj from './data_search.devdocs.json'; diff --git a/api_docs/data_view_editor.mdx b/api_docs/data_view_editor.mdx index 0a1662e016651..e0dd1107a3a21 100644 --- a/api_docs/data_view_editor.mdx +++ b/api_docs/data_view_editor.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewEditor title: "dataViewEditor" image: https://source.unsplash.com/400x175/?github description: API docs for the dataViewEditor plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewEditor'] --- import dataViewEditorObj from './data_view_editor.devdocs.json'; diff --git a/api_docs/data_view_field_editor.mdx b/api_docs/data_view_field_editor.mdx index bb705e7ce002c..a1833f9439305 100644 --- a/api_docs/data_view_field_editor.mdx +++ b/api_docs/data_view_field_editor.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewFieldEditor title: "dataViewFieldEditor" image: https://source.unsplash.com/400x175/?github description: API docs for the dataViewFieldEditor plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewFieldEditor'] --- import dataViewFieldEditorObj from './data_view_field_editor.devdocs.json'; diff --git a/api_docs/data_view_management.mdx b/api_docs/data_view_management.mdx index 121b2e6cb87a5..7242fb6d75734 100644 --- a/api_docs/data_view_management.mdx +++ b/api_docs/data_view_management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViewManagement title: "dataViewManagement" image: https://source.unsplash.com/400x175/?github description: API docs for the dataViewManagement plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViewManagement'] --- import dataViewManagementObj from './data_view_management.devdocs.json'; diff --git a/api_docs/data_views.devdocs.json b/api_docs/data_views.devdocs.json index eacda78b9debc..62651e8696a6a 100644 --- a/api_docs/data_views.devdocs.json +++ b/api_docs/data_views.devdocs.json @@ -319,14 +319,6 @@ "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, { "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" @@ -8531,14 +8523,6 @@ "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, { "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" @@ -15838,14 +15822,6 @@ "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, - { - "plugin": "unifiedFieldList", - "path": "src/plugins/unified_field_list/common/utils/field_existing_utils.ts" - }, { "plugin": "unifiedFieldList", "path": "src/plugins/unified_field_list/public/hooks/use_existing_fields.ts" @@ -26124,14 +26100,6 @@ "plugin": "@kbn/core-saved-objects-browser-mocks", "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, { "plugin": "@kbn/core-saved-objects-server", "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" @@ -26145,961 +26113,341 @@ "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" + "plugin": "@kbn/core-saved-objects-import-export-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" + "plugin": "core", + "path": "src/core/types/index.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" + "plugin": "apm", + "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "core", - "path": "src/core/types/index.ts" - }, - { - "plugin": "apm", - "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" - }, - { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" - }, - { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" - }, - { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { "plugin": "cases", "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, { "plugin": "@kbn/core-saved-objects-browser-internal", "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" @@ -27132,158 +26480,6 @@ "plugin": "@kbn/core-saved-objects-browser-internal", "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" - }, { "plugin": "@kbn/core-ui-settings-server-internal", "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" @@ -27295,126 +26491,6 @@ { "plugin": "@kbn/core-ui-settings-server-internal", "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" } ], "initialIsOpen": false diff --git a/api_docs/data_views.mdx b/api_docs/data_views.mdx index bd5619fd081db..649634375d94d 100644 --- a/api_docs/data_views.mdx +++ b/api_docs/data_views.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataViews title: "dataViews" image: https://source.unsplash.com/400x175/?github description: API docs for the dataViews plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataViews'] --- import dataViewsObj from './data_views.devdocs.json'; diff --git a/api_docs/data_visualizer.mdx b/api_docs/data_visualizer.mdx index 8dec6a11d7920..5b4e87f9ae17d 100644 --- a/api_docs/data_visualizer.mdx +++ b/api_docs/data_visualizer.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/dataVisualizer title: "dataVisualizer" image: https://source.unsplash.com/400x175/?github description: API docs for the dataVisualizer plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'dataVisualizer'] --- import dataVisualizerObj from './data_visualizer.devdocs.json'; diff --git a/api_docs/deprecations_by_api.mdx b/api_docs/deprecations_by_api.mdx index a05179486e88c..fbea9970bb794 100644 --- a/api_docs/deprecations_by_api.mdx +++ b/api_docs/deprecations_by_api.mdx @@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByApi slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-api title: Deprecated API usage by API description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by. -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana'] --- @@ -21,21 +21,16 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | visTypePie | - | | | alerting, discover, securitySolution | - | | | stackAlerts, alerting, securitySolution, inputControlVis | - | -| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal, @kbn/core-saved-objects-api-server, core, home, dataViews, discover, savedObjectsTagging, savedObjectsFinder, fleet, canvas, osquery, securitySolution, synthetics, savedObjects, @kbn/core-saved-objects-browser-mocks, @kbn/core-saved-objects-server, @kbn/core-saved-objects-api-server-internal, @kbn/core-saved-objects-import-export-server-internal, @kbn/core-saved-objects-server-internal, apm, savedObjectsTaggingOss, savedObjectsManagement, cases, lists, upgradeAssistant, security, encryptedSavedObjects, lens, alerting, observability, @kbn/core-ui-settings-server-internal, data, dashboard | - | -| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal, @kbn/core-saved-objects-api-server, core, home, dataViews, discover, savedObjectsTagging, savedObjectsFinder, fleet, canvas, osquery, securitySolution, synthetics, savedObjects, @kbn/core-saved-objects-browser-mocks, @kbn/core-saved-objects-server, @kbn/core-saved-objects-api-server-internal, @kbn/core-saved-objects-import-export-server-internal, @kbn/core-saved-objects-server-internal, apm, savedObjectsTaggingOss, savedObjectsManagement, cases, lists, upgradeAssistant, security, encryptedSavedObjects, lens, alerting, observability, @kbn/core-ui-settings-server-internal, data | - | | | alerting, discover, securitySolution | - | | | stackAlerts, alerting, securitySolution, inputControlVis | - | | | actions, alerting | - | -| | @kbn/core-saved-objects-common, advancedSettings, triggersActionsUi, visualizations, alerting | - | -| | @kbn/core-saved-objects-common, savedObjects, embeddable, visualizations, dashboard, fleet, infra, canvas, graph, ml, alerting, @kbn/core-saved-objects-server-internal | - | -| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-api-server, savedObjects, savedObjectsManagement, visualizations, savedObjectsTagging, lens, fleet, graph, dashboard, savedObjectsTaggingOss, @kbn/core-saved-objects-server, kibanaUtils, expressions, dataViews, data, embeddable, controls, uiActionsEnhanced, maps, canvas, cases, dashboardEnhanced, globalSearchProviders, alerting, @kbn/core-saved-objects-api-server-internal, @kbn/core-saved-objects-import-export-server-internal | - | -| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-server, actions, alerting, canvas, enterpriseSearch, securitySolution, taskManager, dashboard, savedSearch | - | +| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-server, actions, alerting, canvas, enterpriseSearch, securitySolution, taskManager, dashboard, savedSearch, @kbn/core-saved-objects-server-internal | - | | | @kbn/core-saved-objects-migration-server-internal, actions, dataViews, data, alerting, savedObjectsTagging, canvas, lens, cases, graph, lists, maps, securitySolution, dashboard, savedSearch, visualizations, @kbn/core-test-helpers-so-type-serializer | - | -| | core, advancedSettings, triggersActionsUi, visualizations, alerting | - | -| | core, savedObjects, embeddable, visualizations, dashboard, fleet, infra, canvas, graph, ml, alerting, @kbn/core-saved-objects-server-internal, @kbn/core-saved-objects-common, actions, enterpriseSearch, securitySolution, taskManager, savedSearch | - | -| | @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-api-server, core, savedObjects, savedObjectsManagement, visualizations, savedObjectsTagging, lens, fleet, graph, dashboard, savedObjectsTaggingOss, @kbn/core-saved-objects-server, kibanaUtils, expressions, dataViews, data, embeddable, controls, uiActionsEnhanced, maps, canvas, cases, dashboardEnhanced, globalSearchProviders, alerting, @kbn/core-saved-objects-api-server-internal, @kbn/core-saved-objects-import-export-server-internal | - | | | @kbn/core-saved-objects-migration-server-internal, actions, dataViews, data, alerting, savedObjectsTagging, canvas, lens, cases, graph, lists, maps, securitySolution, dashboard, savedSearch, visualizations, @kbn/core-test-helpers-so-type-serializer | - | +| | @kbn/core-saved-objects-common, core, actions, alerting, canvas, enterpriseSearch, securitySolution, taskManager, dashboard, savedSearch, @kbn/core-saved-objects-server-internal, savedObjects, embeddable, visualizations, fleet, infra, graph, ml | - | | | discover, monitoring | - | +| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal, @kbn/core-saved-objects-api-server, core, home, dataViews, discover, savedObjectsTagging, savedObjectsFinder, fleet, canvas, osquery, securitySolution, synthetics, savedObjects, @kbn/core-saved-objects-browser-mocks, @kbn/core-saved-objects-server, @kbn/core-saved-objects-import-export-server-internal, apm, savedObjectsTaggingOss, savedObjectsManagement, cases, lists, upgradeAssistant, @kbn/core-ui-settings-server-internal, data, dashboard | - | +| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal, @kbn/core-saved-objects-api-server, core, home, dataViews, discover, savedObjectsTagging, savedObjectsFinder, fleet, canvas, osquery, securitySolution, synthetics, savedObjects, @kbn/core-saved-objects-browser-mocks, @kbn/core-saved-objects-server, @kbn/core-saved-objects-import-export-server-internal, apm, savedObjectsTaggingOss, savedObjectsManagement, cases, lists, upgradeAssistant, @kbn/core-ui-settings-server-internal, data | - | | | @kbn/es-query, securitySolution, timelines, lists, threatIntelligence, dataViews, unifiedSearch, triggersActionsUi, savedObjectsManagement, controls, unifiedFieldList, lens, aiops, ml, infra, visTypeTimeseries, apm, observability, dataVisualizer, fleet, canvas, graph, stackAlerts, synthetics, transform, upgradeAssistant, ux, maps, dataViewManagement, inputControlVis, visDefaultEditor, presentationUtil, visTypeTimelion, visTypeVega, discover, data | - | | | discover | - | | | @kbn/es-query, securitySolution, timelines, lists, threatIntelligence, dataViews, unifiedSearch, triggersActionsUi, savedObjectsManagement, controls, unifiedFieldList, lens, aiops, ml, infra, visTypeTimeseries, apm, observability, dataVisualizer, fleet, canvas, graph, stackAlerts, synthetics, transform, upgradeAssistant, ux, maps, dataViewManagement, inputControlVis, visDefaultEditor, presentationUtil, visTypeTimelion, visTypeVega, discover, data | - | @@ -68,7 +63,10 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, presentationUtil, savedSearch, visualizations, dashboard, lens, savedObjectsFinder, cases, maps, ml, infra, cloudSecurityPosture, dashboardEnhanced, graph, securitySolution, synthetics, @kbn/core-saved-objects-browser-internal | - | | | @kbn/core-saved-objects-browser-internal, core, dataViews, savedObjects, embeddable, presentationUtil, visualizations, dashboard, lens, savedObjectsFinder, aiops, ml, cases, maps, dataVisualizer, infra, fleet, cloudSecurityPosture, dashboardEnhanced, graph, synthetics, securitySolution, @kbn/core-saved-objects-browser-mocks | - | | | dashboard, dataVisualizer, stackAlerts, expressionPartitionVis | - | +| | @kbn/core-saved-objects-common, advancedSettings, triggersActionsUi, visualizations | - | +| | @kbn/core-saved-objects-common, savedObjects, embeddable, visualizations, dashboard, fleet, infra, canvas, graph, ml | - | | | @kbn/core-saved-objects-common | - | +| | @kbn/core-saved-objects-common, @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-api-server, savedObjects, savedObjectsManagement, visualizations, savedObjectsTagging, lens, fleet, graph, dashboard, savedObjectsTaggingOss, kibanaUtils, expressions, dataViews, data, embeddable, controls, uiActionsEnhanced, maps, canvas, cases, dashboardEnhanced, globalSearchProviders, infra | - | | | @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal, dataViews, savedObjects, visualizations, infra | - | | | @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal | - | | | @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal, infra | - | @@ -81,6 +79,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | @kbn/core-saved-objects-api-browser | - | | | @kbn/core-saved-objects-api-browser | - | | | @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-browser-internal | - | +| | @kbn/core-saved-objects-api-browser, @kbn/core-saved-objects-api-server, core, savedObjects, savedObjectsManagement, visualizations, savedObjectsTagging, lens, fleet, graph, dashboard, savedObjectsTaggingOss, kibanaUtils, expressions, dataViews, data, embeddable, controls, uiActionsEnhanced, maps, canvas, cases, dashboardEnhanced, globalSearchProviders, infra | - | | | @kbn/core-saved-objects-browser, @kbn/core-lifecycle-browser, @kbn/core-saved-objects-browser-internal, savedObjects, savedSearch, visualizations, dashboard, lens, savedObjectsFinder, observability, canvas, transform, @kbn/core-saved-objects-browser-mocks | - | | | @kbn/core-saved-objects-browser-internal, @kbn/core-saved-objects-browser-mocks, dataViews, savedObjects, savedSearch, visualizations, dashboard, lens, maps, infra, graph, synthetics | - | | | @kbn/core-saved-objects-browser-mocks, home, @kbn/core-saved-objects-browser-internal | - | @@ -124,6 +123,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | @kbn/core-lifecycle-browser-mocks, core, ml, dashboard, dataViews, savedSearch, @kbn/core-plugins-browser-internal | - | | | core, lens, savedObjects, visualizations | - | | | core | - | +| | core, advancedSettings, triggersActionsUi, visualizations | - | | | home, canvas, osquery | - | | | home, data, esUiShared, spaces, savedObjectsManagement, fleet, observability, ml, apm, indexLifecycleManagement, synthetics, upgradeAssistant, ux, kibanaOverview | - | | | dataViews, maps | - | @@ -150,8 +150,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | spaces, savedObjectsManagement | - | | | spaces, savedObjectsManagement | - | | | spaces, savedObjectsManagement | - | -| | encryptedSavedObjects | - | -| | encryptedSavedObjects | - | | | visTypeTimeseries, graph, dataViewManagement | - | | | unifiedSearch | - | | | unifiedSearch | - | @@ -159,6 +157,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | dataViewManagement | - | | | dataViewManagement | - | | | enterpriseSearch | - | +| | encryptedSavedObjects | - | +| | encryptedSavedObjects | - | | | @kbn/core-elasticsearch-server-internal, @kbn/core-plugins-server-internal, console | - | | | @kbn/core-elasticsearch-server-internal, @kbn/core-plugins-server-internal, console | - | | | @kbn/core-plugins-server-internal | - | diff --git a/api_docs/deprecations_by_plugin.mdx b/api_docs/deprecations_by_plugin.mdx index 8d4fc0def4565..ac9265cc915ad 100644 --- a/api_docs/deprecations_by_plugin.mdx +++ b/api_docs/deprecations_by_plugin.mdx @@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsByPlugin slug: /kibana-dev-docs/api-meta/deprecated-api-list-by-plugin title: Deprecated API usage by plugin description: A list of deprecated APIs, which plugins are still referencing them, and when they need to be removed by. -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana'] --- @@ -134,17 +134,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] -## @kbn/core-saved-objects-api-server-internal - -| Deprecated API | Reference location(s) | Remove By | -| ---------------|-----------|-----------| -| | [saved_objects_client.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts#:~:text=SavedObject), [saved_objects_client.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts#:~:text=SavedObject), [internal_utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts#:~:text=SavedObject), [internal_utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts#:~:text=SavedObject), [internal_bulk_resolve.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts#:~:text=SavedObject), [internal_bulk_resolve.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts#:~:text=SavedObject), [collect_multi_namespace_references.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts#:~:text=SavedObject), [collect_multi_namespace_references.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts#:~:text=SavedObject), [collect_multi_namespace_references.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts#:~:text=SavedObject), [update_objects_spaces.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts#:~:text=SavedObject)+ 80 more | - | -| | [saved_objects_client.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts#:~:text=SavedObject), [saved_objects_client.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts#:~:text=SavedObject), [internal_utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts#:~:text=SavedObject), [internal_utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts#:~:text=SavedObject), [internal_bulk_resolve.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts#:~:text=SavedObject), [internal_bulk_resolve.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts#:~:text=SavedObject), [collect_multi_namespace_references.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts#:~:text=SavedObject), [collect_multi_namespace_references.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts#:~:text=SavedObject), [collect_multi_namespace_references.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts#:~:text=SavedObject), [update_objects_spaces.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts#:~:text=SavedObject)+ 125 more | - | -| | [repository.test.common.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts#:~:text=SavedObjectReference), [repository.test.common.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference) | - | -| | [repository.test.common.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts#:~:text=SavedObjectReference), [repository.test.common.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference), [repository.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts#:~:text=SavedObjectReference) | - | - - - ## @kbn/core-saved-objects-browser | Deprecated API | Reference location(s) | Remove By | @@ -277,10 +266,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [check_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts#:~:text=SavedObject), [check_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts#:~:text=SavedObject), [check_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject)+ 262 more | - | -| | [check_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts#:~:text=SavedObject), [check_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts#:~:text=SavedObject), [check_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject), [check_origin_conflicts.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts#:~:text=SavedObject)+ 398 more | - | -| | [resolve_import_errors.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts#:~:text=SavedObjectReference), [resolve_import_errors.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts#:~:text=SavedObjectReference), [check_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts#:~:text=SavedObjectReference), [check_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts#:~:text=SavedObjectReference), [check_origin_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts#:~:text=SavedObjectReference), [check_origin_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts#:~:text=SavedObjectReference) | - | -| | [resolve_import_errors.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts#:~:text=SavedObjectReference), [resolve_import_errors.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts#:~:text=SavedObjectReference), [check_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts#:~:text=SavedObjectReference), [check_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts#:~:text=SavedObjectReference), [check_origin_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts#:~:text=SavedObjectReference), [check_origin_conflicts.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts#:~:text=SavedObjectReference) | - | +| | [errors.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts#:~:text=SavedObject), [errors.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts#:~:text=SavedObject), [regenerate_ids.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts#:~:text=SavedObject), [regenerate_ids.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject)+ 18 more | - | +| | [errors.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts#:~:text=SavedObject), [errors.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts#:~:text=SavedObject), [regenerate_ids.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts#:~:text=SavedObject), [regenerate_ids.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject), [apply_export_transforms.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts#:~:text=SavedObject)+ 32 more | - | @@ -297,11 +284,9 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [encryption.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts#:~:text=SavedObject), [encryption.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [import.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/import.ts#:~:text=SavedObject)+ 24 more | - | -| | [encryption.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts#:~:text=SavedObject), [encryption.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [export.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/export.ts#:~:text=SavedObject), [import.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/import.ts#:~:text=SavedObject)+ 41 more | - | -| | [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference), [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference), [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference), [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference) | - | +| | [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject) | - | +| | [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject), [security.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts#:~:text=SavedObject) | - | | | [index.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/index.ts#:~:text=SavedObjectAttributes) | - | -| | [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference), [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference), [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference), [serialization.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server/src/serialization.ts#:~:text=SavedObjectReference) | - | @@ -309,10 +294,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts#:~:text=SavedObject), [collect_references_deep.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts#:~:text=SavedObject), [collect_references_deep.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts#:~:text=SavedObject), [collect_references_deep.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts#:~:text=SavedObject), [import_dashboards.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts#:~:text=SavedObject), [import_dashboards.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts#:~:text=SavedObject), [import.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts#:~:text=SavedObject), [import.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts#:~:text=SavedObject), [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObject)+ 16 more | - | -| | [utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts#:~:text=SavedObject), [collect_references_deep.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts#:~:text=SavedObject), [collect_references_deep.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts#:~:text=SavedObject), [collect_references_deep.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts#:~:text=SavedObject), [import_dashboards.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts#:~:text=SavedObject), [import_dashboards.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts#:~:text=SavedObject), [import.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts#:~:text=SavedObject), [import.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts#:~:text=SavedObject), [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObject)+ 29 more | - | -| | [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes), [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes) | - | -| | [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes), [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes) | - | +| | [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes), [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes) | - | +| | [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes), [collect_references_deep.test.ts](https://github.com/elastic/kibana/tree/main/packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts#:~:text=SavedObjectAttributes) | - | @@ -423,22 +406,15 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | ---------------|-----------|-----------| | | [wrap_search_source_client.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.ts#:~:text=create) | - | | | [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch) | - | -| | [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject)+ 4 more | - | -| | [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [bulk_disable.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject), [test_helpers.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts#:~:text=SavedObject)+ 11 more | - | | | [wrap_search_source_client.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.ts#:~:text=create) | - | | | [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch), [wrap_search_source_client.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/wrap_search_source_client.test.ts#:~:text=fetch) | - | | | [plugin.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/plugin.test.ts#:~:text=getKibanaFeatures) | 8.8.0 | | | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/plugin.ts#:~:text=license%24), [license_state.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/license_state.test.ts#:~:text=license%24), [license_state.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/lib/license_state.test.ts#:~:text=license%24) | 8.8.0 | | | [task.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/usage/task.ts#:~:text=index) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectAttribute) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts#:~:text=SavedObjectAttributes), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts#:~:text=SavedObjectAttributes), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttributes), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttributes) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference) | - | -| | [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [migrations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/geo_containment/migrations.ts#:~:text=SavedObjectAttributes), [migrations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/geo_containment/migrations.ts#:~:text=SavedObjectAttributes)+ 10 more | - | +| | [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [migrations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/geo_containment/migrations.ts#:~:text=SavedObjectAttributes), [migrations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/geo_containment/migrations.ts#:~:text=SavedObjectAttributes)+ 14 more | - | | | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/index.ts#:~:text=convertToMultiNamespaceTypeVersion) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectAttribute), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectAttribute) | - | -| | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts#:~:text=SavedObjectAttributes), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts#:~:text=SavedObjectAttributes), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttributes), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes)+ 14 more | - | -| | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts#:~:text=SavedObjectReference) | - | | | [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/index.ts#:~:text=convertToMultiNamespaceTypeVersion) | - | +| | [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [rule.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/common/rule.ts#:~:text=SavedObjectAttributes), [migrations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/geo_containment/migrations.ts#:~:text=SavedObjectAttributes), [migrations.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/alerting/server/saved_objects/geo_containment/migrations.ts#:~:text=SavedObjectAttributes)+ 14 more | - | @@ -502,8 +478,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject)+ 42 more | - | -| | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/utils.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject), [authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/authorization/authorization.ts#:~:text=SavedObject)+ 68 more | - | +| | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [find.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/operations/find.ts#:~:text=SavedObject), [find.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/operations/find.ts#:~:text=SavedObject), [find.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/operations/find.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject)+ 22 more | - | +| | [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [so_references.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/so_references.ts#:~:text=SavedObject), [find.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/operations/find.ts#:~:text=SavedObject), [find.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/operations/find.ts#:~:text=SavedObject), [find.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/operations/find.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject), [test_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/server/services/user_actions/test_utils.ts#:~:text=SavedObject)+ 38 more | - | | | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=find) | - | | | [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject), [saved_objects_finder.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/public/components/markdown_editor/plugins/lens/saved_objects_finder.tsx#:~:text=SimpleSavedObject)+ 1 more | - | | | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/cases/common/ui/types.ts#:~:text=ResolvedSimpleSavedObject) | - | @@ -820,8 +796,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject) | - | -| | [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject), [saved_objects_encryption_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts#:~:text=SavedObject) | - | | | [encryption_key_rotation_service.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/crypto/encryption_key_rotation_service.ts#:~:text=authc), [index.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/saved_objects/index.ts#:~:text=authc) | - | | | [create_migration.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts#:~:text=convertToMultiNamespaceTypeVersion), [create_migration.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts#:~:text=convertToMultiNamespaceTypeVersion) | - | | | [create_migration.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts#:~:text=convertToMultiNamespaceTypeVersion), [create_migration.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/encrypted_saved_objects/server/create_migration.ts#:~:text=convertToMultiNamespaceTypeVersion) | - | @@ -877,8 +851,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject)+ 4 more | - | -| | [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [action.mock.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/server/services/agents/action.mock.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject)+ 11 more | - | +| | [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject) | - | +| | [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject), [epm.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/common/types/models/epm.ts#:~:text=SavedObject) | - | | | [filter_dataset.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx#:~:text=title), [filter_log_level.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx#:~:text=title), [query_bar.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx#:~:text=title), [filter_dataset.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx#:~:text=title), [filter_log_level.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx#:~:text=title), [query_bar.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx#:~:text=title) | - | | | [filter_dataset.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx#:~:text=title), [filter_log_level.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx#:~:text=title), [query_bar.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx#:~:text=title), [filter_dataset.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx#:~:text=title), [filter_log_level.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx#:~:text=title), [query_bar.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx#:~:text=title) | - | | | [filter_dataset.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_dataset.tsx#:~:text=title), [filter_log_level.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/filter_log_level.tsx#:~:text=title), [query_bar.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_details_page/components/agent_logs/query_bar.tsx#:~:text=title) | - | @@ -1002,6 +976,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectsCreateOptions), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectsCreateOptions), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectsCreateOptions), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectsCreateOptions) | - | | | [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectsBatchResponse), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectsBatchResponse) | - | | | [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectAttributes), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectAttributes), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectAttributes), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectAttributes), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectAttributes), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=SavedObjectAttributes), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=SavedObjectAttributes), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectAttributes), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectAttributes), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectAttributes)+ 2 more | - | +| | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/types.ts#:~:text=SavedObjectReference), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/types.ts#:~:text=SavedObjectReference), [cpu.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts#:~:text=SavedObjectReference), [cpu.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts#:~:text=SavedObjectReference), [load.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts#:~:text=SavedObjectReference), [load.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts#:~:text=SavedObjectReference), [memory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts#:~:text=SavedObjectReference), [memory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts#:~:text=SavedObjectReference), [rx.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts#:~:text=SavedObjectReference), [rx.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts#:~:text=SavedObjectReference)+ 6 more | - | | | [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=savedObjects), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=savedObjects), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=savedObjects), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=savedObjects), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=savedObjects), [use_delete_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_delete_saved_object.tsx#:~:text=savedObjects), [use_delete_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_delete_saved_object.tsx#:~:text=savedObjects), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=savedObjects), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=savedObjects), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=savedObjects)+ 1 more | - | | | [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=savedObjects), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=savedObjects), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=savedObjects), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=savedObjects), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=savedObjects), [use_delete_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_delete_saved_object.tsx#:~:text=savedObjects), [use_delete_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_delete_saved_object.tsx#:~:text=savedObjects), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=savedObjects), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=savedObjects), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=savedObjects)+ 1 more | - | | | [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=create) | - | @@ -1013,6 +988,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectsCreateOptions), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectsCreateOptions), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectsCreateOptions), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectsCreateOptions) | - | | | [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectsBatchResponse), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectsBatchResponse) | - | | | [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectAttributes), [use_find_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_find_saved_object.tsx#:~:text=SavedObjectAttributes), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectAttributes), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectAttributes), [use_create_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_create_saved_object.tsx#:~:text=SavedObjectAttributes), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=SavedObjectAttributes), [use_get_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_get_saved_object.tsx#:~:text=SavedObjectAttributes), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectAttributes), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectAttributes), [use_update_saved_object.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/hooks/use_update_saved_object.tsx#:~:text=SavedObjectAttributes)+ 2 more | - | +| | [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/types.ts#:~:text=SavedObjectReference), [types.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/types.ts#:~:text=SavedObjectReference), [cpu.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts#:~:text=SavedObjectReference), [cpu.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts#:~:text=SavedObjectReference), [load.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts#:~:text=SavedObjectReference), [load.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts#:~:text=SavedObjectReference), [memory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts#:~:text=SavedObjectReference), [memory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts#:~:text=SavedObjectReference), [rx.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts#:~:text=SavedObjectReference), [rx.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts#:~:text=SavedObjectReference)+ 6 more | - | @@ -1052,8 +1028,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject) | - | -| | [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject), [make_lens_embeddable_factory.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts#:~:text=SavedObject) | - | | | [loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/data_views_service/loader.ts#:~:text=title), [lens_top_nav.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx#:~:text=title), [loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/data_views_service/loader.ts#:~:text=title), [lens_top_nav.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx#:~:text=title) | - | | | [loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/data_views_service/loader.ts#:~:text=title), [lens_top_nav.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx#:~:text=title), [loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/data_views_service/loader.ts#:~:text=title), [lens_top_nav.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx#:~:text=title) | - | | | [loader.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/data_views_service/loader.ts#:~:text=title), [lens_top_nav.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx#:~:text=title) | - | @@ -1208,8 +1182,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject) | - | -| | [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject), [slo.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/server/services/slo/fixtures/slo.ts#:~:text=SavedObject) | - | | | [observability_data_views.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts#:~:text=title), [report_definition_field.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/report_definition_field.tsx#:~:text=title), [use_filter_values.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/use_filter_values.ts#:~:text=title), [filter_value_btn.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx#:~:text=title), [sample_attribute.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute.ts#:~:text=title), [sample_attribute_kpi.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_kpi.ts#:~:text=title), [sample_attribute_with_reference_lines.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_with_reference_lines.ts#:~:text=title), [test_formula_metric_attribute.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/test_formula_metric_attribute.ts#:~:text=title), [single_metric_attributes.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts#:~:text=title), [single_metric_attributes.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts#:~:text=title)+ 14 more | - | | | [observability_data_views.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts#:~:text=title), [report_definition_field.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/report_definition_field.tsx#:~:text=title), [use_filter_values.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/use_filter_values.ts#:~:text=title), [filter_value_btn.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx#:~:text=title), [sample_attribute.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute.ts#:~:text=title), [sample_attribute_kpi.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_kpi.ts#:~:text=title), [sample_attribute_with_reference_lines.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_with_reference_lines.ts#:~:text=title), [test_formula_metric_attribute.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/test_formula_metric_attribute.ts#:~:text=title), [single_metric_attributes.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts#:~:text=title), [single_metric_attributes.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts#:~:text=title)+ 14 more | - | | | [observability_data_views.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/utils/observability_data_views/observability_data_views.ts#:~:text=title), [report_definition_field.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/report_definition_field.tsx#:~:text=title), [use_filter_values.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/use_filter_values.ts#:~:text=title), [filter_value_btn.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/series_editor/columns/filter_value_btn.tsx#:~:text=title), [sample_attribute.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute.ts#:~:text=title), [sample_attribute_kpi.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_kpi.ts#:~:text=title), [sample_attribute_with_reference_lines.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/sample_attribute_with_reference_lines.ts#:~:text=title), [test_formula_metric_attribute.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/test_data/test_formula_metric_attribute.ts#:~:text=title), [single_metric_attributes.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts#:~:text=title), [single_metric_attributes.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/observability/public/components/shared/exploratory_view/configurations/lens_attributes/single_metric_attributes.test.ts#:~:text=title)+ 2 more | - | @@ -1415,8 +1387,6 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject) | - | -| | [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject), [saved_objects_security_extension.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts#:~:text=SavedObject) | - | | | [elasticsearch_role.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts#:~:text=disabled), [role_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/lib/role_utils.ts#:~:text=disabled), [role_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/lib/role_utils.ts#:~:text=disabled), [primary_feature_privilege.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/management/roles/model/primary_feature_privilege.ts#:~:text=disabled), [elasticsearch_role.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts#:~:text=disabled), [kibana_features.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_features.ts#:~:text=disabled), [put.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts#:~:text=disabled), [put_payload.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts#:~:text=disabled), [put_payload.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts#:~:text=disabled) | 8.8.0 | | | [disable_ui_capabilities.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts#:~:text=requiredRoles) | 8.8.0 @@ -1526,8 +1496,8 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject)+ 24 more | - | -| | [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject)+ 41 more | - | +| | [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject)+ 20 more | - | +| | [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [monitor_detail_flyout.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/overview/overview/monitor_detail_flyout.tsx#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [api.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject), [effects.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts#:~:text=SavedObject)+ 35 more | - | | | [filter_group.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx#:~:text=title), [filters_expression_select.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx#:~:text=title), [filter_group.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx#:~:text=title), [filters_expression_select.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx#:~:text=title) | - | | | [filter_group.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx#:~:text=title), [filters_expression_select.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx#:~:text=title), [filter_group.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx#:~:text=title), [filters_expression_select.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx#:~:text=title) | - | | | [filter_group.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/filter_group/filter_group.tsx#:~:text=title), [filters_expression_select.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/synthetics/public/legacy_uptime/components/overview/alerts/monitor_expressions/filters_expression_select.tsx#:~:text=title) | - | @@ -1622,9 +1592,9 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ | Deprecated API | Reference location(s) | Remove By | | ---------------|-----------|-----------| -| | [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title)+ 6 more | - | -| | [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title)+ 6 more | - | -| | [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title) | - | +| | [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title)+ 2 more | - | +| | [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title)+ 2 more | - | +| | [load_field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/services/field_stats/load_field_stats.ts#:~:text=title), [field_existing_utils.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/common/utils/field_existing_utils.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [use_existing_fields.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/public/hooks/use_existing_fields.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title), [field_stats.ts](https://github.com/elastic/kibana/tree/main/src/plugins/unified_field_list/server/routes/field_stats.ts#:~:text=title) | - | diff --git a/api_docs/deprecations_by_team.mdx b/api_docs/deprecations_by_team.mdx index 3f35753b21bd7..e5f4313fbdb93 100644 --- a/api_docs/deprecations_by_team.mdx +++ b/api_docs/deprecations_by_team.mdx @@ -7,7 +7,7 @@ id: kibDevDocsDeprecationsDueByTeam slug: /kibana-dev-docs/api-meta/deprecations-due-by-team title: Deprecated APIs due to be removed, by team description: Lists the teams that are referencing deprecated APIs with a remove by date. -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana'] --- @@ -103,6 +103,8 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Plugin | Deprecated API | Reference location(s) | Remove By | | --------|-------|-----------|-----------| +| spaces | | [on_post_auth_interceptor.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.ts#:~:text=getKibanaFeatures), [spaces_usage_collector.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts#:~:text=getKibanaFeatures), [on_post_auth_interceptor.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/lib/request_interceptors/on_post_auth_interceptor.test.ts#:~:text=getKibanaFeatures), [app_authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/app_authorization.ts#:~:text=getKibanaFeatures), [privileges.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.ts#:~:text=getKibanaFeatures), [authorization_service.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/authorization_service.tsx#:~:text=getKibanaFeatures), [app_authorization.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/app_authorization.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures)+ 18 more | 8.8.0 | +| spaces | | [spaces_usage_collector.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/plugin.ts#:~:text=license%24), [spaces_usage_collector.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.test.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/plugin.ts#:~:text=license%24) | 8.8.0 | | security | | [elasticsearch_role.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.ts#:~:text=disabled), [role_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/lib/role_utils.ts#:~:text=disabled), [role_utils.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/lib/role_utils.ts#:~:text=disabled), [primary_feature_privilege.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/management/roles/model/primary_feature_privilege.ts#:~:text=disabled), [elasticsearch_role.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/roles/elasticsearch_role.test.ts#:~:text=disabled), [kibana_features.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/management/roles/__fixtures__/kibana_features.ts#:~:text=disabled), [put.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/routes/authorization/roles/put.test.ts#:~:text=disabled), [put_payload.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts#:~:text=disabled), [put_payload.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/routes/authorization/roles/model/put_payload.test.ts#:~:text=disabled) | 8.8.0 | | security | | [disable_ui_capabilities.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/disable_ui_capabilities.ts#:~:text=requiredRoles) | 8.8.0 @@ -114,12 +116,10 @@ migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/ This is relied on by the reporting feature, and should be removed once reporting migrates to using the Kibana Privilege model: https://github.com/elastic/kibana/issues/19914 | -| security | | [app_authorization.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/app_authorization.ts#:~:text=getKibanaFeatures), [privileges.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.ts#:~:text=getKibanaFeatures), [authorization_service.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/authorization_service.tsx#:~:text=getKibanaFeatures), [app_authorization.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/app_authorization.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures), [privileges.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/privileges/privileges.test.ts#:~:text=getKibanaFeatures)+ 18 more | 8.8.0 | | security | | [authorization_service.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/authorization/authorization_service.tsx#:~:text=getElasticsearchFeatures) | 8.8.0 | | security | | [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode), [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode), [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode) | 8.8.0 | | security | | [plugin.tsx](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/plugin.tsx#:~:text=license%24) | 8.8.0 | | security | | [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode), [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode), [license_service.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/common/licensing/license_service.test.ts#:~:text=mode) | 8.8.0 | -| security | | [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/server/plugin.ts#:~:text=license%24), [spaces_usage_collector.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/plugin.ts#:~:text=license%24), [plugin.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/plugin.ts#:~:text=license%24), [spaces_usage_collector.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/spaces/server/usage_collection/spaces_usage_collector.test.ts#:~:text=license%24) | 8.8.0 | | security | | [logout_app.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts#:~:text=appBasePath) | 8.8.0 | | security | | [logout_app.test.ts](https://github.com/elastic/kibana/tree/main/x-pack/plugins/security/public/authentication/logout/logout_app.test.ts#:~:text=appBasePath) | 8.8.0 | diff --git a/api_docs/dev_tools.mdx b/api_docs/dev_tools.mdx index 1c6e416374c86..0b4a3fbaa2689 100644 --- a/api_docs/dev_tools.mdx +++ b/api_docs/dev_tools.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/devTools title: "devTools" image: https://source.unsplash.com/400x175/?github description: API docs for the devTools plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'devTools'] --- import devToolsObj from './dev_tools.devdocs.json'; diff --git a/api_docs/discover.mdx b/api_docs/discover.mdx index a0ac52e82c99d..64b6deaef0840 100644 --- a/api_docs/discover.mdx +++ b/api_docs/discover.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discover title: "discover" image: https://source.unsplash.com/400x175/?github description: API docs for the discover plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discover'] --- import discoverObj from './discover.devdocs.json'; diff --git a/api_docs/discover_enhanced.mdx b/api_docs/discover_enhanced.mdx index bae3c41163636..64db5c189cc7e 100644 --- a/api_docs/discover_enhanced.mdx +++ b/api_docs/discover_enhanced.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/discoverEnhanced title: "discoverEnhanced" image: https://source.unsplash.com/400x175/?github description: API docs for the discoverEnhanced plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'discoverEnhanced'] --- import discoverEnhancedObj from './discover_enhanced.devdocs.json'; diff --git a/api_docs/embeddable.devdocs.json b/api_docs/embeddable.devdocs.json index a9b6f4421c811..a01a2e94f470d 100644 --- a/api_docs/embeddable.devdocs.json +++ b/api_docs/embeddable.devdocs.json @@ -5117,6 +5117,134 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "embeddable", + "id": "def-public.isMultiValueClickTriggerContext", + "type": "Function", + "tags": [], + "label": "isMultiValueClickTriggerContext", + "description": [], + "signature": [ + "(context: ", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.ChartActionContext", + "text": "ChartActionContext" + }, + "<", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.IEmbeddable", + "text": "IEmbeddable" + }, + "<", + { + "pluginId": "embeddable", + "scope": "common", + "docId": "kibEmbeddablePluginApi", + "section": "def-common.EmbeddableInput", + "text": "EmbeddableInput" + }, + ", ", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.EmbeddableOutput", + "text": "EmbeddableOutput" + }, + ", any>>) => context is ", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.MultiValueClickContext", + "text": "MultiValueClickContext" + }, + "<", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.IEmbeddable", + "text": "IEmbeddable" + }, + "<", + { + "pluginId": "embeddable", + "scope": "common", + "docId": "kibEmbeddablePluginApi", + "section": "def-common.EmbeddableInput", + "text": "EmbeddableInput" + }, + ", ", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.EmbeddableOutput", + "text": "EmbeddableOutput" + }, + ", any>>" + ], + "path": "src/plugins/embeddable/public/lib/triggers/triggers.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "embeddable", + "id": "def-public.isMultiValueClickTriggerContext.$1", + "type": "CompoundType", + "tags": [], + "label": "context", + "description": [], + "signature": [ + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.ChartActionContext", + "text": "ChartActionContext" + }, + "<", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.IEmbeddable", + "text": "IEmbeddable" + }, + "<", + { + "pluginId": "embeddable", + "scope": "common", + "docId": "kibEmbeddablePluginApi", + "section": "def-common.EmbeddableInput", + "text": "EmbeddableInput" + }, + ", ", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.EmbeddableOutput", + "text": "EmbeddableOutput" + }, + ", any>>" + ], + "path": "src/plugins/embeddable/public/lib/triggers/triggers.ts", + "deprecated": false, + "trackAdoption": false, + "isRequired": true + } + ], + "returnComment": [], + "initialIsOpen": false + }, { "parentPluginId": "embeddable", "id": "def-public.isRangeSelectTriggerContext", @@ -9406,6 +9534,66 @@ ], "initialIsOpen": false }, + { + "parentPluginId": "embeddable", + "id": "def-public.MultiValueClickContext", + "type": "Interface", + "tags": [], + "label": "MultiValueClickContext", + "description": [], + "signature": [ + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.MultiValueClickContext", + "text": "MultiValueClickContext" + }, + "" + ], + "path": "src/plugins/embeddable/public/lib/triggers/triggers.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "embeddable", + "id": "def-public.MultiValueClickContext.embeddable", + "type": "Uncategorized", + "tags": [], + "label": "embeddable", + "description": [], + "signature": [ + "T | undefined" + ], + "path": "src/plugins/embeddable/public/lib/triggers/triggers.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "embeddable", + "id": "def-public.MultiValueClickContext.data", + "type": "Object", + "tags": [], + "label": "data", + "description": [], + "signature": [ + "{ data: { table: Pick<", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + }, + ", \"rows\" | \"columns\">; column: number; value: any[]; }; timeFieldName?: string | undefined; negate?: boolean | undefined; }" + ], + "path": "src/plugins/embeddable/public/lib/triggers/triggers.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, { "parentPluginId": "embeddable", "id": "def-public.OutputSpec", @@ -9949,6 +10137,14 @@ "text": "ValueClickContext" }, " | ", + { + "pluginId": "embeddable", + "scope": "public", + "docId": "kibEmbeddablePluginApi", + "section": "def-public.MultiValueClickContext", + "text": "MultiValueClickContext" + }, + " | ", { "pluginId": "embeddable", "scope": "public", @@ -10165,6 +10361,21 @@ "trackAdoption": false, "initialIsOpen": false }, + { + "parentPluginId": "embeddable", + "id": "def-public.MULTI_VALUE_CLICK_TRIGGER", + "type": "string", + "tags": [], + "label": "MULTI_VALUE_CLICK_TRIGGER", + "description": [], + "signature": [ + "\"MULTI_VALUE_CLICK_TRIGGER\"" + ], + "path": "src/plugins/embeddable/public/lib/triggers/triggers.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, { "parentPluginId": "embeddable", "id": "def-public.PANEL_BADGE_TRIGGER", diff --git a/api_docs/embeddable.mdx b/api_docs/embeddable.mdx index f07dde4281915..5bb2361324349 100644 --- a/api_docs/embeddable.mdx +++ b/api_docs/embeddable.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddable title: "embeddable" image: https://source.unsplash.com/400x175/?github description: API docs for the embeddable plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddable'] --- import embeddableObj from './embeddable.devdocs.json'; @@ -21,7 +21,7 @@ Contact [App Services](https://github.com/orgs/elastic/teams/kibana-app-services | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 522 | 8 | 421 | 4 | +| 528 | 8 | 427 | 4 | ## Client diff --git a/api_docs/embeddable_enhanced.mdx b/api_docs/embeddable_enhanced.mdx index 266aba87981f9..d3aae07721e10 100644 --- a/api_docs/embeddable_enhanced.mdx +++ b/api_docs/embeddable_enhanced.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/embeddableEnhanced title: "embeddableEnhanced" image: https://source.unsplash.com/400x175/?github description: API docs for the embeddableEnhanced plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'embeddableEnhanced'] --- import embeddableEnhancedObj from './embeddable_enhanced.devdocs.json'; diff --git a/api_docs/encrypted_saved_objects.mdx b/api_docs/encrypted_saved_objects.mdx index e1ed3d73e2249..296615100b3be 100644 --- a/api_docs/encrypted_saved_objects.mdx +++ b/api_docs/encrypted_saved_objects.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/encryptedSavedObjects title: "encryptedSavedObjects" image: https://source.unsplash.com/400x175/?github description: API docs for the encryptedSavedObjects plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'encryptedSavedObjects'] --- import encryptedSavedObjectsObj from './encrypted_saved_objects.devdocs.json'; diff --git a/api_docs/enterprise_search.mdx b/api_docs/enterprise_search.mdx index 7c27689e45745..1163109a13698 100644 --- a/api_docs/enterprise_search.mdx +++ b/api_docs/enterprise_search.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/enterpriseSearch title: "enterpriseSearch" image: https://source.unsplash.com/400x175/?github description: API docs for the enterpriseSearch plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'enterpriseSearch'] --- import enterpriseSearchObj from './enterprise_search.devdocs.json'; diff --git a/api_docs/es_ui_shared.mdx b/api_docs/es_ui_shared.mdx index e2635f2590748..76a3082cacce6 100644 --- a/api_docs/es_ui_shared.mdx +++ b/api_docs/es_ui_shared.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/esUiShared title: "esUiShared" image: https://source.unsplash.com/400x175/?github description: API docs for the esUiShared plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'esUiShared'] --- import esUiSharedObj from './es_ui_shared.devdocs.json'; diff --git a/api_docs/event_annotation.mdx b/api_docs/event_annotation.mdx index e6a8142bdc1db..bb984bc89f356 100644 --- a/api_docs/event_annotation.mdx +++ b/api_docs/event_annotation.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventAnnotation title: "eventAnnotation" image: https://source.unsplash.com/400x175/?github description: API docs for the eventAnnotation plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventAnnotation'] --- import eventAnnotationObj from './event_annotation.devdocs.json'; diff --git a/api_docs/event_log.mdx b/api_docs/event_log.mdx index af7f549d9b42b..e13091d660559 100644 --- a/api_docs/event_log.mdx +++ b/api_docs/event_log.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/eventLog title: "eventLog" image: https://source.unsplash.com/400x175/?github description: API docs for the eventLog plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'eventLog'] --- import eventLogObj from './event_log.devdocs.json'; diff --git a/api_docs/expression_error.mdx b/api_docs/expression_error.mdx index f0723f37b1ba6..e9ec1f55093fb 100644 --- a/api_docs/expression_error.mdx +++ b/api_docs/expression_error.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionError title: "expressionError" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionError plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionError'] --- import expressionErrorObj from './expression_error.devdocs.json'; diff --git a/api_docs/expression_gauge.mdx b/api_docs/expression_gauge.mdx index 8abc539fa23b5..26a2502a8109e 100644 --- a/api_docs/expression_gauge.mdx +++ b/api_docs/expression_gauge.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionGauge title: "expressionGauge" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionGauge plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionGauge'] --- import expressionGaugeObj from './expression_gauge.devdocs.json'; diff --git a/api_docs/expression_heatmap.mdx b/api_docs/expression_heatmap.mdx index 4496774bec1f4..cd1ccba6e9617 100644 --- a/api_docs/expression_heatmap.mdx +++ b/api_docs/expression_heatmap.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionHeatmap title: "expressionHeatmap" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionHeatmap plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionHeatmap'] --- import expressionHeatmapObj from './expression_heatmap.devdocs.json'; diff --git a/api_docs/expression_image.mdx b/api_docs/expression_image.mdx index 8adbc59645ee8..49432287d4f8c 100644 --- a/api_docs/expression_image.mdx +++ b/api_docs/expression_image.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionImage title: "expressionImage" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionImage plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionImage'] --- import expressionImageObj from './expression_image.devdocs.json'; diff --git a/api_docs/expression_legacy_metric_vis.mdx b/api_docs/expression_legacy_metric_vis.mdx index 119b574fe01ed..681975ee08acb 100644 --- a/api_docs/expression_legacy_metric_vis.mdx +++ b/api_docs/expression_legacy_metric_vis.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionLegacyMetricVis title: "expressionLegacyMetricVis" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionLegacyMetricVis plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionLegacyMetricVis'] --- import expressionLegacyMetricVisObj from './expression_legacy_metric_vis.devdocs.json'; diff --git a/api_docs/expression_metric.mdx b/api_docs/expression_metric.mdx index ab318080e0972..2a4c7da8dab20 100644 --- a/api_docs/expression_metric.mdx +++ b/api_docs/expression_metric.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetric title: "expressionMetric" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionMetric plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetric'] --- import expressionMetricObj from './expression_metric.devdocs.json'; diff --git a/api_docs/expression_metric_vis.mdx b/api_docs/expression_metric_vis.mdx index 7357397cb3986..47b710cc9ddbf 100644 --- a/api_docs/expression_metric_vis.mdx +++ b/api_docs/expression_metric_vis.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionMetricVis title: "expressionMetricVis" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionMetricVis plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionMetricVis'] --- import expressionMetricVisObj from './expression_metric_vis.devdocs.json'; diff --git a/api_docs/expression_partition_vis.mdx b/api_docs/expression_partition_vis.mdx index bb97b6edaae18..0fdeda8d9273a 100644 --- a/api_docs/expression_partition_vis.mdx +++ b/api_docs/expression_partition_vis.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionPartitionVis title: "expressionPartitionVis" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionPartitionVis plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionPartitionVis'] --- import expressionPartitionVisObj from './expression_partition_vis.devdocs.json'; diff --git a/api_docs/expression_repeat_image.mdx b/api_docs/expression_repeat_image.mdx index d330de9bdc629..b701763489290 100644 --- a/api_docs/expression_repeat_image.mdx +++ b/api_docs/expression_repeat_image.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRepeatImage title: "expressionRepeatImage" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionRepeatImage plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRepeatImage'] --- import expressionRepeatImageObj from './expression_repeat_image.devdocs.json'; diff --git a/api_docs/expression_reveal_image.mdx b/api_docs/expression_reveal_image.mdx index ee84104475197..3073d3dd83ce3 100644 --- a/api_docs/expression_reveal_image.mdx +++ b/api_docs/expression_reveal_image.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionRevealImage title: "expressionRevealImage" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionRevealImage plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionRevealImage'] --- import expressionRevealImageObj from './expression_reveal_image.devdocs.json'; diff --git a/api_docs/expression_shape.mdx b/api_docs/expression_shape.mdx index c621072c2a427..ad4cd745f9e28 100644 --- a/api_docs/expression_shape.mdx +++ b/api_docs/expression_shape.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionShape title: "expressionShape" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionShape plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionShape'] --- import expressionShapeObj from './expression_shape.devdocs.json'; diff --git a/api_docs/expression_tagcloud.mdx b/api_docs/expression_tagcloud.mdx index f2f7f1510f045..8b1341595fba7 100644 --- a/api_docs/expression_tagcloud.mdx +++ b/api_docs/expression_tagcloud.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionTagcloud title: "expressionTagcloud" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionTagcloud plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionTagcloud'] --- import expressionTagcloudObj from './expression_tagcloud.devdocs.json'; diff --git a/api_docs/expression_x_y.mdx b/api_docs/expression_x_y.mdx index 1479ea52011e8..cfa9548138dfd 100644 --- a/api_docs/expression_x_y.mdx +++ b/api_docs/expression_x_y.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressionXY title: "expressionXY" image: https://source.unsplash.com/400x175/?github description: API docs for the expressionXY plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressionXY'] --- import expressionXYObj from './expression_x_y.devdocs.json'; diff --git a/api_docs/expressions.mdx b/api_docs/expressions.mdx index f2ac9095384e8..fa5e0326f0f56 100644 --- a/api_docs/expressions.mdx +++ b/api_docs/expressions.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/expressions title: "expressions" image: https://source.unsplash.com/400x175/?github description: API docs for the expressions plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'expressions'] --- import expressionsObj from './expressions.devdocs.json'; diff --git a/api_docs/features.mdx b/api_docs/features.mdx index fc9fe4e811353..b5aef79eea0af 100644 --- a/api_docs/features.mdx +++ b/api_docs/features.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/features title: "features" image: https://source.unsplash.com/400x175/?github description: API docs for the features plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'features'] --- import featuresObj from './features.devdocs.json'; diff --git a/api_docs/field_formats.mdx b/api_docs/field_formats.mdx index ffa55135e6635..7d6df8d941cf5 100644 --- a/api_docs/field_formats.mdx +++ b/api_docs/field_formats.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fieldFormats title: "fieldFormats" image: https://source.unsplash.com/400x175/?github description: API docs for the fieldFormats plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fieldFormats'] --- import fieldFormatsObj from './field_formats.devdocs.json'; diff --git a/api_docs/file_upload.mdx b/api_docs/file_upload.mdx index 8c1a7ab843a44..1af193fa9bb3d 100644 --- a/api_docs/file_upload.mdx +++ b/api_docs/file_upload.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fileUpload title: "fileUpload" image: https://source.unsplash.com/400x175/?github description: API docs for the fileUpload plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fileUpload'] --- import fileUploadObj from './file_upload.devdocs.json'; diff --git a/api_docs/files.mdx b/api_docs/files.mdx index d39f390aba066..11cfc6904d73f 100644 --- a/api_docs/files.mdx +++ b/api_docs/files.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/files title: "files" image: https://source.unsplash.com/400x175/?github description: API docs for the files plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'files'] --- import filesObj from './files.devdocs.json'; diff --git a/api_docs/files_management.mdx b/api_docs/files_management.mdx index 9877ee0c165c6..96dc2d2e8060a 100644 --- a/api_docs/files_management.mdx +++ b/api_docs/files_management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/filesManagement title: "filesManagement" image: https://source.unsplash.com/400x175/?github description: API docs for the filesManagement plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'filesManagement'] --- import filesManagementObj from './files_management.devdocs.json'; diff --git a/api_docs/fleet.mdx b/api_docs/fleet.mdx index 7cb30073063ca..4a73d04cad66e 100644 --- a/api_docs/fleet.mdx +++ b/api_docs/fleet.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/fleet title: "fleet" image: https://source.unsplash.com/400x175/?github description: API docs for the fleet plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'fleet'] --- import fleetObj from './fleet.devdocs.json'; diff --git a/api_docs/global_search.mdx b/api_docs/global_search.mdx index fe32a1154699a..6a3e1d99f16dd 100644 --- a/api_docs/global_search.mdx +++ b/api_docs/global_search.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/globalSearch title: "globalSearch" image: https://source.unsplash.com/400x175/?github description: API docs for the globalSearch plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'globalSearch'] --- import globalSearchObj from './global_search.devdocs.json'; diff --git a/api_docs/guided_onboarding.mdx b/api_docs/guided_onboarding.mdx index 49e61881496a9..08806c5b89993 100644 --- a/api_docs/guided_onboarding.mdx +++ b/api_docs/guided_onboarding.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/guidedOnboarding title: "guidedOnboarding" image: https://source.unsplash.com/400x175/?github description: API docs for the guidedOnboarding plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'guidedOnboarding'] --- import guidedOnboardingObj from './guided_onboarding.devdocs.json'; diff --git a/api_docs/home.mdx b/api_docs/home.mdx index ed85f8fd99ca9..027a0e6f7655e 100644 --- a/api_docs/home.mdx +++ b/api_docs/home.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/home title: "home" image: https://source.unsplash.com/400x175/?github description: API docs for the home plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'home'] --- import homeObj from './home.devdocs.json'; diff --git a/api_docs/image_embeddable.mdx b/api_docs/image_embeddable.mdx index b1975215b7af4..4ba0d55b7a390 100644 --- a/api_docs/image_embeddable.mdx +++ b/api_docs/image_embeddable.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/imageEmbeddable title: "imageEmbeddable" image: https://source.unsplash.com/400x175/?github description: API docs for the imageEmbeddable plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'imageEmbeddable'] --- import imageEmbeddableObj from './image_embeddable.devdocs.json'; diff --git a/api_docs/index_lifecycle_management.mdx b/api_docs/index_lifecycle_management.mdx index 548addffb51d7..41f4cbe51eeb3 100644 --- a/api_docs/index_lifecycle_management.mdx +++ b/api_docs/index_lifecycle_management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexLifecycleManagement title: "indexLifecycleManagement" image: https://source.unsplash.com/400x175/?github description: API docs for the indexLifecycleManagement plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexLifecycleManagement'] --- import indexLifecycleManagementObj from './index_lifecycle_management.devdocs.json'; diff --git a/api_docs/index_management.mdx b/api_docs/index_management.mdx index 495d32c780f2b..de20b0de53299 100644 --- a/api_docs/index_management.mdx +++ b/api_docs/index_management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/indexManagement title: "indexManagement" image: https://source.unsplash.com/400x175/?github description: API docs for the indexManagement plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'indexManagement'] --- import indexManagementObj from './index_management.devdocs.json'; diff --git a/api_docs/infra.mdx b/api_docs/infra.mdx index 03c2e53777649..f40a6d7e27e6f 100644 --- a/api_docs/infra.mdx +++ b/api_docs/infra.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/infra title: "infra" image: https://source.unsplash.com/400x175/?github description: API docs for the infra plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'infra'] --- import infraObj from './infra.devdocs.json'; diff --git a/api_docs/inspector.mdx b/api_docs/inspector.mdx index 931f22ae3d371..5a5083c156dbb 100644 --- a/api_docs/inspector.mdx +++ b/api_docs/inspector.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/inspector title: "inspector" image: https://source.unsplash.com/400x175/?github description: API docs for the inspector plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'inspector'] --- import inspectorObj from './inspector.devdocs.json'; diff --git a/api_docs/interactive_setup.mdx b/api_docs/interactive_setup.mdx index 8c0ec2245391e..93cb2607c3953 100644 --- a/api_docs/interactive_setup.mdx +++ b/api_docs/interactive_setup.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/interactiveSetup title: "interactiveSetup" image: https://source.unsplash.com/400x175/?github description: API docs for the interactiveSetup plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'interactiveSetup'] --- import interactiveSetupObj from './interactive_setup.devdocs.json'; diff --git a/api_docs/kbn_ace.mdx b/api_docs/kbn_ace.mdx index be1c284eec447..2ac467b72520c 100644 --- a/api_docs/kbn_ace.mdx +++ b/api_docs/kbn_ace.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ace title: "@kbn/ace" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ace plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ace'] --- import kbnAceObj from './kbn_ace.devdocs.json'; diff --git a/api_docs/kbn_aiops_components.mdx b/api_docs/kbn_aiops_components.mdx index 08667f5ffd983..f4cf45f4f8848 100644 --- a/api_docs/kbn_aiops_components.mdx +++ b/api_docs/kbn_aiops_components.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-components title: "@kbn/aiops-components" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/aiops-components plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-components'] --- import kbnAiopsComponentsObj from './kbn_aiops_components.devdocs.json'; diff --git a/api_docs/kbn_aiops_utils.mdx b/api_docs/kbn_aiops_utils.mdx index 1d40055d1429f..a42ec1ed3d70b 100644 --- a/api_docs/kbn_aiops_utils.mdx +++ b/api_docs/kbn_aiops_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-aiops-utils title: "@kbn/aiops-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/aiops-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/aiops-utils'] --- import kbnAiopsUtilsObj from './kbn_aiops_utils.devdocs.json'; diff --git a/api_docs/kbn_alerts.mdx b/api_docs/kbn_alerts.mdx index ed85c5bdfaac0..2b223da4edf95 100644 --- a/api_docs/kbn_alerts.mdx +++ b/api_docs/kbn_alerts.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-alerts title: "@kbn/alerts" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/alerts plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/alerts'] --- import kbnAlertsObj from './kbn_alerts.devdocs.json'; diff --git a/api_docs/kbn_analytics.mdx b/api_docs/kbn_analytics.mdx index dcebd7dec001d..74d6d3dbeee12 100644 --- a/api_docs/kbn_analytics.mdx +++ b/api_docs/kbn_analytics.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics title: "@kbn/analytics" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics'] --- import kbnAnalyticsObj from './kbn_analytics.devdocs.json'; diff --git a/api_docs/kbn_analytics_client.mdx b/api_docs/kbn_analytics_client.mdx index 18f8ee0e44a0e..563a3f27e4dde 100644 --- a/api_docs/kbn_analytics_client.mdx +++ b/api_docs/kbn_analytics_client.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-client title: "@kbn/analytics-client" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics-client plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-client'] --- import kbnAnalyticsClientObj from './kbn_analytics_client.devdocs.json'; diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx index a2821ef8bca47..3005c4dea57ad 100644 --- a/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx +++ b/api_docs/kbn_analytics_shippers_elastic_v3_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-browser title: "@kbn/analytics-shippers-elastic-v3-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics-shippers-elastic-v3-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-browser'] --- import kbnAnalyticsShippersElasticV3BrowserObj from './kbn_analytics_shippers_elastic_v3_browser.devdocs.json'; diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx index 95b4d8f249599..676edd94c21ab 100644 --- a/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx +++ b/api_docs/kbn_analytics_shippers_elastic_v3_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-common title: "@kbn/analytics-shippers-elastic-v3-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics-shippers-elastic-v3-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-common'] --- import kbnAnalyticsShippersElasticV3CommonObj from './kbn_analytics_shippers_elastic_v3_common.devdocs.json'; diff --git a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx index 48c04d4834bea..7f8d48b5db660 100644 --- a/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx +++ b/api_docs/kbn_analytics_shippers_elastic_v3_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-elastic-v3-server title: "@kbn/analytics-shippers-elastic-v3-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics-shippers-elastic-v3-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-elastic-v3-server'] --- import kbnAnalyticsShippersElasticV3ServerObj from './kbn_analytics_shippers_elastic_v3_server.devdocs.json'; diff --git a/api_docs/kbn_analytics_shippers_fullstory.mdx b/api_docs/kbn_analytics_shippers_fullstory.mdx index 137bc7e8a99f5..eeb38287d30f2 100644 --- a/api_docs/kbn_analytics_shippers_fullstory.mdx +++ b/api_docs/kbn_analytics_shippers_fullstory.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-fullstory title: "@kbn/analytics-shippers-fullstory" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics-shippers-fullstory plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-fullstory'] --- import kbnAnalyticsShippersFullstoryObj from './kbn_analytics_shippers_fullstory.devdocs.json'; diff --git a/api_docs/kbn_analytics_shippers_gainsight.mdx b/api_docs/kbn_analytics_shippers_gainsight.mdx index f1c7ed247aea3..9c5006b1397ee 100644 --- a/api_docs/kbn_analytics_shippers_gainsight.mdx +++ b/api_docs/kbn_analytics_shippers_gainsight.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-analytics-shippers-gainsight title: "@kbn/analytics-shippers-gainsight" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/analytics-shippers-gainsight plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/analytics-shippers-gainsight'] --- import kbnAnalyticsShippersGainsightObj from './kbn_analytics_shippers_gainsight.devdocs.json'; diff --git a/api_docs/kbn_apm_config_loader.mdx b/api_docs/kbn_apm_config_loader.mdx index ab07da2337de9..6deb215850b9b 100644 --- a/api_docs/kbn_apm_config_loader.mdx +++ b/api_docs/kbn_apm_config_loader.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-config-loader title: "@kbn/apm-config-loader" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/apm-config-loader plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-config-loader'] --- import kbnApmConfigLoaderObj from './kbn_apm_config_loader.devdocs.json'; diff --git a/api_docs/kbn_apm_synthtrace.mdx b/api_docs/kbn_apm_synthtrace.mdx index 14689a5a10b27..186dd0e8f5440 100644 --- a/api_docs/kbn_apm_synthtrace.mdx +++ b/api_docs/kbn_apm_synthtrace.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace title: "@kbn/apm-synthtrace" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/apm-synthtrace plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace'] --- import kbnApmSynthtraceObj from './kbn_apm_synthtrace.devdocs.json'; diff --git a/api_docs/kbn_apm_synthtrace_client.mdx b/api_docs/kbn_apm_synthtrace_client.mdx index e390f2cecd7d4..434c5382d636b 100644 --- a/api_docs/kbn_apm_synthtrace_client.mdx +++ b/api_docs/kbn_apm_synthtrace_client.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-synthtrace-client title: "@kbn/apm-synthtrace-client" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/apm-synthtrace-client plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-synthtrace-client'] --- import kbnApmSynthtraceClientObj from './kbn_apm_synthtrace_client.devdocs.json'; diff --git a/api_docs/kbn_apm_utils.mdx b/api_docs/kbn_apm_utils.mdx index 0520c482b9c92..7e1793e181bb4 100644 --- a/api_docs/kbn_apm_utils.mdx +++ b/api_docs/kbn_apm_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-apm-utils title: "@kbn/apm-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/apm-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/apm-utils'] --- import kbnApmUtilsObj from './kbn_apm_utils.devdocs.json'; diff --git a/api_docs/kbn_axe_config.mdx b/api_docs/kbn_axe_config.mdx index 328180b31b8b7..a91fda760e8b9 100644 --- a/api_docs/kbn_axe_config.mdx +++ b/api_docs/kbn_axe_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-axe-config title: "@kbn/axe-config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/axe-config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/axe-config'] --- import kbnAxeConfigObj from './kbn_axe_config.devdocs.json'; diff --git a/api_docs/kbn_cases_components.mdx b/api_docs/kbn_cases_components.mdx index 7c784b334d0e6..86f5f3a1523f7 100644 --- a/api_docs/kbn_cases_components.mdx +++ b/api_docs/kbn_cases_components.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cases-components title: "@kbn/cases-components" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/cases-components plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cases-components'] --- import kbnCasesComponentsObj from './kbn_cases_components.devdocs.json'; diff --git a/api_docs/kbn_cell_actions.mdx b/api_docs/kbn_cell_actions.mdx index a6c1fadf346ab..343422695ba2b 100644 --- a/api_docs/kbn_cell_actions.mdx +++ b/api_docs/kbn_cell_actions.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cell-actions title: "@kbn/cell-actions" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/cell-actions plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cell-actions'] --- import kbnCellActionsObj from './kbn_cell_actions.devdocs.json'; diff --git a/api_docs/kbn_chart_icons.mdx b/api_docs/kbn_chart_icons.mdx index b1bc0cd414a22..bd067776fdc61 100644 --- a/api_docs/kbn_chart_icons.mdx +++ b/api_docs/kbn_chart_icons.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-chart-icons title: "@kbn/chart-icons" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/chart-icons plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/chart-icons'] --- import kbnChartIconsObj from './kbn_chart_icons.devdocs.json'; diff --git a/api_docs/kbn_ci_stats_core.mdx b/api_docs/kbn_ci_stats_core.mdx index 7bfbac69c5e5f..f707d533fe737 100644 --- a/api_docs/kbn_ci_stats_core.mdx +++ b/api_docs/kbn_ci_stats_core.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-core title: "@kbn/ci-stats-core" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ci-stats-core plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-core'] --- import kbnCiStatsCoreObj from './kbn_ci_stats_core.devdocs.json'; diff --git a/api_docs/kbn_ci_stats_performance_metrics.mdx b/api_docs/kbn_ci_stats_performance_metrics.mdx index 6d0a4f53629d2..079c5eb0aa888 100644 --- a/api_docs/kbn_ci_stats_performance_metrics.mdx +++ b/api_docs/kbn_ci_stats_performance_metrics.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-performance-metrics title: "@kbn/ci-stats-performance-metrics" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ci-stats-performance-metrics plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-performance-metrics'] --- import kbnCiStatsPerformanceMetricsObj from './kbn_ci_stats_performance_metrics.devdocs.json'; diff --git a/api_docs/kbn_ci_stats_reporter.mdx b/api_docs/kbn_ci_stats_reporter.mdx index d8ca189536e96..d6dffac8f0854 100644 --- a/api_docs/kbn_ci_stats_reporter.mdx +++ b/api_docs/kbn_ci_stats_reporter.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ci-stats-reporter title: "@kbn/ci-stats-reporter" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ci-stats-reporter plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ci-stats-reporter'] --- import kbnCiStatsReporterObj from './kbn_ci_stats_reporter.devdocs.json'; diff --git a/api_docs/kbn_cli_dev_mode.mdx b/api_docs/kbn_cli_dev_mode.mdx index 71a260fab038c..2fab4f93fe440 100644 --- a/api_docs/kbn_cli_dev_mode.mdx +++ b/api_docs/kbn_cli_dev_mode.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cli-dev-mode title: "@kbn/cli-dev-mode" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/cli-dev-mode plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cli-dev-mode'] --- import kbnCliDevModeObj from './kbn_cli_dev_mode.devdocs.json'; diff --git a/api_docs/kbn_coloring.mdx b/api_docs/kbn_coloring.mdx index 7c869e64566db..b95482db1e654 100644 --- a/api_docs/kbn_coloring.mdx +++ b/api_docs/kbn_coloring.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-coloring title: "@kbn/coloring" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/coloring plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/coloring'] --- import kbnColoringObj from './kbn_coloring.devdocs.json'; diff --git a/api_docs/kbn_config.mdx b/api_docs/kbn_config.mdx index 66dbe20320bea..c67464aee6f97 100644 --- a/api_docs/kbn_config.mdx +++ b/api_docs/kbn_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config title: "@kbn/config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config'] --- import kbnConfigObj from './kbn_config.devdocs.json'; diff --git a/api_docs/kbn_config_mocks.mdx b/api_docs/kbn_config_mocks.mdx index 363c398c87735..154eb93df05ab 100644 --- a/api_docs/kbn_config_mocks.mdx +++ b/api_docs/kbn_config_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-mocks title: "@kbn/config-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/config-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-mocks'] --- import kbnConfigMocksObj from './kbn_config_mocks.devdocs.json'; diff --git a/api_docs/kbn_config_schema.mdx b/api_docs/kbn_config_schema.mdx index a253304dd8e66..c514e701e0963 100644 --- a/api_docs/kbn_config_schema.mdx +++ b/api_docs/kbn_config_schema.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-config-schema title: "@kbn/config-schema" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/config-schema plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/config-schema'] --- import kbnConfigSchemaObj from './kbn_config_schema.devdocs.json'; diff --git a/api_docs/kbn_content_management_content_editor.mdx b/api_docs/kbn_content_management_content_editor.mdx index c5bc6fae58061..df591653d3338 100644 --- a/api_docs/kbn_content_management_content_editor.mdx +++ b/api_docs/kbn_content_management_content_editor.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-content-editor title: "@kbn/content-management-content-editor" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/content-management-content-editor plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-content-editor'] --- import kbnContentManagementContentEditorObj from './kbn_content_management_content_editor.devdocs.json'; diff --git a/api_docs/kbn_content_management_table_list.mdx b/api_docs/kbn_content_management_table_list.mdx index 67fb4fc2d268c..2ac4a23fe1411 100644 --- a/api_docs/kbn_content_management_table_list.mdx +++ b/api_docs/kbn_content_management_table_list.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-content-management-table-list title: "@kbn/content-management-table-list" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/content-management-table-list plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/content-management-table-list'] --- import kbnContentManagementTableListObj from './kbn_content_management_table_list.devdocs.json'; diff --git a/api_docs/kbn_core_analytics_browser.mdx b/api_docs/kbn_core_analytics_browser.mdx index bd0babef68b6d..bc9339f5b628b 100644 --- a/api_docs/kbn_core_analytics_browser.mdx +++ b/api_docs/kbn_core_analytics_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser title: "@kbn/core-analytics-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-analytics-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser'] --- import kbnCoreAnalyticsBrowserObj from './kbn_core_analytics_browser.devdocs.json'; diff --git a/api_docs/kbn_core_analytics_browser_internal.mdx b/api_docs/kbn_core_analytics_browser_internal.mdx index ffe6c513319f0..993e57d6abf19 100644 --- a/api_docs/kbn_core_analytics_browser_internal.mdx +++ b/api_docs/kbn_core_analytics_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-internal title: "@kbn/core-analytics-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-analytics-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-internal'] --- import kbnCoreAnalyticsBrowserInternalObj from './kbn_core_analytics_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_analytics_browser_mocks.mdx b/api_docs/kbn_core_analytics_browser_mocks.mdx index 2b17d37d624c1..782ad26bc83b7 100644 --- a/api_docs/kbn_core_analytics_browser_mocks.mdx +++ b/api_docs/kbn_core_analytics_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-browser-mocks title: "@kbn/core-analytics-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-analytics-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-browser-mocks'] --- import kbnCoreAnalyticsBrowserMocksObj from './kbn_core_analytics_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_analytics_server.mdx b/api_docs/kbn_core_analytics_server.mdx index 46478fe6df7be..42483cf5b783c 100644 --- a/api_docs/kbn_core_analytics_server.mdx +++ b/api_docs/kbn_core_analytics_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server title: "@kbn/core-analytics-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-analytics-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server'] --- import kbnCoreAnalyticsServerObj from './kbn_core_analytics_server.devdocs.json'; diff --git a/api_docs/kbn_core_analytics_server_internal.mdx b/api_docs/kbn_core_analytics_server_internal.mdx index e58a33293e84a..2b19e77bcb4ba 100644 --- a/api_docs/kbn_core_analytics_server_internal.mdx +++ b/api_docs/kbn_core_analytics_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-internal title: "@kbn/core-analytics-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-analytics-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-internal'] --- import kbnCoreAnalyticsServerInternalObj from './kbn_core_analytics_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_analytics_server_mocks.mdx b/api_docs/kbn_core_analytics_server_mocks.mdx index 6728390da3389..17e6207d98649 100644 --- a/api_docs/kbn_core_analytics_server_mocks.mdx +++ b/api_docs/kbn_core_analytics_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-analytics-server-mocks title: "@kbn/core-analytics-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-analytics-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-analytics-server-mocks'] --- import kbnCoreAnalyticsServerMocksObj from './kbn_core_analytics_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_application_browser.mdx b/api_docs/kbn_core_application_browser.mdx index 925be935477af..688915feba5bf 100644 --- a/api_docs/kbn_core_application_browser.mdx +++ b/api_docs/kbn_core_application_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser title: "@kbn/core-application-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-application-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser'] --- import kbnCoreApplicationBrowserObj from './kbn_core_application_browser.devdocs.json'; diff --git a/api_docs/kbn_core_application_browser_internal.mdx b/api_docs/kbn_core_application_browser_internal.mdx index 3f2deeeda156f..9d344fe290c21 100644 --- a/api_docs/kbn_core_application_browser_internal.mdx +++ b/api_docs/kbn_core_application_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-internal title: "@kbn/core-application-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-application-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-internal'] --- import kbnCoreApplicationBrowserInternalObj from './kbn_core_application_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_application_browser_mocks.mdx b/api_docs/kbn_core_application_browser_mocks.mdx index 061e56d316e1e..6f3d7806d1bd4 100644 --- a/api_docs/kbn_core_application_browser_mocks.mdx +++ b/api_docs/kbn_core_application_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-browser-mocks title: "@kbn/core-application-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-application-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-browser-mocks'] --- import kbnCoreApplicationBrowserMocksObj from './kbn_core_application_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_application_common.mdx b/api_docs/kbn_core_application_common.mdx index 2edfbff89d204..98d09bc7c153c 100644 --- a/api_docs/kbn_core_application_common.mdx +++ b/api_docs/kbn_core_application_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-application-common title: "@kbn/core-application-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-application-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-application-common'] --- import kbnCoreApplicationCommonObj from './kbn_core_application_common.devdocs.json'; diff --git a/api_docs/kbn_core_apps_browser_internal.mdx b/api_docs/kbn_core_apps_browser_internal.mdx index e65fed629b237..05cd7986a5cf3 100644 --- a/api_docs/kbn_core_apps_browser_internal.mdx +++ b/api_docs/kbn_core_apps_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-internal title: "@kbn/core-apps-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-apps-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-internal'] --- import kbnCoreAppsBrowserInternalObj from './kbn_core_apps_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_apps_browser_mocks.mdx b/api_docs/kbn_core_apps_browser_mocks.mdx index c6a5cc07ce9d9..4bdb5c9eda07e 100644 --- a/api_docs/kbn_core_apps_browser_mocks.mdx +++ b/api_docs/kbn_core_apps_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-browser-mocks title: "@kbn/core-apps-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-apps-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-browser-mocks'] --- import kbnCoreAppsBrowserMocksObj from './kbn_core_apps_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_apps_server_internal.mdx b/api_docs/kbn_core_apps_server_internal.mdx index 46ef2a82a5e48..73ccbbec9f524 100644 --- a/api_docs/kbn_core_apps_server_internal.mdx +++ b/api_docs/kbn_core_apps_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-apps-server-internal title: "@kbn/core-apps-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-apps-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-apps-server-internal'] --- import kbnCoreAppsServerInternalObj from './kbn_core_apps_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_base_browser_mocks.mdx b/api_docs/kbn_core_base_browser_mocks.mdx index 3eb739cda14ad..08dddb0cd6185 100644 --- a/api_docs/kbn_core_base_browser_mocks.mdx +++ b/api_docs/kbn_core_base_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-browser-mocks title: "@kbn/core-base-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-base-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-browser-mocks'] --- import kbnCoreBaseBrowserMocksObj from './kbn_core_base_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_base_common.mdx b/api_docs/kbn_core_base_common.mdx index b0b534b6f8397..197e0caaeb2a8 100644 --- a/api_docs/kbn_core_base_common.mdx +++ b/api_docs/kbn_core_base_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-common title: "@kbn/core-base-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-base-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-common'] --- import kbnCoreBaseCommonObj from './kbn_core_base_common.devdocs.json'; diff --git a/api_docs/kbn_core_base_server_internal.mdx b/api_docs/kbn_core_base_server_internal.mdx index f22fc241ed847..c2c971ec93838 100644 --- a/api_docs/kbn_core_base_server_internal.mdx +++ b/api_docs/kbn_core_base_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-internal title: "@kbn/core-base-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-base-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-internal'] --- import kbnCoreBaseServerInternalObj from './kbn_core_base_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_base_server_mocks.mdx b/api_docs/kbn_core_base_server_mocks.mdx index 42b26d5bbe40f..210086725b1a0 100644 --- a/api_docs/kbn_core_base_server_mocks.mdx +++ b/api_docs/kbn_core_base_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-base-server-mocks title: "@kbn/core-base-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-base-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-base-server-mocks'] --- import kbnCoreBaseServerMocksObj from './kbn_core_base_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_capabilities_browser_mocks.mdx b/api_docs/kbn_core_capabilities_browser_mocks.mdx index 0e29870762ddf..4f1b4710f24ab 100644 --- a/api_docs/kbn_core_capabilities_browser_mocks.mdx +++ b/api_docs/kbn_core_capabilities_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-browser-mocks title: "@kbn/core-capabilities-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-capabilities-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-browser-mocks'] --- import kbnCoreCapabilitiesBrowserMocksObj from './kbn_core_capabilities_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_capabilities_common.mdx b/api_docs/kbn_core_capabilities_common.mdx index 2a5975912f6e0..8a7ebbbde5f42 100644 --- a/api_docs/kbn_core_capabilities_common.mdx +++ b/api_docs/kbn_core_capabilities_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-common title: "@kbn/core-capabilities-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-capabilities-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-common'] --- import kbnCoreCapabilitiesCommonObj from './kbn_core_capabilities_common.devdocs.json'; diff --git a/api_docs/kbn_core_capabilities_server.mdx b/api_docs/kbn_core_capabilities_server.mdx index f7e136ddcf886..65fdd73a3a794 100644 --- a/api_docs/kbn_core_capabilities_server.mdx +++ b/api_docs/kbn_core_capabilities_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server title: "@kbn/core-capabilities-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-capabilities-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server'] --- import kbnCoreCapabilitiesServerObj from './kbn_core_capabilities_server.devdocs.json'; diff --git a/api_docs/kbn_core_capabilities_server_mocks.mdx b/api_docs/kbn_core_capabilities_server_mocks.mdx index 089611f4f982c..78b5e5a86c1b2 100644 --- a/api_docs/kbn_core_capabilities_server_mocks.mdx +++ b/api_docs/kbn_core_capabilities_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-capabilities-server-mocks title: "@kbn/core-capabilities-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-capabilities-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-capabilities-server-mocks'] --- import kbnCoreCapabilitiesServerMocksObj from './kbn_core_capabilities_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_chrome_browser.mdx b/api_docs/kbn_core_chrome_browser.mdx index 2739a16c3e26d..01472aa410007 100644 --- a/api_docs/kbn_core_chrome_browser.mdx +++ b/api_docs/kbn_core_chrome_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser title: "@kbn/core-chrome-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-chrome-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser'] --- import kbnCoreChromeBrowserObj from './kbn_core_chrome_browser.devdocs.json'; diff --git a/api_docs/kbn_core_chrome_browser_mocks.mdx b/api_docs/kbn_core_chrome_browser_mocks.mdx index ef124b9ce828b..c355a97e7927c 100644 --- a/api_docs/kbn_core_chrome_browser_mocks.mdx +++ b/api_docs/kbn_core_chrome_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-chrome-browser-mocks title: "@kbn/core-chrome-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-chrome-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-chrome-browser-mocks'] --- import kbnCoreChromeBrowserMocksObj from './kbn_core_chrome_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_config_server_internal.mdx b/api_docs/kbn_core_config_server_internal.mdx index 3fa820f55e2c1..98df37e9a75df 100644 --- a/api_docs/kbn_core_config_server_internal.mdx +++ b/api_docs/kbn_core_config_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-config-server-internal title: "@kbn/core-config-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-config-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-config-server-internal'] --- import kbnCoreConfigServerInternalObj from './kbn_core_config_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_browser.mdx b/api_docs/kbn_core_custom_branding_browser.mdx index b0588f2ef34a6..ac31154978bfb 100644 --- a/api_docs/kbn_core_custom_branding_browser.mdx +++ b/api_docs/kbn_core_custom_branding_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser title: "@kbn/core-custom-branding-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser'] --- import kbnCoreCustomBrandingBrowserObj from './kbn_core_custom_branding_browser.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_browser_internal.mdx b/api_docs/kbn_core_custom_branding_browser_internal.mdx index 8f353fa408805..abae088f8f697 100644 --- a/api_docs/kbn_core_custom_branding_browser_internal.mdx +++ b/api_docs/kbn_core_custom_branding_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-internal title: "@kbn/core-custom-branding-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-internal'] --- import kbnCoreCustomBrandingBrowserInternalObj from './kbn_core_custom_branding_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_browser_mocks.mdx b/api_docs/kbn_core_custom_branding_browser_mocks.mdx index c94056127d66a..7a5f518ae767f 100644 --- a/api_docs/kbn_core_custom_branding_browser_mocks.mdx +++ b/api_docs/kbn_core_custom_branding_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-browser-mocks title: "@kbn/core-custom-branding-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-browser-mocks'] --- import kbnCoreCustomBrandingBrowserMocksObj from './kbn_core_custom_branding_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_common.mdx b/api_docs/kbn_core_custom_branding_common.mdx index 965df8d06317e..b59f572d7744c 100644 --- a/api_docs/kbn_core_custom_branding_common.mdx +++ b/api_docs/kbn_core_custom_branding_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-common title: "@kbn/core-custom-branding-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-common'] --- import kbnCoreCustomBrandingCommonObj from './kbn_core_custom_branding_common.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_server.mdx b/api_docs/kbn_core_custom_branding_server.mdx index d17f96da63f95..f1da7a2804a5c 100644 --- a/api_docs/kbn_core_custom_branding_server.mdx +++ b/api_docs/kbn_core_custom_branding_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server title: "@kbn/core-custom-branding-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server'] --- import kbnCoreCustomBrandingServerObj from './kbn_core_custom_branding_server.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_server_internal.mdx b/api_docs/kbn_core_custom_branding_server_internal.mdx index 112dd38004af3..58e3f21124e3b 100644 --- a/api_docs/kbn_core_custom_branding_server_internal.mdx +++ b/api_docs/kbn_core_custom_branding_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-internal title: "@kbn/core-custom-branding-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-internal'] --- import kbnCoreCustomBrandingServerInternalObj from './kbn_core_custom_branding_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_custom_branding_server_mocks.mdx b/api_docs/kbn_core_custom_branding_server_mocks.mdx index 7657432fe89bd..1fef58b323980 100644 --- a/api_docs/kbn_core_custom_branding_server_mocks.mdx +++ b/api_docs/kbn_core_custom_branding_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-custom-branding-server-mocks title: "@kbn/core-custom-branding-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-custom-branding-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-custom-branding-server-mocks'] --- import kbnCoreCustomBrandingServerMocksObj from './kbn_core_custom_branding_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_browser.mdx b/api_docs/kbn_core_deprecations_browser.mdx index 21dfb0909e8b0..42c936c1d2bed 100644 --- a/api_docs/kbn_core_deprecations_browser.mdx +++ b/api_docs/kbn_core_deprecations_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser title: "@kbn/core-deprecations-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser'] --- import kbnCoreDeprecationsBrowserObj from './kbn_core_deprecations_browser.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_browser_internal.mdx b/api_docs/kbn_core_deprecations_browser_internal.mdx index c7d03b4c34ad2..f8d82bba771d6 100644 --- a/api_docs/kbn_core_deprecations_browser_internal.mdx +++ b/api_docs/kbn_core_deprecations_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-internal title: "@kbn/core-deprecations-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-internal'] --- import kbnCoreDeprecationsBrowserInternalObj from './kbn_core_deprecations_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_browser_mocks.mdx b/api_docs/kbn_core_deprecations_browser_mocks.mdx index 383aaa98dea0b..acf7c28d2a778 100644 --- a/api_docs/kbn_core_deprecations_browser_mocks.mdx +++ b/api_docs/kbn_core_deprecations_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-browser-mocks title: "@kbn/core-deprecations-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-browser-mocks'] --- import kbnCoreDeprecationsBrowserMocksObj from './kbn_core_deprecations_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_common.mdx b/api_docs/kbn_core_deprecations_common.mdx index d353993a82b5e..c80e48980add0 100644 --- a/api_docs/kbn_core_deprecations_common.mdx +++ b/api_docs/kbn_core_deprecations_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-common title: "@kbn/core-deprecations-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-common'] --- import kbnCoreDeprecationsCommonObj from './kbn_core_deprecations_common.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_server.mdx b/api_docs/kbn_core_deprecations_server.mdx index d684649cac4ba..d33468b69d767 100644 --- a/api_docs/kbn_core_deprecations_server.mdx +++ b/api_docs/kbn_core_deprecations_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server title: "@kbn/core-deprecations-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server'] --- import kbnCoreDeprecationsServerObj from './kbn_core_deprecations_server.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_server_internal.mdx b/api_docs/kbn_core_deprecations_server_internal.mdx index 60aec58ac93f8..e2b023e44825b 100644 --- a/api_docs/kbn_core_deprecations_server_internal.mdx +++ b/api_docs/kbn_core_deprecations_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-internal title: "@kbn/core-deprecations-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-internal'] --- import kbnCoreDeprecationsServerInternalObj from './kbn_core_deprecations_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_deprecations_server_mocks.mdx b/api_docs/kbn_core_deprecations_server_mocks.mdx index 4f06adcb4c3f2..55709607723a4 100644 --- a/api_docs/kbn_core_deprecations_server_mocks.mdx +++ b/api_docs/kbn_core_deprecations_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-deprecations-server-mocks title: "@kbn/core-deprecations-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-deprecations-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-deprecations-server-mocks'] --- import kbnCoreDeprecationsServerMocksObj from './kbn_core_deprecations_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_doc_links_browser.mdx b/api_docs/kbn_core_doc_links_browser.mdx index 64aa85183bf8d..1b6e985211927 100644 --- a/api_docs/kbn_core_doc_links_browser.mdx +++ b/api_docs/kbn_core_doc_links_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser title: "@kbn/core-doc-links-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-doc-links-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser'] --- import kbnCoreDocLinksBrowserObj from './kbn_core_doc_links_browser.devdocs.json'; diff --git a/api_docs/kbn_core_doc_links_browser_mocks.mdx b/api_docs/kbn_core_doc_links_browser_mocks.mdx index 7916d11105022..c39aaa7407c7c 100644 --- a/api_docs/kbn_core_doc_links_browser_mocks.mdx +++ b/api_docs/kbn_core_doc_links_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-browser-mocks title: "@kbn/core-doc-links-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-doc-links-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-browser-mocks'] --- import kbnCoreDocLinksBrowserMocksObj from './kbn_core_doc_links_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_doc_links_server.mdx b/api_docs/kbn_core_doc_links_server.mdx index faa09acc52387..75194095b3843 100644 --- a/api_docs/kbn_core_doc_links_server.mdx +++ b/api_docs/kbn_core_doc_links_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server title: "@kbn/core-doc-links-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-doc-links-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server'] --- import kbnCoreDocLinksServerObj from './kbn_core_doc_links_server.devdocs.json'; diff --git a/api_docs/kbn_core_doc_links_server_mocks.mdx b/api_docs/kbn_core_doc_links_server_mocks.mdx index b5e9a4ccb8dbb..3cefebf73ba53 100644 --- a/api_docs/kbn_core_doc_links_server_mocks.mdx +++ b/api_docs/kbn_core_doc_links_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-doc-links-server-mocks title: "@kbn/core-doc-links-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-doc-links-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-doc-links-server-mocks'] --- import kbnCoreDocLinksServerMocksObj from './kbn_core_doc_links_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx index 3fd2bcf68c1c3..bb1231731d805 100644 --- a/api_docs/kbn_core_elasticsearch_client_server_internal.mdx +++ b/api_docs/kbn_core_elasticsearch_client_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-internal title: "@kbn/core-elasticsearch-client-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-elasticsearch-client-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-internal'] --- import kbnCoreElasticsearchClientServerInternalObj from './kbn_core_elasticsearch_client_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx index 433072f2de56e..d206cefe49bcf 100644 --- a/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx +++ b/api_docs/kbn_core_elasticsearch_client_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-client-server-mocks title: "@kbn/core-elasticsearch-client-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-elasticsearch-client-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-client-server-mocks'] --- import kbnCoreElasticsearchClientServerMocksObj from './kbn_core_elasticsearch_client_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_elasticsearch_server.mdx b/api_docs/kbn_core_elasticsearch_server.mdx index c278fa1841f2d..e29aea9c54822 100644 --- a/api_docs/kbn_core_elasticsearch_server.mdx +++ b/api_docs/kbn_core_elasticsearch_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server title: "@kbn/core-elasticsearch-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-elasticsearch-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server'] --- import kbnCoreElasticsearchServerObj from './kbn_core_elasticsearch_server.devdocs.json'; diff --git a/api_docs/kbn_core_elasticsearch_server_internal.mdx b/api_docs/kbn_core_elasticsearch_server_internal.mdx index 9de835878b228..f560d8e3264cc 100644 --- a/api_docs/kbn_core_elasticsearch_server_internal.mdx +++ b/api_docs/kbn_core_elasticsearch_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-internal title: "@kbn/core-elasticsearch-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-elasticsearch-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-internal'] --- import kbnCoreElasticsearchServerInternalObj from './kbn_core_elasticsearch_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_elasticsearch_server_mocks.mdx b/api_docs/kbn_core_elasticsearch_server_mocks.mdx index a83b7ec2ee3ea..0453b0dd8c12f 100644 --- a/api_docs/kbn_core_elasticsearch_server_mocks.mdx +++ b/api_docs/kbn_core_elasticsearch_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-elasticsearch-server-mocks title: "@kbn/core-elasticsearch-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-elasticsearch-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-elasticsearch-server-mocks'] --- import kbnCoreElasticsearchServerMocksObj from './kbn_core_elasticsearch_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_environment_server_internal.mdx b/api_docs/kbn_core_environment_server_internal.mdx index 1984164dba728..f35985dd0e855 100644 --- a/api_docs/kbn_core_environment_server_internal.mdx +++ b/api_docs/kbn_core_environment_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-internal title: "@kbn/core-environment-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-environment-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-internal'] --- import kbnCoreEnvironmentServerInternalObj from './kbn_core_environment_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_environment_server_mocks.mdx b/api_docs/kbn_core_environment_server_mocks.mdx index be966e3aa9705..17237ada3f56a 100644 --- a/api_docs/kbn_core_environment_server_mocks.mdx +++ b/api_docs/kbn_core_environment_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-environment-server-mocks title: "@kbn/core-environment-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-environment-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-environment-server-mocks'] --- import kbnCoreEnvironmentServerMocksObj from './kbn_core_environment_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_browser.mdx b/api_docs/kbn_core_execution_context_browser.mdx index 70dc4cb32b0f6..f6b539f3807d3 100644 --- a/api_docs/kbn_core_execution_context_browser.mdx +++ b/api_docs/kbn_core_execution_context_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser title: "@kbn/core-execution-context-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser'] --- import kbnCoreExecutionContextBrowserObj from './kbn_core_execution_context_browser.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_browser_internal.mdx b/api_docs/kbn_core_execution_context_browser_internal.mdx index 72722d95c29e2..f84842d16c77e 100644 --- a/api_docs/kbn_core_execution_context_browser_internal.mdx +++ b/api_docs/kbn_core_execution_context_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-internal title: "@kbn/core-execution-context-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-internal'] --- import kbnCoreExecutionContextBrowserInternalObj from './kbn_core_execution_context_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_browser_mocks.mdx b/api_docs/kbn_core_execution_context_browser_mocks.mdx index 0fb8d10b2c639..42de53558f686 100644 --- a/api_docs/kbn_core_execution_context_browser_mocks.mdx +++ b/api_docs/kbn_core_execution_context_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-browser-mocks title: "@kbn/core-execution-context-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-browser-mocks'] --- import kbnCoreExecutionContextBrowserMocksObj from './kbn_core_execution_context_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_common.mdx b/api_docs/kbn_core_execution_context_common.mdx index 050e7d8eac38b..56e4c18a51b3a 100644 --- a/api_docs/kbn_core_execution_context_common.mdx +++ b/api_docs/kbn_core_execution_context_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-common title: "@kbn/core-execution-context-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-common'] --- import kbnCoreExecutionContextCommonObj from './kbn_core_execution_context_common.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_server.mdx b/api_docs/kbn_core_execution_context_server.mdx index ce5f5ce67e242..004dbf923a07b 100644 --- a/api_docs/kbn_core_execution_context_server.mdx +++ b/api_docs/kbn_core_execution_context_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server title: "@kbn/core-execution-context-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server'] --- import kbnCoreExecutionContextServerObj from './kbn_core_execution_context_server.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_server_internal.mdx b/api_docs/kbn_core_execution_context_server_internal.mdx index 141e9c0f3d3f3..d559872cac2ff 100644 --- a/api_docs/kbn_core_execution_context_server_internal.mdx +++ b/api_docs/kbn_core_execution_context_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-internal title: "@kbn/core-execution-context-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-internal'] --- import kbnCoreExecutionContextServerInternalObj from './kbn_core_execution_context_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_execution_context_server_mocks.mdx b/api_docs/kbn_core_execution_context_server_mocks.mdx index 47f49f142d2d0..258d9d427531c 100644 --- a/api_docs/kbn_core_execution_context_server_mocks.mdx +++ b/api_docs/kbn_core_execution_context_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-execution-context-server-mocks title: "@kbn/core-execution-context-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-execution-context-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-execution-context-server-mocks'] --- import kbnCoreExecutionContextServerMocksObj from './kbn_core_execution_context_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_fatal_errors_browser.mdx b/api_docs/kbn_core_fatal_errors_browser.mdx index d0950f433ac81..add8e1b05110d 100644 --- a/api_docs/kbn_core_fatal_errors_browser.mdx +++ b/api_docs/kbn_core_fatal_errors_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser title: "@kbn/core-fatal-errors-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-fatal-errors-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser'] --- import kbnCoreFatalErrorsBrowserObj from './kbn_core_fatal_errors_browser.devdocs.json'; diff --git a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx index 2daf9c2050d40..e0c9bd5d99014 100644 --- a/api_docs/kbn_core_fatal_errors_browser_mocks.mdx +++ b/api_docs/kbn_core_fatal_errors_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-fatal-errors-browser-mocks title: "@kbn/core-fatal-errors-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-fatal-errors-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-fatal-errors-browser-mocks'] --- import kbnCoreFatalErrorsBrowserMocksObj from './kbn_core_fatal_errors_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_http_browser.mdx b/api_docs/kbn_core_http_browser.mdx index c797998ca49d0..d348cbf35f264 100644 --- a/api_docs/kbn_core_http_browser.mdx +++ b/api_docs/kbn_core_http_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser title: "@kbn/core-http-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser'] --- import kbnCoreHttpBrowserObj from './kbn_core_http_browser.devdocs.json'; diff --git a/api_docs/kbn_core_http_browser_internal.mdx b/api_docs/kbn_core_http_browser_internal.mdx index 334bb46a06c8d..24f9017749929 100644 --- a/api_docs/kbn_core_http_browser_internal.mdx +++ b/api_docs/kbn_core_http_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-internal title: "@kbn/core-http-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-internal'] --- import kbnCoreHttpBrowserInternalObj from './kbn_core_http_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_http_browser_mocks.mdx b/api_docs/kbn_core_http_browser_mocks.mdx index f45a3ff135202..e457ceacffd3f 100644 --- a/api_docs/kbn_core_http_browser_mocks.mdx +++ b/api_docs/kbn_core_http_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-browser-mocks title: "@kbn/core-http-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-browser-mocks'] --- import kbnCoreHttpBrowserMocksObj from './kbn_core_http_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_http_common.mdx b/api_docs/kbn_core_http_common.mdx index 07c8d10e287c8..d7f251ee69ed8 100644 --- a/api_docs/kbn_core_http_common.mdx +++ b/api_docs/kbn_core_http_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-common title: "@kbn/core-http-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-common'] --- import kbnCoreHttpCommonObj from './kbn_core_http_common.devdocs.json'; diff --git a/api_docs/kbn_core_http_context_server_mocks.mdx b/api_docs/kbn_core_http_context_server_mocks.mdx index 2887d54d6c072..530050d3eb4cb 100644 --- a/api_docs/kbn_core_http_context_server_mocks.mdx +++ b/api_docs/kbn_core_http_context_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-context-server-mocks title: "@kbn/core-http-context-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-context-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-context-server-mocks'] --- import kbnCoreHttpContextServerMocksObj from './kbn_core_http_context_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_http_request_handler_context_server.mdx b/api_docs/kbn_core_http_request_handler_context_server.mdx index df5ce63b82fa2..a49e58f81f932 100644 --- a/api_docs/kbn_core_http_request_handler_context_server.mdx +++ b/api_docs/kbn_core_http_request_handler_context_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-request-handler-context-server title: "@kbn/core-http-request-handler-context-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-request-handler-context-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-request-handler-context-server'] --- import kbnCoreHttpRequestHandlerContextServerObj from './kbn_core_http_request_handler_context_server.devdocs.json'; diff --git a/api_docs/kbn_core_http_resources_server.mdx b/api_docs/kbn_core_http_resources_server.mdx index 4f586c348e4f9..a53fc6124c775 100644 --- a/api_docs/kbn_core_http_resources_server.mdx +++ b/api_docs/kbn_core_http_resources_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server title: "@kbn/core-http-resources-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-resources-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server'] --- import kbnCoreHttpResourcesServerObj from './kbn_core_http_resources_server.devdocs.json'; diff --git a/api_docs/kbn_core_http_resources_server_internal.mdx b/api_docs/kbn_core_http_resources_server_internal.mdx index 5f4e0c12a0e98..00df0ed338b8e 100644 --- a/api_docs/kbn_core_http_resources_server_internal.mdx +++ b/api_docs/kbn_core_http_resources_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-internal title: "@kbn/core-http-resources-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-resources-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-internal'] --- import kbnCoreHttpResourcesServerInternalObj from './kbn_core_http_resources_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_http_resources_server_mocks.mdx b/api_docs/kbn_core_http_resources_server_mocks.mdx index 88f02ec490d03..d04e4f2247cda 100644 --- a/api_docs/kbn_core_http_resources_server_mocks.mdx +++ b/api_docs/kbn_core_http_resources_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-resources-server-mocks title: "@kbn/core-http-resources-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-resources-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-resources-server-mocks'] --- import kbnCoreHttpResourcesServerMocksObj from './kbn_core_http_resources_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_http_router_server_internal.mdx b/api_docs/kbn_core_http_router_server_internal.mdx index 759ecc1c1e737..4533f8e746966 100644 --- a/api_docs/kbn_core_http_router_server_internal.mdx +++ b/api_docs/kbn_core_http_router_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-internal title: "@kbn/core-http-router-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-router-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-internal'] --- import kbnCoreHttpRouterServerInternalObj from './kbn_core_http_router_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_http_router_server_mocks.mdx b/api_docs/kbn_core_http_router_server_mocks.mdx index 3d9b8135292af..c1ea05df66a27 100644 --- a/api_docs/kbn_core_http_router_server_mocks.mdx +++ b/api_docs/kbn_core_http_router_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-router-server-mocks title: "@kbn/core-http-router-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-router-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-router-server-mocks'] --- import kbnCoreHttpRouterServerMocksObj from './kbn_core_http_router_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_http_server.mdx b/api_docs/kbn_core_http_server.mdx index 4f64e06e9674e..da944948c73e1 100644 --- a/api_docs/kbn_core_http_server.mdx +++ b/api_docs/kbn_core_http_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server title: "@kbn/core-http-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server'] --- import kbnCoreHttpServerObj from './kbn_core_http_server.devdocs.json'; diff --git a/api_docs/kbn_core_http_server_internal.mdx b/api_docs/kbn_core_http_server_internal.mdx index bfb80e821eb29..4ce85d8ce5f1c 100644 --- a/api_docs/kbn_core_http_server_internal.mdx +++ b/api_docs/kbn_core_http_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-internal title: "@kbn/core-http-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-internal'] --- import kbnCoreHttpServerInternalObj from './kbn_core_http_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_http_server_mocks.mdx b/api_docs/kbn_core_http_server_mocks.mdx index c8a00f2d71d35..7fa4c14717c3d 100644 --- a/api_docs/kbn_core_http_server_mocks.mdx +++ b/api_docs/kbn_core_http_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-http-server-mocks title: "@kbn/core-http-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-http-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-http-server-mocks'] --- import kbnCoreHttpServerMocksObj from './kbn_core_http_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_i18n_browser.mdx b/api_docs/kbn_core_i18n_browser.mdx index d2f969d945c1e..a5efffc62af7b 100644 --- a/api_docs/kbn_core_i18n_browser.mdx +++ b/api_docs/kbn_core_i18n_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser title: "@kbn/core-i18n-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-i18n-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser'] --- import kbnCoreI18nBrowserObj from './kbn_core_i18n_browser.devdocs.json'; diff --git a/api_docs/kbn_core_i18n_browser_mocks.mdx b/api_docs/kbn_core_i18n_browser_mocks.mdx index 4f332e0faa55d..4502d94c30632 100644 --- a/api_docs/kbn_core_i18n_browser_mocks.mdx +++ b/api_docs/kbn_core_i18n_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-browser-mocks title: "@kbn/core-i18n-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-i18n-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-browser-mocks'] --- import kbnCoreI18nBrowserMocksObj from './kbn_core_i18n_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_i18n_server.mdx b/api_docs/kbn_core_i18n_server.mdx index 30205cf8b4b7d..e3f7ede1b3175 100644 --- a/api_docs/kbn_core_i18n_server.mdx +++ b/api_docs/kbn_core_i18n_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server title: "@kbn/core-i18n-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-i18n-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server'] --- import kbnCoreI18nServerObj from './kbn_core_i18n_server.devdocs.json'; diff --git a/api_docs/kbn_core_i18n_server_internal.mdx b/api_docs/kbn_core_i18n_server_internal.mdx index 56fa415fb9377..1e9017015e6a4 100644 --- a/api_docs/kbn_core_i18n_server_internal.mdx +++ b/api_docs/kbn_core_i18n_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-internal title: "@kbn/core-i18n-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-i18n-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-internal'] --- import kbnCoreI18nServerInternalObj from './kbn_core_i18n_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_i18n_server_mocks.mdx b/api_docs/kbn_core_i18n_server_mocks.mdx index 621136816a6d5..cd108b890cf5d 100644 --- a/api_docs/kbn_core_i18n_server_mocks.mdx +++ b/api_docs/kbn_core_i18n_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-i18n-server-mocks title: "@kbn/core-i18n-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-i18n-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-i18n-server-mocks'] --- import kbnCoreI18nServerMocksObj from './kbn_core_i18n_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx index ecf12a47edf6f..175508e1e20ac 100644 --- a/api_docs/kbn_core_injected_metadata_browser_mocks.mdx +++ b/api_docs/kbn_core_injected_metadata_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-injected-metadata-browser-mocks title: "@kbn/core-injected-metadata-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-injected-metadata-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-injected-metadata-browser-mocks'] --- import kbnCoreInjectedMetadataBrowserMocksObj from './kbn_core_injected_metadata_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_integrations_browser_internal.mdx b/api_docs/kbn_core_integrations_browser_internal.mdx index 758c27360710e..26b3890048154 100644 --- a/api_docs/kbn_core_integrations_browser_internal.mdx +++ b/api_docs/kbn_core_integrations_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-internal title: "@kbn/core-integrations-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-integrations-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-internal'] --- import kbnCoreIntegrationsBrowserInternalObj from './kbn_core_integrations_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_integrations_browser_mocks.mdx b/api_docs/kbn_core_integrations_browser_mocks.mdx index 0faf80f8b1d64..e6d3c2ac99bb4 100644 --- a/api_docs/kbn_core_integrations_browser_mocks.mdx +++ b/api_docs/kbn_core_integrations_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-integrations-browser-mocks title: "@kbn/core-integrations-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-integrations-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-integrations-browser-mocks'] --- import kbnCoreIntegrationsBrowserMocksObj from './kbn_core_integrations_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_lifecycle_browser.mdx b/api_docs/kbn_core_lifecycle_browser.mdx index 96a072d386b68..c302bf397633d 100644 --- a/api_docs/kbn_core_lifecycle_browser.mdx +++ b/api_docs/kbn_core_lifecycle_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser title: "@kbn/core-lifecycle-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-lifecycle-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser'] --- import kbnCoreLifecycleBrowserObj from './kbn_core_lifecycle_browser.devdocs.json'; diff --git a/api_docs/kbn_core_lifecycle_browser_mocks.mdx b/api_docs/kbn_core_lifecycle_browser_mocks.mdx index 686555175a670..13d4b7df92b39 100644 --- a/api_docs/kbn_core_lifecycle_browser_mocks.mdx +++ b/api_docs/kbn_core_lifecycle_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-browser-mocks title: "@kbn/core-lifecycle-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-lifecycle-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-browser-mocks'] --- import kbnCoreLifecycleBrowserMocksObj from './kbn_core_lifecycle_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_lifecycle_server.mdx b/api_docs/kbn_core_lifecycle_server.mdx index fd28c416c3f37..a0438ad521a72 100644 --- a/api_docs/kbn_core_lifecycle_server.mdx +++ b/api_docs/kbn_core_lifecycle_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server title: "@kbn/core-lifecycle-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-lifecycle-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server'] --- import kbnCoreLifecycleServerObj from './kbn_core_lifecycle_server.devdocs.json'; diff --git a/api_docs/kbn_core_lifecycle_server_mocks.mdx b/api_docs/kbn_core_lifecycle_server_mocks.mdx index 35f5efafd3b01..473f2deeb470d 100644 --- a/api_docs/kbn_core_lifecycle_server_mocks.mdx +++ b/api_docs/kbn_core_lifecycle_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-lifecycle-server-mocks title: "@kbn/core-lifecycle-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-lifecycle-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-lifecycle-server-mocks'] --- import kbnCoreLifecycleServerMocksObj from './kbn_core_lifecycle_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_logging_browser_mocks.mdx b/api_docs/kbn_core_logging_browser_mocks.mdx index 88ab5142cb852..f5d2d9eedb293 100644 --- a/api_docs/kbn_core_logging_browser_mocks.mdx +++ b/api_docs/kbn_core_logging_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-browser-mocks title: "@kbn/core-logging-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-logging-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-browser-mocks'] --- import kbnCoreLoggingBrowserMocksObj from './kbn_core_logging_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_logging_common_internal.mdx b/api_docs/kbn_core_logging_common_internal.mdx index 8e0df34b9aec9..fd4a595ea1a0a 100644 --- a/api_docs/kbn_core_logging_common_internal.mdx +++ b/api_docs/kbn_core_logging_common_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-common-internal title: "@kbn/core-logging-common-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-logging-common-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-common-internal'] --- import kbnCoreLoggingCommonInternalObj from './kbn_core_logging_common_internal.devdocs.json'; diff --git a/api_docs/kbn_core_logging_server.mdx b/api_docs/kbn_core_logging_server.mdx index 9aa390e34f0fb..9651207e8a0ea 100644 --- a/api_docs/kbn_core_logging_server.mdx +++ b/api_docs/kbn_core_logging_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server title: "@kbn/core-logging-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-logging-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server'] --- import kbnCoreLoggingServerObj from './kbn_core_logging_server.devdocs.json'; diff --git a/api_docs/kbn_core_logging_server_internal.mdx b/api_docs/kbn_core_logging_server_internal.mdx index 05d00acfa64d2..dd7edd97d26f5 100644 --- a/api_docs/kbn_core_logging_server_internal.mdx +++ b/api_docs/kbn_core_logging_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-internal title: "@kbn/core-logging-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-logging-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-internal'] --- import kbnCoreLoggingServerInternalObj from './kbn_core_logging_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_logging_server_mocks.mdx b/api_docs/kbn_core_logging_server_mocks.mdx index dca89b485c853..4611e3180ad80 100644 --- a/api_docs/kbn_core_logging_server_mocks.mdx +++ b/api_docs/kbn_core_logging_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-logging-server-mocks title: "@kbn/core-logging-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-logging-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-logging-server-mocks'] --- import kbnCoreLoggingServerMocksObj from './kbn_core_logging_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_metrics_collectors_server_internal.mdx b/api_docs/kbn_core_metrics_collectors_server_internal.mdx index 724da2d16c5d6..f787fde043084 100644 --- a/api_docs/kbn_core_metrics_collectors_server_internal.mdx +++ b/api_docs/kbn_core_metrics_collectors_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-internal title: "@kbn/core-metrics-collectors-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-metrics-collectors-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-internal'] --- import kbnCoreMetricsCollectorsServerInternalObj from './kbn_core_metrics_collectors_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx index b51a7ae9afde5..f841c7947b3e0 100644 --- a/api_docs/kbn_core_metrics_collectors_server_mocks.mdx +++ b/api_docs/kbn_core_metrics_collectors_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-collectors-server-mocks title: "@kbn/core-metrics-collectors-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-metrics-collectors-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-collectors-server-mocks'] --- import kbnCoreMetricsCollectorsServerMocksObj from './kbn_core_metrics_collectors_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_metrics_server.mdx b/api_docs/kbn_core_metrics_server.mdx index 55b7e2975f629..e28a56b20ad8a 100644 --- a/api_docs/kbn_core_metrics_server.mdx +++ b/api_docs/kbn_core_metrics_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server title: "@kbn/core-metrics-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-metrics-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server'] --- import kbnCoreMetricsServerObj from './kbn_core_metrics_server.devdocs.json'; diff --git a/api_docs/kbn_core_metrics_server_internal.mdx b/api_docs/kbn_core_metrics_server_internal.mdx index 9857cb694d986..37e86a9d3b03e 100644 --- a/api_docs/kbn_core_metrics_server_internal.mdx +++ b/api_docs/kbn_core_metrics_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-internal title: "@kbn/core-metrics-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-metrics-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-internal'] --- import kbnCoreMetricsServerInternalObj from './kbn_core_metrics_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_metrics_server_mocks.mdx b/api_docs/kbn_core_metrics_server_mocks.mdx index 8338c33c8391e..a42ab0471b98c 100644 --- a/api_docs/kbn_core_metrics_server_mocks.mdx +++ b/api_docs/kbn_core_metrics_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-metrics-server-mocks title: "@kbn/core-metrics-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-metrics-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-metrics-server-mocks'] --- import kbnCoreMetricsServerMocksObj from './kbn_core_metrics_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_mount_utils_browser.mdx b/api_docs/kbn_core_mount_utils_browser.mdx index 337b42b96190d..b658b6d8e184c 100644 --- a/api_docs/kbn_core_mount_utils_browser.mdx +++ b/api_docs/kbn_core_mount_utils_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-mount-utils-browser title: "@kbn/core-mount-utils-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-mount-utils-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-mount-utils-browser'] --- import kbnCoreMountUtilsBrowserObj from './kbn_core_mount_utils_browser.devdocs.json'; diff --git a/api_docs/kbn_core_node_server.mdx b/api_docs/kbn_core_node_server.mdx index 4fec95172600a..0b429766b09d3 100644 --- a/api_docs/kbn_core_node_server.mdx +++ b/api_docs/kbn_core_node_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server title: "@kbn/core-node-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-node-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server'] --- import kbnCoreNodeServerObj from './kbn_core_node_server.devdocs.json'; diff --git a/api_docs/kbn_core_node_server_internal.mdx b/api_docs/kbn_core_node_server_internal.mdx index 29e715d0d55b1..63ed8abfea872 100644 --- a/api_docs/kbn_core_node_server_internal.mdx +++ b/api_docs/kbn_core_node_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-internal title: "@kbn/core-node-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-node-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-internal'] --- import kbnCoreNodeServerInternalObj from './kbn_core_node_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_node_server_mocks.mdx b/api_docs/kbn_core_node_server_mocks.mdx index c1621620d938d..1c5ba67da8ee9 100644 --- a/api_docs/kbn_core_node_server_mocks.mdx +++ b/api_docs/kbn_core_node_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-node-server-mocks title: "@kbn/core-node-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-node-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-node-server-mocks'] --- import kbnCoreNodeServerMocksObj from './kbn_core_node_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_notifications_browser.mdx b/api_docs/kbn_core_notifications_browser.mdx index d7e1099d545a9..1b8b6a4011316 100644 --- a/api_docs/kbn_core_notifications_browser.mdx +++ b/api_docs/kbn_core_notifications_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser title: "@kbn/core-notifications-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-notifications-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser'] --- import kbnCoreNotificationsBrowserObj from './kbn_core_notifications_browser.devdocs.json'; diff --git a/api_docs/kbn_core_notifications_browser_internal.mdx b/api_docs/kbn_core_notifications_browser_internal.mdx index 08c1598007300..d4a19e1974d72 100644 --- a/api_docs/kbn_core_notifications_browser_internal.mdx +++ b/api_docs/kbn_core_notifications_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-internal title: "@kbn/core-notifications-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-notifications-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-internal'] --- import kbnCoreNotificationsBrowserInternalObj from './kbn_core_notifications_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_notifications_browser_mocks.mdx b/api_docs/kbn_core_notifications_browser_mocks.mdx index a19ee6682f1de..e827260aa6cde 100644 --- a/api_docs/kbn_core_notifications_browser_mocks.mdx +++ b/api_docs/kbn_core_notifications_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-notifications-browser-mocks title: "@kbn/core-notifications-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-notifications-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-notifications-browser-mocks'] --- import kbnCoreNotificationsBrowserMocksObj from './kbn_core_notifications_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_overlays_browser.mdx b/api_docs/kbn_core_overlays_browser.mdx index 353346d8b2134..158cc35410965 100644 --- a/api_docs/kbn_core_overlays_browser.mdx +++ b/api_docs/kbn_core_overlays_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser title: "@kbn/core-overlays-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-overlays-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser'] --- import kbnCoreOverlaysBrowserObj from './kbn_core_overlays_browser.devdocs.json'; diff --git a/api_docs/kbn_core_overlays_browser_internal.mdx b/api_docs/kbn_core_overlays_browser_internal.mdx index b19493a9538be..e8bb1bd1bc31c 100644 --- a/api_docs/kbn_core_overlays_browser_internal.mdx +++ b/api_docs/kbn_core_overlays_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-internal title: "@kbn/core-overlays-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-overlays-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-internal'] --- import kbnCoreOverlaysBrowserInternalObj from './kbn_core_overlays_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_overlays_browser_mocks.mdx b/api_docs/kbn_core_overlays_browser_mocks.mdx index 2bb7d9828fa66..e9f2c8f73e737 100644 --- a/api_docs/kbn_core_overlays_browser_mocks.mdx +++ b/api_docs/kbn_core_overlays_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-overlays-browser-mocks title: "@kbn/core-overlays-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-overlays-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-overlays-browser-mocks'] --- import kbnCoreOverlaysBrowserMocksObj from './kbn_core_overlays_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_plugins_browser.mdx b/api_docs/kbn_core_plugins_browser.mdx index 0eb16427a9a12..9eb152b09c468 100644 --- a/api_docs/kbn_core_plugins_browser.mdx +++ b/api_docs/kbn_core_plugins_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser title: "@kbn/core-plugins-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-plugins-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser'] --- import kbnCorePluginsBrowserObj from './kbn_core_plugins_browser.devdocs.json'; diff --git a/api_docs/kbn_core_plugins_browser_mocks.mdx b/api_docs/kbn_core_plugins_browser_mocks.mdx index eeb1c6c9031c0..1d8bd1cf108e8 100644 --- a/api_docs/kbn_core_plugins_browser_mocks.mdx +++ b/api_docs/kbn_core_plugins_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-browser-mocks title: "@kbn/core-plugins-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-plugins-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-browser-mocks'] --- import kbnCorePluginsBrowserMocksObj from './kbn_core_plugins_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_plugins_server.mdx b/api_docs/kbn_core_plugins_server.mdx index d279efbb46f03..eab16379dcbe6 100644 --- a/api_docs/kbn_core_plugins_server.mdx +++ b/api_docs/kbn_core_plugins_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server title: "@kbn/core-plugins-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-plugins-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server'] --- import kbnCorePluginsServerObj from './kbn_core_plugins_server.devdocs.json'; diff --git a/api_docs/kbn_core_plugins_server_mocks.mdx b/api_docs/kbn_core_plugins_server_mocks.mdx index 639f4ec5d932e..0a44e2babb9b4 100644 --- a/api_docs/kbn_core_plugins_server_mocks.mdx +++ b/api_docs/kbn_core_plugins_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-plugins-server-mocks title: "@kbn/core-plugins-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-plugins-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-plugins-server-mocks'] --- import kbnCorePluginsServerMocksObj from './kbn_core_plugins_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_preboot_server.mdx b/api_docs/kbn_core_preboot_server.mdx index 34d716a4264f2..7373ca1c1196d 100644 --- a/api_docs/kbn_core_preboot_server.mdx +++ b/api_docs/kbn_core_preboot_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server title: "@kbn/core-preboot-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-preboot-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server'] --- import kbnCorePrebootServerObj from './kbn_core_preboot_server.devdocs.json'; diff --git a/api_docs/kbn_core_preboot_server_mocks.mdx b/api_docs/kbn_core_preboot_server_mocks.mdx index f2ddd9752409b..7a2f52e5a2e0d 100644 --- a/api_docs/kbn_core_preboot_server_mocks.mdx +++ b/api_docs/kbn_core_preboot_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-preboot-server-mocks title: "@kbn/core-preboot-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-preboot-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-preboot-server-mocks'] --- import kbnCorePrebootServerMocksObj from './kbn_core_preboot_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_rendering_browser_mocks.mdx b/api_docs/kbn_core_rendering_browser_mocks.mdx index 2dbe503efe103..efbcf9b9bc4bf 100644 --- a/api_docs/kbn_core_rendering_browser_mocks.mdx +++ b/api_docs/kbn_core_rendering_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-browser-mocks title: "@kbn/core-rendering-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-rendering-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-browser-mocks'] --- import kbnCoreRenderingBrowserMocksObj from './kbn_core_rendering_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_rendering_server_internal.mdx b/api_docs/kbn_core_rendering_server_internal.mdx index f628611b6dd89..90d51b25871f2 100644 --- a/api_docs/kbn_core_rendering_server_internal.mdx +++ b/api_docs/kbn_core_rendering_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-internal title: "@kbn/core-rendering-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-rendering-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-internal'] --- import kbnCoreRenderingServerInternalObj from './kbn_core_rendering_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_rendering_server_mocks.mdx b/api_docs/kbn_core_rendering_server_mocks.mdx index 7bee735adc7d9..50a83f6610b24 100644 --- a/api_docs/kbn_core_rendering_server_mocks.mdx +++ b/api_docs/kbn_core_rendering_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-rendering-server-mocks title: "@kbn/core-rendering-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-rendering-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-rendering-server-mocks'] --- import kbnCoreRenderingServerMocksObj from './kbn_core_rendering_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_root_server_internal.mdx b/api_docs/kbn_core_root_server_internal.mdx index 8c9d4f2a11c08..878d017a5bb44 100644 --- a/api_docs/kbn_core_root_server_internal.mdx +++ b/api_docs/kbn_core_root_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-root-server-internal title: "@kbn/core-root-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-root-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-root-server-internal'] --- import kbnCoreRootServerInternalObj from './kbn_core_root_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_api_browser.mdx b/api_docs/kbn_core_saved_objects_api_browser.mdx index c0d01cc0786dd..83c5c046bf0cf 100644 --- a/api_docs/kbn_core_saved_objects_api_browser.mdx +++ b/api_docs/kbn_core_saved_objects_api_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-browser title: "@kbn/core-saved-objects-api-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-api-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-browser'] --- import kbnCoreSavedObjectsApiBrowserObj from './kbn_core_saved_objects_api_browser.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_api_server.mdx b/api_docs/kbn_core_saved_objects_api_server.mdx index 45cc33cdccd8f..e7b0e9282a3d7 100644 --- a/api_docs/kbn_core_saved_objects_api_server.mdx +++ b/api_docs/kbn_core_saved_objects_api_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server title: "@kbn/core-saved-objects-api-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-api-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server'] --- import kbnCoreSavedObjectsApiServerObj from './kbn_core_saved_objects_api_server.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_api_server_internal.mdx b/api_docs/kbn_core_saved_objects_api_server_internal.mdx index 4cb0bd225724a..3aee7c286a160 100644 --- a/api_docs/kbn_core_saved_objects_api_server_internal.mdx +++ b/api_docs/kbn_core_saved_objects_api_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-internal title: "@kbn/core-saved-objects-api-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-api-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-internal'] --- import kbnCoreSavedObjectsApiServerInternalObj from './kbn_core_saved_objects_api_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx index 03e009ba04b02..da2b8ae4e1d29 100644 --- a/api_docs/kbn_core_saved_objects_api_server_mocks.mdx +++ b/api_docs/kbn_core_saved_objects_api_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-api-server-mocks title: "@kbn/core-saved-objects-api-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-api-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-api-server-mocks'] --- import kbnCoreSavedObjectsApiServerMocksObj from './kbn_core_saved_objects_api_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_base_server_internal.mdx b/api_docs/kbn_core_saved_objects_base_server_internal.mdx index cdffca564cd74..3018c3bb67932 100644 --- a/api_docs/kbn_core_saved_objects_base_server_internal.mdx +++ b/api_docs/kbn_core_saved_objects_base_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-internal title: "@kbn/core-saved-objects-base-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-base-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-internal'] --- import kbnCoreSavedObjectsBaseServerInternalObj from './kbn_core_saved_objects_base_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx index 187cff3f40b42..2b4ffeac60448 100644 --- a/api_docs/kbn_core_saved_objects_base_server_mocks.mdx +++ b/api_docs/kbn_core_saved_objects_base_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-base-server-mocks title: "@kbn/core-saved-objects-base-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-base-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-base-server-mocks'] --- import kbnCoreSavedObjectsBaseServerMocksObj from './kbn_core_saved_objects_base_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_browser.mdx b/api_docs/kbn_core_saved_objects_browser.mdx index 460dac8573db4..00cd38ae9d342 100644 --- a/api_docs/kbn_core_saved_objects_browser.mdx +++ b/api_docs/kbn_core_saved_objects_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser title: "@kbn/core-saved-objects-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser'] --- import kbnCoreSavedObjectsBrowserObj from './kbn_core_saved_objects_browser.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_browser_internal.mdx b/api_docs/kbn_core_saved_objects_browser_internal.mdx index ef7070674ac26..09ae6cd4322b7 100644 --- a/api_docs/kbn_core_saved_objects_browser_internal.mdx +++ b/api_docs/kbn_core_saved_objects_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-internal title: "@kbn/core-saved-objects-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-internal'] --- import kbnCoreSavedObjectsBrowserInternalObj from './kbn_core_saved_objects_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_browser_mocks.mdx b/api_docs/kbn_core_saved_objects_browser_mocks.mdx index 95fd818c0a922..0b3852e2f315d 100644 --- a/api_docs/kbn_core_saved_objects_browser_mocks.mdx +++ b/api_docs/kbn_core_saved_objects_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-browser-mocks title: "@kbn/core-saved-objects-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-browser-mocks'] --- import kbnCoreSavedObjectsBrowserMocksObj from './kbn_core_saved_objects_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_common.devdocs.json b/api_docs/kbn_core_saved_objects_common.devdocs.json index 748f954221ef6..0b1701f00d67d 100644 --- a/api_docs/kbn_core_saved_objects_common.devdocs.json +++ b/api_docs/kbn_core_saved_objects_common.devdocs.json @@ -1444,14 +1444,6 @@ "plugin": "@kbn/core-saved-objects-browser-mocks", "path": "packages/core/saved-objects/core-saved-objects-browser-mocks/src/simple_saved_object.mock.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/encryption.ts" - }, { "plugin": "@kbn/core-saved-objects-server", "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" @@ -1464,210 +1456,6 @@ "plugin": "@kbn/core-saved-objects-server", "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/export.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/saved_objects_management.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/saved_objects_client.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/update_objects_spaces.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.ts" - }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/errors.ts" @@ -1678,1071 +1466,383 @@ }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/collect_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_objects_filter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/split_overwrites.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/validate_references.ts" + "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "core", + "path": "src/core/types/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "apm", + "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.ts" + "plugin": "savedObjectsTaggingOss", + "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/so_references.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/errors.ts" + "plugin": "lists", + "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/utils.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/import.ts" - }, - { - "plugin": "core", - "path": "src/core/types/index.ts" - }, - { - "plugin": "apm", - "path": "x-pack/plugins/apm/server/routes/settings/apm_indices/route.ts" - }, - { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" - }, - { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" - }, - { - "plugin": "savedObjectsTaggingOss", - "path": "src/plugins/saved_objects_tagging_oss/public/api.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/so_references.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "lists", - "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/public/utils.test.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/host_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" - }, - { - "plugin": "securitySolution", - "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" - }, - { - "plugin": "upgradeAssistant", - "path": "x-pack/plugins/upgrade_assistant/common/types.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "savedObjectsTagging", - "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_view.stub.ts" - }, - { - "plugin": "dataViews", - "path": "src/plugins/data_views/common/data_view.stub.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "savedObjectsManagement", - "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "data", - "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "security", - "path": "x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "encryptedSavedObjects", - "path": "x-pack/plugins/encrypted_saved_objects/server/saved_objects/saved_objects_encryption_extension.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "lens", - "path": "x-pack/plugins/lens/server/embeddable/make_lens_embeddable_factory.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/authorization/authorization.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/common/types.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" - }, - { - "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" + "plugin": "securitySolution", + "path": "x-pack/plugins/security_solution/server/lib/risk_score/prebuilt_saved_objects/saved_object/user_risk_score_dashboards.ts" }, { "plugin": "synthetics", - "path": "x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/test_helpers.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "fleet", - "path": "x-pack/plugins/fleet/server/services/agents/action.mock.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "observability", - "path": "x-pack/plugins/observability/server/services/slo/fixtures/slo.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-browser-internal", - "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/internal_bulk_resolve.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.security_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.spaces_extension.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_details/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/overview/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" + "plugin": "upgradeAssistant", + "path": "x-pack/plugins/upgrade_assistant/common/types.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/apply_export_transforms.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "savedObjectsTagging", + "path": "x-pack/plugins/saved_objects_tagging/common/test_utils/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_view.stub.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "dataViews", + "path": "src/plugins/data_views/common/data_view.stub.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/collect_exported_objects.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/saved_objects_exporter.test.ts" + "plugin": "savedObjectsManagement", + "path": "src/plugins/saved_objects_management/server/lib/find_relationships.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/sort_objects.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/export/utils.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/import_saved_objects.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "data", + "path": "src/plugins/data/server/search/saved_objects/search_session_migration.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/operations/find.ts" }, { - "plugin": "@kbn/core-ui-settings-server-internal", - "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/api.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/effects.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/state/monitor_list/index.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "synthetics", + "path": "x-pack/plugins/synthetics/public/apps/synthetics/components/settings/hooks/use_params_list.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/create_saved_objects.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/execute_import_hooks.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/extract_errors.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/get_import_state_map_for_retries.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/regenerate_ids.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" + "plugin": "@kbn/core-saved-objects-browser-internal", + "path": "packages/core/saved-objects/core-saved-objects-browser-internal/src/simple_saved_object.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" }, { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/import_dashboards.test.ts" + "plugin": "@kbn/core-ui-settings-server-internal", + "path": "packages/core/ui-settings/core-ui-settings-server-internal/src/saved_objects/transforms.test.ts" } ], "initialIsOpen": false @@ -2813,30 +1913,6 @@ { "plugin": "core", "path": "src/core/types/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.13/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" } ], "initialIsOpen": false @@ -3210,22 +2286,6 @@ "plugin": "ml", "path": "x-pack/plugins/ml/common/types/modules.ts" }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, { "plugin": "dashboard", "path": "src/plugins/dashboard/public/services/dashboard_saved_object/lib/save_dashboard_state_to_saved_object.ts" @@ -3233,14 +2293,6 @@ { "plugin": "dashboard", "path": "src/plugins/dashboard/public/services/dashboard_saved_object/lib/save_dashboard_state_to_saved_object.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" } ], "initialIsOpen": false @@ -3673,22 +2725,6 @@ "plugin": "savedObjectsTaggingOss", "path": "src/plugins/saved_objects_tagging_oss/public/decorator/inject_tag_references.test.ts" }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, - { - "plugin": "@kbn/core-saved-objects-server", - "path": "packages/core/saved-objects/core-saved-objects-server/src/serialization.ts" - }, { "plugin": "core", "path": "src/core/types/index.ts" @@ -4233,38 +3269,6 @@ "plugin": "data", "path": "src/plugins/data/common/search/search_source/inject_references.test.ts" }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, - { - "plugin": "alerting", - "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.16/index.ts" - }, { "plugin": "lens", "path": "x-pack/plugins/lens/common/locator/locator.ts" @@ -4286,64 +3290,76 @@ "path": "x-pack/plugins/lens/public/app_plugin/share_action.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/types.ts" }, { - "plugin": "cases", - "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/types.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/test_helpers/repository.test.common.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/cpu.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/load.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/memory.ts" }, { - "plugin": "@kbn/core-saved-objects-api-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/repository.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/rx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/resolve_import_errors.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/tx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/tx.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_read.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_read.ts" }, { - "plugin": "@kbn/core-saved-objects-import-export-server-internal", - "path": "packages/core/saved-objects/core-saved-objects-import-export-server-internal/src/import/lib/check_origin_conflicts.test.ts" + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_write.ts" + }, + { + "plugin": "infra", + "path": "x-pack/plugins/infra/public/common/visualizations/lens/hosts/diskio_write.ts" + }, + { + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" + }, + { + "plugin": "cases", + "path": "x-pack/plugins/cases/server/services/user_actions/test_utils.ts" } ], "initialIsOpen": false diff --git a/api_docs/kbn_core_saved_objects_common.mdx b/api_docs/kbn_core_saved_objects_common.mdx index 002444fe5b442..3e641597dba82 100644 --- a/api_docs/kbn_core_saved_objects_common.mdx +++ b/api_docs/kbn_core_saved_objects_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-common title: "@kbn/core-saved-objects-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-common'] --- import kbnCoreSavedObjectsCommonObj from './kbn_core_saved_objects_common.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx index d3e633f0de9aa..ac7463c31ab38 100644 --- a/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx +++ b/api_docs/kbn_core_saved_objects_import_export_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-internal title: "@kbn/core-saved-objects-import-export-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-import-export-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-internal'] --- import kbnCoreSavedObjectsImportExportServerInternalObj from './kbn_core_saved_objects_import_export_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx index 55d37320e6d36..5ad06cc84820a 100644 --- a/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx +++ b/api_docs/kbn_core_saved_objects_import_export_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-import-export-server-mocks title: "@kbn/core-saved-objects-import-export-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-import-export-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-import-export-server-mocks'] --- import kbnCoreSavedObjectsImportExportServerMocksObj from './kbn_core_saved_objects_import_export_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx index 3c779e4848996..6d3db88834288 100644 --- a/api_docs/kbn_core_saved_objects_migration_server_internal.mdx +++ b/api_docs/kbn_core_saved_objects_migration_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-internal title: "@kbn/core-saved-objects-migration-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-migration-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-internal'] --- import kbnCoreSavedObjectsMigrationServerInternalObj from './kbn_core_saved_objects_migration_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx index 1c182be9cdb07..e8b6d67c622e4 100644 --- a/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx +++ b/api_docs/kbn_core_saved_objects_migration_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-migration-server-mocks title: "@kbn/core-saved-objects-migration-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-migration-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-migration-server-mocks'] --- import kbnCoreSavedObjectsMigrationServerMocksObj from './kbn_core_saved_objects_migration_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_server.devdocs.json b/api_docs/kbn_core_saved_objects_server.devdocs.json index b4dac3d8ec4ea..106d023c52af4 100644 --- a/api_docs/kbn_core_saved_objects_server.devdocs.json +++ b/api_docs/kbn_core_saved_objects_server.devdocs.json @@ -58,21 +58,14 @@ { "parentPluginId": "@kbn/core-saved-objects-server", "id": "def-common.AddAuditEventParams.outcome", - "type": "CompoundType", + "type": "string", "tags": [], "label": "outcome", "description": [ "\nThe outcome of the operation\n'failure' | 'success' | 'unknown'" ], "signature": [ - { - "pluginId": "@kbn/ecs", - "scope": "common", - "docId": "kibKbnEcsPluginApi", - "section": "def-common.EcsEventOutcome", - "text": "EcsEventOutcome" - }, - " | undefined" + "string | undefined" ], "path": "packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts", "deprecated": false, @@ -2806,6 +2799,30 @@ { "plugin": "savedSearch", "path": "src/plugins/saved_search/server/saved_objects/search_migrations.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.11/index.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" + }, + { + "plugin": "alerting", + "path": "x-pack/plugins/alerting/server/saved_objects/migrations/7.15/index.ts" + }, + { + "plugin": "@kbn/core-saved-objects-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" + }, + { + "plugin": "@kbn/core-saved-objects-server-internal", + "path": "packages/core/saved-objects/core-saved-objects-server-internal/src/routes/legacy_import_export/lib/collect_references_deep.test.ts" } ], "children": [ diff --git a/api_docs/kbn_core_saved_objects_server.mdx b/api_docs/kbn_core_saved_objects_server.mdx index 2a9401298559d..d20bc0c7269a6 100644 --- a/api_docs/kbn_core_saved_objects_server.mdx +++ b/api_docs/kbn_core_saved_objects_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server title: "@kbn/core-saved-objects-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server'] --- import kbnCoreSavedObjectsServerObj from './kbn_core_saved_objects_server.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_server_internal.mdx b/api_docs/kbn_core_saved_objects_server_internal.mdx index 2e40c1b5b1871..9e63518899840 100644 --- a/api_docs/kbn_core_saved_objects_server_internal.mdx +++ b/api_docs/kbn_core_saved_objects_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-internal title: "@kbn/core-saved-objects-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-internal'] --- import kbnCoreSavedObjectsServerInternalObj from './kbn_core_saved_objects_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_server_mocks.mdx b/api_docs/kbn_core_saved_objects_server_mocks.mdx index e37112ca2932c..a94734f123c4d 100644 --- a/api_docs/kbn_core_saved_objects_server_mocks.mdx +++ b/api_docs/kbn_core_saved_objects_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-server-mocks title: "@kbn/core-saved-objects-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-server-mocks'] --- import kbnCoreSavedObjectsServerMocksObj from './kbn_core_saved_objects_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_saved_objects_utils_server.mdx b/api_docs/kbn_core_saved_objects_utils_server.mdx index 3c7a95f4dc7d7..aacdd4a7aa8fd 100644 --- a/api_docs/kbn_core_saved_objects_utils_server.mdx +++ b/api_docs/kbn_core_saved_objects_utils_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-saved-objects-utils-server title: "@kbn/core-saved-objects-utils-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-saved-objects-utils-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-saved-objects-utils-server'] --- import kbnCoreSavedObjectsUtilsServerObj from './kbn_core_saved_objects_utils_server.devdocs.json'; diff --git a/api_docs/kbn_core_status_common.mdx b/api_docs/kbn_core_status_common.mdx index ab77a4f75b9b8..6e3b9e9ddf71d 100644 --- a/api_docs/kbn_core_status_common.mdx +++ b/api_docs/kbn_core_status_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common title: "@kbn/core-status-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-status-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common'] --- import kbnCoreStatusCommonObj from './kbn_core_status_common.devdocs.json'; diff --git a/api_docs/kbn_core_status_common_internal.mdx b/api_docs/kbn_core_status_common_internal.mdx index c1fea24307a47..7c7542e471e0e 100644 --- a/api_docs/kbn_core_status_common_internal.mdx +++ b/api_docs/kbn_core_status_common_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-common-internal title: "@kbn/core-status-common-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-status-common-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-common-internal'] --- import kbnCoreStatusCommonInternalObj from './kbn_core_status_common_internal.devdocs.json'; diff --git a/api_docs/kbn_core_status_server.mdx b/api_docs/kbn_core_status_server.mdx index 20ced0d3eefff..19d794c47a3b1 100644 --- a/api_docs/kbn_core_status_server.mdx +++ b/api_docs/kbn_core_status_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server title: "@kbn/core-status-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-status-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server'] --- import kbnCoreStatusServerObj from './kbn_core_status_server.devdocs.json'; diff --git a/api_docs/kbn_core_status_server_internal.mdx b/api_docs/kbn_core_status_server_internal.mdx index 878afa6f4176d..eaedb938f3970 100644 --- a/api_docs/kbn_core_status_server_internal.mdx +++ b/api_docs/kbn_core_status_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-internal title: "@kbn/core-status-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-status-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-internal'] --- import kbnCoreStatusServerInternalObj from './kbn_core_status_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_status_server_mocks.mdx b/api_docs/kbn_core_status_server_mocks.mdx index c229bd8a6e0dd..9bf32252c0d65 100644 --- a/api_docs/kbn_core_status_server_mocks.mdx +++ b/api_docs/kbn_core_status_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-status-server-mocks title: "@kbn/core-status-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-status-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-status-server-mocks'] --- import kbnCoreStatusServerMocksObj from './kbn_core_status_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx index 1fe2fa49f42c9..171966abf3340 100644 --- a/api_docs/kbn_core_test_helpers_deprecations_getters.mdx +++ b/api_docs/kbn_core_test_helpers_deprecations_getters.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-deprecations-getters title: "@kbn/core-test-helpers-deprecations-getters" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-test-helpers-deprecations-getters plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-deprecations-getters'] --- import kbnCoreTestHelpersDeprecationsGettersObj from './kbn_core_test_helpers_deprecations_getters.devdocs.json'; diff --git a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx index 38bdb3014c5be..55c2c8bd0d23a 100644 --- a/api_docs/kbn_core_test_helpers_http_setup_browser.mdx +++ b/api_docs/kbn_core_test_helpers_http_setup_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-http-setup-browser title: "@kbn/core-test-helpers-http-setup-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-test-helpers-http-setup-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-http-setup-browser'] --- import kbnCoreTestHelpersHttpSetupBrowserObj from './kbn_core_test_helpers_http_setup_browser.devdocs.json'; diff --git a/api_docs/kbn_core_test_helpers_kbn_server.mdx b/api_docs/kbn_core_test_helpers_kbn_server.mdx index 8436eff2da97d..568a36a5b8819 100644 --- a/api_docs/kbn_core_test_helpers_kbn_server.mdx +++ b/api_docs/kbn_core_test_helpers_kbn_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-kbn-server title: "@kbn/core-test-helpers-kbn-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-test-helpers-kbn-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-kbn-server'] --- import kbnCoreTestHelpersKbnServerObj from './kbn_core_test_helpers_kbn_server.devdocs.json'; diff --git a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx index 51aa63e24d4f0..10060a5deb5be 100644 --- a/api_docs/kbn_core_test_helpers_so_type_serializer.mdx +++ b/api_docs/kbn_core_test_helpers_so_type_serializer.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-so-type-serializer title: "@kbn/core-test-helpers-so-type-serializer" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-test-helpers-so-type-serializer plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-so-type-serializer'] --- import kbnCoreTestHelpersSoTypeSerializerObj from './kbn_core_test_helpers_so_type_serializer.devdocs.json'; diff --git a/api_docs/kbn_core_test_helpers_test_utils.mdx b/api_docs/kbn_core_test_helpers_test_utils.mdx index ca50d95ad63df..50f974a6d0358 100644 --- a/api_docs/kbn_core_test_helpers_test_utils.mdx +++ b/api_docs/kbn_core_test_helpers_test_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-test-helpers-test-utils title: "@kbn/core-test-helpers-test-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-test-helpers-test-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-test-helpers-test-utils'] --- import kbnCoreTestHelpersTestUtilsObj from './kbn_core_test_helpers_test_utils.devdocs.json'; diff --git a/api_docs/kbn_core_theme_browser.mdx b/api_docs/kbn_core_theme_browser.mdx index b9a8fb1fda494..9aeff0c38f248 100644 --- a/api_docs/kbn_core_theme_browser.mdx +++ b/api_docs/kbn_core_theme_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser title: "@kbn/core-theme-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-theme-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser'] --- import kbnCoreThemeBrowserObj from './kbn_core_theme_browser.devdocs.json'; diff --git a/api_docs/kbn_core_theme_browser_internal.mdx b/api_docs/kbn_core_theme_browser_internal.mdx index 5eba0869f8339..7ced5d35ca9ea 100644 --- a/api_docs/kbn_core_theme_browser_internal.mdx +++ b/api_docs/kbn_core_theme_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-internal title: "@kbn/core-theme-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-theme-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-internal'] --- import kbnCoreThemeBrowserInternalObj from './kbn_core_theme_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_theme_browser_mocks.mdx b/api_docs/kbn_core_theme_browser_mocks.mdx index 1879c357339bb..20f2ae1a9c206 100644 --- a/api_docs/kbn_core_theme_browser_mocks.mdx +++ b/api_docs/kbn_core_theme_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-theme-browser-mocks title: "@kbn/core-theme-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-theme-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-theme-browser-mocks'] --- import kbnCoreThemeBrowserMocksObj from './kbn_core_theme_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_browser.mdx b/api_docs/kbn_core_ui_settings_browser.mdx index ddc0c181695db..bb36954ebd1f5 100644 --- a/api_docs/kbn_core_ui_settings_browser.mdx +++ b/api_docs/kbn_core_ui_settings_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser title: "@kbn/core-ui-settings-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser'] --- import kbnCoreUiSettingsBrowserObj from './kbn_core_ui_settings_browser.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_browser_internal.mdx b/api_docs/kbn_core_ui_settings_browser_internal.mdx index ed2194c8a708e..4d54ff1d75227 100644 --- a/api_docs/kbn_core_ui_settings_browser_internal.mdx +++ b/api_docs/kbn_core_ui_settings_browser_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-internal title: "@kbn/core-ui-settings-browser-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-browser-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-internal'] --- import kbnCoreUiSettingsBrowserInternalObj from './kbn_core_ui_settings_browser_internal.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_browser_mocks.mdx b/api_docs/kbn_core_ui_settings_browser_mocks.mdx index cc1e5629c0cca..a3797baea0bfe 100644 --- a/api_docs/kbn_core_ui_settings_browser_mocks.mdx +++ b/api_docs/kbn_core_ui_settings_browser_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-browser-mocks title: "@kbn/core-ui-settings-browser-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-browser-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-browser-mocks'] --- import kbnCoreUiSettingsBrowserMocksObj from './kbn_core_ui_settings_browser_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_common.mdx b/api_docs/kbn_core_ui_settings_common.mdx index 788e20d34853a..a4c239118cd0f 100644 --- a/api_docs/kbn_core_ui_settings_common.mdx +++ b/api_docs/kbn_core_ui_settings_common.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-common title: "@kbn/core-ui-settings-common" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-common plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-common'] --- import kbnCoreUiSettingsCommonObj from './kbn_core_ui_settings_common.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_server.mdx b/api_docs/kbn_core_ui_settings_server.mdx index 982e4e4c68261..8d7e4bcbcee36 100644 --- a/api_docs/kbn_core_ui_settings_server.mdx +++ b/api_docs/kbn_core_ui_settings_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server title: "@kbn/core-ui-settings-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server'] --- import kbnCoreUiSettingsServerObj from './kbn_core_ui_settings_server.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_server_internal.mdx b/api_docs/kbn_core_ui_settings_server_internal.mdx index 4c83bbc9fe2cb..f22894c3c3d5b 100644 --- a/api_docs/kbn_core_ui_settings_server_internal.mdx +++ b/api_docs/kbn_core_ui_settings_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-internal title: "@kbn/core-ui-settings-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-internal'] --- import kbnCoreUiSettingsServerInternalObj from './kbn_core_ui_settings_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_ui_settings_server_mocks.mdx b/api_docs/kbn_core_ui_settings_server_mocks.mdx index 9fb8da253474b..f20ffe1b0086b 100644 --- a/api_docs/kbn_core_ui_settings_server_mocks.mdx +++ b/api_docs/kbn_core_ui_settings_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-ui-settings-server-mocks title: "@kbn/core-ui-settings-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-ui-settings-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-ui-settings-server-mocks'] --- import kbnCoreUiSettingsServerMocksObj from './kbn_core_ui_settings_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_core_usage_data_server.mdx b/api_docs/kbn_core_usage_data_server.mdx index b27796dc85af4..a66c933b1d138 100644 --- a/api_docs/kbn_core_usage_data_server.mdx +++ b/api_docs/kbn_core_usage_data_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server title: "@kbn/core-usage-data-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-usage-data-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server'] --- import kbnCoreUsageDataServerObj from './kbn_core_usage_data_server.devdocs.json'; diff --git a/api_docs/kbn_core_usage_data_server_internal.mdx b/api_docs/kbn_core_usage_data_server_internal.mdx index c8f6bc900e15c..7fcea26e9ade8 100644 --- a/api_docs/kbn_core_usage_data_server_internal.mdx +++ b/api_docs/kbn_core_usage_data_server_internal.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-internal title: "@kbn/core-usage-data-server-internal" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-usage-data-server-internal plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-internal'] --- import kbnCoreUsageDataServerInternalObj from './kbn_core_usage_data_server_internal.devdocs.json'; diff --git a/api_docs/kbn_core_usage_data_server_mocks.mdx b/api_docs/kbn_core_usage_data_server_mocks.mdx index a53913bd9e65c..dbe41bc4bd9b3 100644 --- a/api_docs/kbn_core_usage_data_server_mocks.mdx +++ b/api_docs/kbn_core_usage_data_server_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-core-usage-data-server-mocks title: "@kbn/core-usage-data-server-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/core-usage-data-server-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/core-usage-data-server-mocks'] --- import kbnCoreUsageDataServerMocksObj from './kbn_core_usage_data_server_mocks.devdocs.json'; diff --git a/api_docs/kbn_crypto.mdx b/api_docs/kbn_crypto.mdx index aa9ba3d5893a3..aa21e0db42bfa 100644 --- a/api_docs/kbn_crypto.mdx +++ b/api_docs/kbn_crypto.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto title: "@kbn/crypto" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/crypto plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto'] --- import kbnCryptoObj from './kbn_crypto.devdocs.json'; diff --git a/api_docs/kbn_crypto_browser.mdx b/api_docs/kbn_crypto_browser.mdx index 88233251ee0e7..cc237aa72479a 100644 --- a/api_docs/kbn_crypto_browser.mdx +++ b/api_docs/kbn_crypto_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-crypto-browser title: "@kbn/crypto-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/crypto-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/crypto-browser'] --- import kbnCryptoBrowserObj from './kbn_crypto_browser.devdocs.json'; diff --git a/api_docs/kbn_cypress_config.mdx b/api_docs/kbn_cypress_config.mdx index b2c73b8236f1a..5bf03a346a56b 100644 --- a/api_docs/kbn_cypress_config.mdx +++ b/api_docs/kbn_cypress_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-cypress-config title: "@kbn/cypress-config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/cypress-config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/cypress-config'] --- import kbnCypressConfigObj from './kbn_cypress_config.devdocs.json'; diff --git a/api_docs/kbn_datemath.mdx b/api_docs/kbn_datemath.mdx index 14761aa0366fb..1b2585bec69aa 100644 --- a/api_docs/kbn_datemath.mdx +++ b/api_docs/kbn_datemath.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-datemath title: "@kbn/datemath" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/datemath plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/datemath'] --- import kbnDatemathObj from './kbn_datemath.devdocs.json'; diff --git a/api_docs/kbn_dev_cli_errors.mdx b/api_docs/kbn_dev_cli_errors.mdx index ab5ba6a8158a3..9295cc5f1325c 100644 --- a/api_docs/kbn_dev_cli_errors.mdx +++ b/api_docs/kbn_dev_cli_errors.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-errors title: "@kbn/dev-cli-errors" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/dev-cli-errors plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-errors'] --- import kbnDevCliErrorsObj from './kbn_dev_cli_errors.devdocs.json'; diff --git a/api_docs/kbn_dev_cli_runner.mdx b/api_docs/kbn_dev_cli_runner.mdx index dcbdc60c41500..91d1fbf70db4e 100644 --- a/api_docs/kbn_dev_cli_runner.mdx +++ b/api_docs/kbn_dev_cli_runner.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-cli-runner title: "@kbn/dev-cli-runner" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/dev-cli-runner plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-cli-runner'] --- import kbnDevCliRunnerObj from './kbn_dev_cli_runner.devdocs.json'; diff --git a/api_docs/kbn_dev_proc_runner.mdx b/api_docs/kbn_dev_proc_runner.mdx index 5458a945a9da0..1861816165361 100644 --- a/api_docs/kbn_dev_proc_runner.mdx +++ b/api_docs/kbn_dev_proc_runner.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-proc-runner title: "@kbn/dev-proc-runner" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/dev-proc-runner plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-proc-runner'] --- import kbnDevProcRunnerObj from './kbn_dev_proc_runner.devdocs.json'; diff --git a/api_docs/kbn_dev_utils.devdocs.json b/api_docs/kbn_dev_utils.devdocs.json index adb4510de09bb..2d366c4839e72 100644 --- a/api_docs/kbn_dev_utils.devdocs.json +++ b/api_docs/kbn_dev_utils.devdocs.json @@ -202,23 +202,6 @@ "returnComment": [], "initialIsOpen": false }, - { - "parentPluginId": "@kbn/dev-utils", - "id": "def-common.shipCiStatsCli", - "type": "Function", - "tags": [], - "label": "shipCiStatsCli", - "description": [], - "signature": [ - "() => void" - ], - "path": "packages/kbn-dev-utils/src/ship_ci_stats_cli.ts", - "deprecated": false, - "trackAdoption": false, - "children": [], - "returnComment": [], - "initialIsOpen": false - }, { "parentPluginId": "@kbn/dev-utils", "id": "def-common.transformFileStream", diff --git a/api_docs/kbn_dev_utils.mdx b/api_docs/kbn_dev_utils.mdx index 7614c0594642e..7fe74f2ffb8af 100644 --- a/api_docs/kbn_dev_utils.mdx +++ b/api_docs/kbn_dev_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-dev-utils title: "@kbn/dev-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/dev-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/dev-utils'] --- import kbnDevUtilsObj from './kbn_dev_utils.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin. | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 28 | 2 | 25 | 0 | +| 27 | 2 | 24 | 0 | ## Common diff --git a/api_docs/kbn_doc_links.mdx b/api_docs/kbn_doc_links.mdx index 062c175e1c508..af4cb80422bdd 100644 --- a/api_docs/kbn_doc_links.mdx +++ b/api_docs/kbn_doc_links.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-doc-links title: "@kbn/doc-links" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/doc-links plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/doc-links'] --- import kbnDocLinksObj from './kbn_doc_links.devdocs.json'; diff --git a/api_docs/kbn_docs_utils.mdx b/api_docs/kbn_docs_utils.mdx index 7e7bacb575088..7924dee076eab 100644 --- a/api_docs/kbn_docs_utils.mdx +++ b/api_docs/kbn_docs_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-docs-utils title: "@kbn/docs-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/docs-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/docs-utils'] --- import kbnDocsUtilsObj from './kbn_docs_utils.devdocs.json'; diff --git a/api_docs/kbn_ebt_tools.mdx b/api_docs/kbn_ebt_tools.mdx index e15698a881a79..bd648c8df73cb 100644 --- a/api_docs/kbn_ebt_tools.mdx +++ b/api_docs/kbn_ebt_tools.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ebt-tools title: "@kbn/ebt-tools" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ebt-tools plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ebt-tools'] --- import kbnEbtToolsObj from './kbn_ebt_tools.devdocs.json'; diff --git a/api_docs/kbn_ecs.devdocs.json b/api_docs/kbn_ecs.devdocs.json index b5ca77e1a3dd3..32c5b52fbc08d 100644 --- a/api_docs/kbn_ecs.devdocs.json +++ b/api_docs/kbn_ecs.devdocs.json @@ -19,7 +19,8001 @@ "common": { "classes": [], "functions": [], - "interfaces": [], + "interfaces": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent", + "type": "Interface", + "tags": [], + "label": "EcsAgent", + "description": [ + "\nThe agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken." + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent.build", + "type": "Object", + "tags": [], + "label": "build", + "description": [], + "signature": [ + "{ original?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent.ephemeral_id", + "type": "string", + "tags": [], + "label": "ephemeral_id", + "description": [ + "\nEphemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nCustom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nType of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAgent.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nVersion of the agent." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/agent.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAs", + "type": "Interface", + "tags": [], + "label": "EcsAs", + "description": [ + "\nAn autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet." + ], + "path": "packages/kbn-ecs/generated/as.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAs.number", + "type": "number", + "tags": [], + "label": "number", + "description": [ + "\nUnique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/as.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsAs.organization", + "type": "Object", + "tags": [], + "label": "organization", + "description": [], + "signature": [ + "{ name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/as.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsBase", + "type": "Interface", + "tags": [], + "label": "EcsBase", + "description": [ + "\nThe `base` field set contains all fields which are at the root of the events. These fields are common across all types of events." + ], + "path": "packages/kbn-ecs/generated/base.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsBase.timestamp", + "type": "string", + "tags": [], + "label": "'@timestamp'", + "description": [ + "\nDate/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events." + ], + "path": "packages/kbn-ecs/generated/base.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsBase.labels", + "type": "Object", + "tags": [], + "label": "labels", + "description": [ + "\nCustom key/value pairs.\nCan be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.\nExample: `docker` and `k8s` labels." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/base.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsBase.message", + "type": "string", + "tags": [], + "label": "message", + "description": [ + "\nFor log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/base.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsBase.tags", + "type": "Array", + "tags": [], + "label": "tags", + "description": [ + "\nList of keywords used to tag each event." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/base.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient", + "type": "Interface", + "tags": [], + "label": "EcsClient", + "description": [ + "\nA client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records.\nFor TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term \"originator\" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events.\nClient / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately." + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.address", + "type": "string", + "tags": [], + "label": "address", + "description": [ + "\nSome event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.as", + "type": "Object", + "tags": [], + "label": "as", + "description": [], + "signature": [ + "{ number?: number | undefined; organization?: { name?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.bytes", + "type": "number", + "tags": [], + "label": "bytes", + "description": [ + "\nBytes sent from the client to the server." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nThe domain name of the client system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "signature": [ + "{ city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.ip", + "type": "string", + "tags": [], + "label": "ip", + "description": [ + "\nIP address of the client (IPv4 or IPv6)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.mac", + "type": "string", + "tags": [], + "label": "mac", + "description": [ + "\nMAC address of the client.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.nat", + "type": "Object", + "tags": [], + "label": "nat", + "description": [], + "signature": [ + "{ ip?: string | undefined; port?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.packets", + "type": "number", + "tags": [], + "label": "packets", + "description": [ + "\nPackets sent from the client to the server." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.port", + "type": "number", + "tags": [], + "label": "port", + "description": [ + "\nPort of the client." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.registered_domain", + "type": "string", + "tags": [], + "label": "registered_domain", + "description": [ + "\nThe highest registered client domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.subdomain", + "type": "string", + "tags": [], + "label": "subdomain", + "description": [ + "\nThe subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.top_level_domain", + "type": "string", + "tags": [], + "label": "top_level_domain", + "description": [ + "\nThe effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsClient.user", + "type": "Object", + "tags": [], + "label": "user", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/client.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud", + "type": "Interface", + "tags": [], + "label": "EcsCloud", + "description": [ + "\nFields related to the cloud or infrastructure the events are coming from." + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.account", + "type": "Object", + "tags": [], + "label": "account", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.availability_zone", + "type": "string", + "tags": [], + "label": "availability_zone", + "description": [ + "\nAvailability zone in which this host, resource, or service is located." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.instance", + "type": "Object", + "tags": [], + "label": "instance", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.machine", + "type": "Object", + "tags": [], + "label": "machine", + "description": [], + "signature": [ + "{ type?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.origin", + "type": "Object", + "tags": [], + "label": "origin", + "description": [], + "signature": [ + "{ account?: { id?: string | undefined; name?: string | undefined; } | undefined; availability_zone?: string | undefined; instance?: { id?: string | undefined; name?: string | undefined; } | undefined; machine?: { type?: string | undefined; } | undefined; project?: { id?: string | undefined; name?: string | undefined; } | undefined; provider?: string | undefined; region?: string | undefined; service?: { name?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.project", + "type": "Object", + "tags": [], + "label": "project", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.provider", + "type": "string", + "tags": [], + "label": "provider", + "description": [ + "\nName of the cloud provider. Example values are aws, azure, gcp, or digitalocean." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.region", + "type": "string", + "tags": [], + "label": "region", + "description": [ + "\nRegion in which this host, resource, or service is located." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.service", + "type": "Object", + "tags": [], + "label": "service", + "description": [], + "signature": [ + "{ name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCloud.target", + "type": "Object", + "tags": [], + "label": "target", + "description": [], + "signature": [ + "{ account?: { id?: string | undefined; name?: string | undefined; } | undefined; availability_zone?: string | undefined; instance?: { id?: string | undefined; name?: string | undefined; } | undefined; machine?: { type?: string | undefined; } | undefined; project?: { id?: string | undefined; name?: string | undefined; } | undefined; provider?: string | undefined; region?: string | undefined; service?: { name?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/cloud.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature", + "type": "Interface", + "tags": [], + "label": "EcsCodeSignature", + "description": [ + "\nThese fields contain information about binary code signatures." + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.digest_algorithm", + "type": "string", + "tags": [], + "label": "digest_algorithm", + "description": [ + "\nThe hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.exists", + "type": "CompoundType", + "tags": [], + "label": "exists", + "description": [ + "\nBoolean to capture if a signature is present." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.signing_id", + "type": "string", + "tags": [], + "label": "signing_id", + "description": [ + "\nThe identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.status", + "type": "string", + "tags": [], + "label": "status", + "description": [ + "\nAdditional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.subject_name", + "type": "string", + "tags": [], + "label": "subject_name", + "description": [ + "\nSubject name of the code signer" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.team_id", + "type": "string", + "tags": [], + "label": "team_id", + "description": [ + "\nThe team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.timestamp", + "type": "string", + "tags": [], + "label": "timestamp", + "description": [ + "\nDate and time when the code signature was generated and signed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.trusted", + "type": "CompoundType", + "tags": [], + "label": "trusted", + "description": [ + "\nStores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsCodeSignature.valid", + "type": "CompoundType", + "tags": [], + "label": "valid", + "description": [ + "\nBoolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/code_signature.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer", + "type": "Interface", + "tags": [], + "label": "EcsContainer", + "description": [ + "\nContainer fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime." + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.cpu", + "type": "Object", + "tags": [], + "label": "cpu", + "description": [], + "signature": [ + "{ usage?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.disk", + "type": "Object", + "tags": [], + "label": "disk", + "description": [], + "signature": [ + "{ read?: { bytes?: number | undefined; } | undefined; write?: { bytes?: number | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique container id." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.image", + "type": "Object", + "tags": [], + "label": "image", + "description": [], + "signature": [ + "{ hash?: { all?: string[] | undefined; } | undefined; name?: string | undefined; tag?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.labels", + "type": "Object", + "tags": [], + "label": "labels", + "description": [ + "\nImage labels." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.memory", + "type": "Object", + "tags": [], + "label": "memory", + "description": [], + "signature": [ + "{ usage?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nContainer name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.network", + "type": "Object", + "tags": [], + "label": "network", + "description": [], + "signature": [ + "{ egress?: { bytes?: number | undefined; } | undefined; ingress?: { bytes?: number | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsContainer.runtime", + "type": "string", + "tags": [], + "label": "runtime", + "description": [ + "\nRuntime managing this container." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/container.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDataStream", + "type": "Interface", + "tags": [], + "label": "EcsDataStream", + "description": [ + "\nThe data_stream fields take part in defining the new data stream naming scheme.\nIn the new data stream naming scheme the value of the data stream fields combine to the name of the actual data stream in the following manner: `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`. This means the fields can only contain characters that are valid as part of names of data streams. More details about this can be found in this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog post].\nAn Elasticsearch data stream consists of one or more backing indices, and a data stream name forms part of the backing indices names. Due to this convention, data streams must also follow index naming restrictions. For example, data stream names cannot include `\\`, `/`, `*`, `?`, `\"`, `<`, `>`, `|`, ` ` (space character), `,`, or `#`. Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions]." + ], + "path": "packages/kbn-ecs/generated/data_stream.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDataStream.dataset", + "type": "string", + "tags": [], + "label": "dataset", + "description": [ + "\nThe field can contain anything that makes sense to signify the source of the data.\nExamples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value \"generic\" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`.\nBeyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/data_stream.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDataStream.namespace", + "type": "string", + "tags": [], + "label": "namespace", + "description": [ + "\nA user defined namespace. Namespaces are useful to allow grouping of data.\nMany users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`.\nBeyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/data_stream.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDataStream.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nAn overarching type for the data stream.\nCurrently allowed values are \"logs\" and \"metrics\". We expect to also add \"traces\" and \"synthetics\" in the near future." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/data_stream.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination", + "type": "Interface", + "tags": [], + "label": "EcsDestination", + "description": [ + "\nDestination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated." + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.address", + "type": "string", + "tags": [], + "label": "address", + "description": [ + "\nSome event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.as", + "type": "Object", + "tags": [], + "label": "as", + "description": [], + "signature": [ + "{ number?: number | undefined; organization?: { name?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.bytes", + "type": "number", + "tags": [], + "label": "bytes", + "description": [ + "\nBytes sent from the destination to the source." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nThe domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "signature": [ + "{ city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.ip", + "type": "string", + "tags": [], + "label": "ip", + "description": [ + "\nIP address of the destination (IPv4 or IPv6)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.mac", + "type": "string", + "tags": [], + "label": "mac", + "description": [ + "\nMAC address of the destination.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.nat", + "type": "Object", + "tags": [], + "label": "nat", + "description": [], + "signature": [ + "{ ip?: string | undefined; port?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.packets", + "type": "number", + "tags": [], + "label": "packets", + "description": [ + "\nPackets sent from the destination to the source." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.port", + "type": "number", + "tags": [], + "label": "port", + "description": [ + "\nPort of the destination." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.registered_domain", + "type": "string", + "tags": [], + "label": "registered_domain", + "description": [ + "\nThe highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.subdomain", + "type": "string", + "tags": [], + "label": "subdomain", + "description": [ + "\nThe subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.top_level_domain", + "type": "string", + "tags": [], + "label": "top_level_domain", + "description": [ + "\nThe effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDestination.user", + "type": "Object", + "tags": [], + "label": "user", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/destination.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDevice", + "type": "Interface", + "tags": [], + "label": "EcsDevice", + "description": [ + "\nFields that describe a device instance and its characteristics. Data collected for applications and processes running on a (mobile) device can be enriched with these fields to describe the identity, type and other characteristics of the device.\nThis field group definition is based on the Device namespace of the OpenTelemetry Semantic Conventions (https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/device/)." + ], + "path": "packages/kbn-ecs/generated/device.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDevice.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nThe unique identifier of a device. The identifier must not change across application sessions but stay fixex for an instance of a (mobile) device.\nOn iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application.\nFor GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/device.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDevice.manufacturer", + "type": "string", + "tags": [], + "label": "manufacturer", + "description": [ + "\nThe vendor name of the device manufacturer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/device.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDevice.model", + "type": "Object", + "tags": [], + "label": "model", + "description": [], + "signature": [ + "{ identifier?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/device.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDll", + "type": "Interface", + "tags": [], + "label": "EcsDll", + "description": [ + "\nThese fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS" + ], + "path": "packages/kbn-ecs/generated/dll.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDll.code_signature", + "type": "Object", + "tags": [], + "label": "code_signature", + "description": [], + "signature": [ + "{ digest_algorithm?: string | undefined; exists?: boolean | undefined; signing_id?: string | undefined; status?: string | undefined; subject_name?: string | undefined; team_id?: string | undefined; timestamp?: string | undefined; trusted?: boolean | undefined; valid?: boolean | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/dll.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDll.hash", + "type": "Object", + "tags": [], + "label": "hash", + "description": [], + "signature": [ + "{ md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; sha384?: string | undefined; sha512?: string | undefined; ssdeep?: string | undefined; tlsh?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/dll.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDll.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the library.\nThis generally maps to the name of the file on disk." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/dll.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDll.path", + "type": "string", + "tags": [], + "label": "path", + "description": [ + "\nFull file path of the library." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/dll.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDll.pe", + "type": "Object", + "tags": [], + "label": "pe", + "description": [], + "signature": [ + "{ architecture?: string | undefined; company?: string | undefined; description?: string | undefined; file_version?: string | undefined; imphash?: string | undefined; original_file_name?: string | undefined; pehash?: string | undefined; product?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/dll.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns", + "type": "Interface", + "tags": [], + "label": "EcsDns", + "description": [ + "\nFields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`)." + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.answers", + "type": "Array", + "tags": [], + "label": "answers", + "description": [ + "\nAn array containing an object for each answer section returned by the server.\nThe main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.\nNot all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.header_flags", + "type": "Array", + "tags": [], + "label": "header_flags", + "description": [ + "\nArray of 2 letter DNS header flags." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nThe DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.op_code", + "type": "string", + "tags": [], + "label": "op_code", + "description": [ + "\nThe DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.question", + "type": "Object", + "tags": [], + "label": "question", + "description": [], + "signature": [ + "{ class?: string | undefined; name?: string | undefined; registered_domain?: string | undefined; subdomain?: string | undefined; top_level_domain?: string | undefined; type?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.resolved_ip", + "type": "Array", + "tags": [], + "label": "resolved_ip", + "description": [ + "\nArray containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.response_code", + "type": "string", + "tags": [], + "label": "response_code", + "description": [ + "\nThe DNS response code." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsDns.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nThe type of DNS event captured, query or answer.\nIf your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`.\nIf your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/dns.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEcs", + "type": "Interface", + "tags": [], + "label": "EcsEcs", + "description": [ + "\nMeta-information specific to ECS." + ], + "path": "packages/kbn-ecs/generated/ecs.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEcs.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events." + ], + "signature": [ + "\"8.6.0\"" + ], + "path": "packages/kbn-ecs/generated/ecs.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf", + "type": "Interface", + "tags": [], + "label": "EcsElf", + "description": [ + "\nThese fields contain Linux Executable Linkable Format (ELF) metadata." + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.architecture", + "type": "string", + "tags": [], + "label": "architecture", + "description": [ + "\nMachine architecture of the ELF file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.byte_order", + "type": "string", + "tags": [], + "label": "byte_order", + "description": [ + "\nByte sequence of ELF file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.cpu_type", + "type": "string", + "tags": [], + "label": "cpu_type", + "description": [ + "\nCPU type of the ELF file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.creation_date", + "type": "string", + "tags": [], + "label": "creation_date", + "description": [ + "\nExtracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.exports", + "type": "Array", + "tags": [], + "label": "exports", + "description": [ + "\nList of exported element names and types." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.header", + "type": "Object", + "tags": [], + "label": "header", + "description": [], + "signature": [ + "{ abi_version?: string | undefined; class?: string | undefined; data?: string | undefined; entrypoint?: number | undefined; object_version?: string | undefined; os_abi?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.imports", + "type": "Array", + "tags": [], + "label": "imports", + "description": [ + "\nList of imported element names and types." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.sections", + "type": "Array", + "tags": [], + "label": "sections", + "description": [ + "\nAn array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.segments", + "type": "Array", + "tags": [], + "label": "segments", + "description": [ + "\nAn array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.shared_libraries", + "type": "Array", + "tags": [], + "label": "shared_libraries", + "description": [ + "\nList of shared libraries used by this ELF object." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsElf.telfhash", + "type": "string", + "tags": [], + "label": "telfhash", + "description": [ + "\ntelfhash symbol hash for ELF file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/elf.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail", + "type": "Interface", + "tags": [], + "label": "EcsEmail", + "description": [ + "\nEvent details relating to an email transaction.\nThis field set focuses on the email message header, body, and attachments. Network protocols that send and receive email messages such as SMTP are outside the scope of the `email.*` fields." + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.attachments", + "type": "Array", + "tags": [], + "label": "attachments", + "description": [ + "\nA list of objects describing the attachment files sent along with an email message." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.bcc", + "type": "Object", + "tags": [], + "label": "bcc", + "description": [], + "signature": [ + "{ address?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.cc", + "type": "Object", + "tags": [], + "label": "cc", + "description": [], + "signature": [ + "{ address?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.content_type", + "type": "string", + "tags": [], + "label": "content_type", + "description": [ + "\nInformation about how the message is to be displayed.\nTypically a MIME type." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.delivery_timestamp", + "type": "string", + "tags": [], + "label": "delivery_timestamp", + "description": [ + "\nThe date and time when the email message was received by the service or client." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.direction", + "type": "string", + "tags": [], + "label": "direction", + "description": [ + "\nThe direction of the message based on the sending and receiving domains." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.from", + "type": "Object", + "tags": [], + "label": "from", + "description": [], + "signature": [ + "{ address?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.local_id", + "type": "string", + "tags": [], + "label": "local_id", + "description": [ + "\nUnique identifier given to the email by the source that created the event.\nIdentifier is not persistent across hops." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.message_id", + "type": "string", + "tags": [], + "label": "message_id", + "description": [ + "\nIdentifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.origination_timestamp", + "type": "string", + "tags": [], + "label": "origination_timestamp", + "description": [ + "\nThe date and time the email message was composed. Many email clients will fill in this value automatically when the message is sent by a user." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.reply_to", + "type": "Object", + "tags": [], + "label": "reply_to", + "description": [], + "signature": [ + "{ address?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.sender", + "type": "Object", + "tags": [], + "label": "sender", + "description": [], + "signature": [ + "{ address?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.subject", + "type": "string", + "tags": [], + "label": "subject", + "description": [ + "\nA brief summary of the topic of the message." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.to", + "type": "Object", + "tags": [], + "label": "to", + "description": [], + "signature": [ + "{ address?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEmail.x_mailer", + "type": "string", + "tags": [], + "label": "x_mailer", + "description": [ + "\nThe name of the application that was used to draft and send the original email message." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/email.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsError", + "type": "Interface", + "tags": [], + "label": "EcsError", + "description": [ + "\nThese fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error." + ], + "path": "packages/kbn-ecs/generated/error.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsError.code", + "type": "string", + "tags": [], + "label": "code", + "description": [ + "\nError code describing the error." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/error.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsError.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique identifier for the error." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/error.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsError.message", + "type": "string", + "tags": [], + "label": "message", + "description": [ + "\nError message." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/error.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsError.stack_trace", + "type": "string", + "tags": [], + "label": "stack_trace", + "description": [ + "\nThe stack trace of this error in plain text." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/error.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsError.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nThe type of the error, for example the class name of the exception." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/error.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent", + "type": "Interface", + "tags": [], + "label": "EcsEvent", + "description": [ + "\nThe event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events." + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.action", + "type": "string", + "tags": [], + "label": "action", + "description": [ + "\nThe action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.agent_id_status", + "type": "string", + "tags": [], + "label": "agent_id_status", + "description": [ + "\nAgents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation.\nFor example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used.\nIf no validation is performed then the field should be omitted.\nThe allowed values are:\n`verified` - The `agent.id` field value matches expected value obtained from auth metadata.\n`mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata.\n`missing` - There was no `agent.id` field in the event to validate.\n`auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.category", + "type": "Array", + "tags": [], + "label": "category", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.code", + "type": "string", + "tags": [], + "label": "code", + "description": [ + "\nIdentification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.created", + "type": "string", + "tags": [], + "label": "created", + "description": [ + "\nevent.created contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, @timestamp should be used." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.dataset", + "type": "string", + "tags": [], + "label": "dataset", + "description": [ + "\nName of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.duration", + "type": "number", + "tags": [], + "label": "duration", + "description": [ + "\nDuration of the event in nanoseconds.\nIf event.start and event.end are known this value should be the difference between the end and start time." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.end", + "type": "string", + "tags": [], + "label": "end", + "description": [ + "\nevent.end contains the date when the event ended or when the activity was last observed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.hash", + "type": "string", + "tags": [], + "label": "hash", + "description": [ + "\nHash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique ID to describe the event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.ingested", + "type": "string", + "tags": [], + "label": "ingested", + "description": [ + "\nTimestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.kind", + "type": "string", + "tags": [], + "label": "kind", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.module", + "type": "string", + "tags": [], + "label": "module", + "description": [ + "\nName of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.original", + "type": "string", + "tags": [], + "label": "original", + "description": [ + "\nRaw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex.\nThis field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.outcome", + "type": "string", + "tags": [], + "label": "outcome", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.provider", + "type": "string", + "tags": [], + "label": "provider", + "description": [ + "\nSource of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.reason", + "type": "string", + "tags": [], + "label": "reason", + "description": [ + "\nReason why this event happened, according to the source.\nThis describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.reference", + "type": "string", + "tags": [], + "label": "reference", + "description": [ + "\nReference URL linking to additional information about this event.\nThis URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.risk_score", + "type": "number", + "tags": [], + "label": "risk_score", + "description": [ + "\nRisk score or priority of the event (e.g. security solutions). Use your system's original value here." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.risk_score_norm", + "type": "number", + "tags": [], + "label": "risk_score_norm", + "description": [ + "\nNormalized risk score or priority of the event, on a scale of 0 to 100.\nThis is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.sequence", + "type": "number", + "tags": [], + "label": "sequence", + "description": [ + "\nSequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.severity", + "type": "number", + "tags": [], + "label": "severity", + "description": [ + "\nThe numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.start", + "type": "string", + "tags": [], + "label": "start", + "description": [ + "\nevent.start contains the date when the event started or when the activity was first observed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.timezone", + "type": "string", + "tags": [], + "label": "timezone", + "description": [ + "\nThis field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise.\nAcceptable timezone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\")." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.type", + "type": "Array", + "tags": [], + "label": "type", + "description": [ + "\nThis is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsEvent.url", + "type": "string", + "tags": [], + "label": "url", + "description": [ + "\nURL linking to an external system to continue investigation of this event.\nThis URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/event.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas", + "type": "Interface", + "tags": [], + "label": "EcsFaas", + "description": [ + "\nThe user fields describe information about the function as a service (FaaS) that is relevant to the event." + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas.coldstart", + "type": "CompoundType", + "tags": [], + "label": "coldstart", + "description": [ + "\nBoolean value indicating a cold start of a function." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas.execution", + "type": "string", + "tags": [], + "label": "execution", + "description": [ + "\nThe execution ID of the current function execution." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nThe unique identifier of a serverless function.\nFor AWS Lambda it's the function ARN (Amazon Resource Name) without a version or alias suffix." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nThe name of a serverless function." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas.trigger", + "type": "Object", + "tags": [], + "label": "trigger", + "description": [ + "\nDetails about the function trigger." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFaas.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nThe version of a serverless function." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/faas.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile", + "type": "Interface", + "tags": [], + "label": "EcsFile", + "description": [ + "\nA file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric." + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.accessed", + "type": "string", + "tags": [], + "label": "accessed", + "description": [ + "\nLast time the file was accessed.\nNote that not all filesystems keep track of access time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.attributes", + "type": "Array", + "tags": [], + "label": "attributes", + "description": [ + "\nArray of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.code_signature", + "type": "Object", + "tags": [], + "label": "code_signature", + "description": [], + "signature": [ + "{ digest_algorithm?: string | undefined; exists?: boolean | undefined; signing_id?: string | undefined; status?: string | undefined; subject_name?: string | undefined; team_id?: string | undefined; timestamp?: string | undefined; trusted?: boolean | undefined; valid?: boolean | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.created", + "type": "string", + "tags": [], + "label": "created", + "description": [ + "\nFile creation time.\nNote that not all filesystems store the creation time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.ctime", + "type": "string", + "tags": [], + "label": "ctime", + "description": [ + "\nLast time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.device", + "type": "string", + "tags": [], + "label": "device", + "description": [ + "\nDevice that is the source of the file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.directory", + "type": "string", + "tags": [], + "label": "directory", + "description": [ + "\nDirectory where the file is located. It should include the drive letter, when appropriate." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.drive_letter", + "type": "string", + "tags": [], + "label": "drive_letter", + "description": [ + "\nDrive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.elf", + "type": "Object", + "tags": [], + "label": "elf", + "description": [], + "signature": [ + "{ architecture?: string | undefined; byte_order?: string | undefined; cpu_type?: string | undefined; creation_date?: string | undefined; exports?: Record[] | undefined; header?: { abi_version?: string | undefined; class?: string | undefined; data?: string | undefined; entrypoint?: number | undefined; object_version?: string | undefined; os_abi?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined; imports?: Record[] | undefined; sections?: Record[] | undefined; segments?: Record[] | undefined; shared_libraries?: string[] | undefined; telfhash?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.extension", + "type": "string", + "tags": [], + "label": "extension", + "description": [ + "\nFile extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.fork_name", + "type": "string", + "tags": [], + "label": "fork_name", + "description": [ + "\nA fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.gid", + "type": "string", + "tags": [], + "label": "gid", + "description": [ + "\nPrimary group ID (GID) of the file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.group", + "type": "string", + "tags": [], + "label": "group", + "description": [ + "\nPrimary group name of the file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.hash", + "type": "Object", + "tags": [], + "label": "hash", + "description": [], + "signature": [ + "{ md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; sha384?: string | undefined; sha512?: string | undefined; ssdeep?: string | undefined; tlsh?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.inode", + "type": "string", + "tags": [], + "label": "inode", + "description": [ + "\nInode representing the file in the filesystem." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.mime_type", + "type": "string", + "tags": [], + "label": "mime_type", + "description": [ + "\nMIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.mode", + "type": "string", + "tags": [], + "label": "mode", + "description": [ + "\nMode of the file in octal representation." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.mtime", + "type": "string", + "tags": [], + "label": "mtime", + "description": [ + "\nLast time the file content was modified." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the file including the extension, without the directory." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.owner", + "type": "string", + "tags": [], + "label": "owner", + "description": [ + "\nFile owner's username." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.path", + "type": "string", + "tags": [], + "label": "path", + "description": [ + "\nFull path to the file, including the file name. It should include the drive letter, when appropriate." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.pe", + "type": "Object", + "tags": [], + "label": "pe", + "description": [], + "signature": [ + "{ architecture?: string | undefined; company?: string | undefined; description?: string | undefined; file_version?: string | undefined; imphash?: string | undefined; original_file_name?: string | undefined; pehash?: string | undefined; product?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.size", + "type": "number", + "tags": [], + "label": "size", + "description": [ + "\nFile size in bytes.\nOnly relevant when `file.type` is \"file\"." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.target_path", + "type": "string", + "tags": [], + "label": "target_path", + "description": [ + "\nTarget path for symlinks." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nFile type (file, dir, or symlink)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.uid", + "type": "string", + "tags": [], + "label": "uid", + "description": [ + "\nThe user ID (UID) or security identifier (SID) of the file owner." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFile.x509", + "type": "Object", + "tags": [], + "label": "x509", + "description": [], + "signature": [ + "{ alternative_names?: string[] | undefined; issuer?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; not_after?: string | undefined; not_before?: string | undefined; public_key_algorithm?: string | undefined; public_key_curve?: string | undefined; public_key_exponent?: number | undefined; public_key_size?: number | undefined; serial_number?: string | undefined; signature_algorithm?: string | undefined; subject?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; version_number?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/file.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo", + "type": "Interface", + "tags": [], + "label": "EcsGeo", + "description": [ + "\nGeo fields can carry data about a specific location related to an event.\nThis geolocation information can be derived from techniques such as Geo IP, or be user-supplied." + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.city_name", + "type": "string", + "tags": [], + "label": "city_name", + "description": [ + "\nCity name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.continent_code", + "type": "string", + "tags": [], + "label": "continent_code", + "description": [ + "\nTwo-letter code representing continent's name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.continent_name", + "type": "string", + "tags": [], + "label": "continent_name", + "description": [ + "\nName of the continent." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.country_iso_code", + "type": "string", + "tags": [], + "label": "country_iso_code", + "description": [ + "\nCountry ISO code." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.country_name", + "type": "string", + "tags": [], + "label": "country_name", + "description": [ + "\nCountry name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.location", + "type": "Object", + "tags": [], + "label": "location", + "description": [ + "\nLongitude and latitude." + ], + "signature": [ + "{ lat: number; lon: number; } | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nUser-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.postal_code", + "type": "string", + "tags": [], + "label": "postal_code", + "description": [ + "\nPostal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.region_iso_code", + "type": "string", + "tags": [], + "label": "region_iso_code", + "description": [ + "\nRegion ISO code." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.region_name", + "type": "string", + "tags": [], + "label": "region_name", + "description": [ + "\nRegion name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGeo.timezone", + "type": "string", + "tags": [], + "label": "timezone", + "description": [ + "\nThe time zone of the location, such as IANA time zone name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/geo.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGroup", + "type": "Interface", + "tags": [], + "label": "EcsGroup", + "description": [ + "\nThe group fields are meant to represent groups that are relevant to the event." + ], + "path": "packages/kbn-ecs/generated/group.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGroup.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nName of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/group.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGroup.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique identifier for the group on the system/platform." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/group.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsGroup.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the group." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/group.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash", + "type": "Interface", + "tags": [], + "label": "EcsHash", + "description": [ + "\nThe hash fields represent different bitwise hash algorithms and their values.\nField names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512).\nNote that this fieldset is used for common hashes that may be computed over a range of generic bytes. Entity-specific hashes such as ja3 or imphash are placed in the fieldsets to which they relate (tls and pe, respectively)." + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.md5", + "type": "string", + "tags": [], + "label": "md5", + "description": [ + "\nMD5 hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.sha1", + "type": "string", + "tags": [], + "label": "sha1", + "description": [ + "\nSHA1 hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.sha256", + "type": "string", + "tags": [], + "label": "sha256", + "description": [ + "\nSHA256 hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.sha384", + "type": "string", + "tags": [], + "label": "sha384", + "description": [ + "\nSHA384 hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.sha512", + "type": "string", + "tags": [], + "label": "sha512", + "description": [ + "\nSHA512 hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.ssdeep", + "type": "string", + "tags": [], + "label": "ssdeep", + "description": [ + "\nSSDEEP hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHash.tlsh", + "type": "string", + "tags": [], + "label": "tlsh", + "description": [ + "\nTLSH hash." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/hash.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost", + "type": "Interface", + "tags": [], + "label": "EcsHost", + "description": [ + "\nA host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes." + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.architecture", + "type": "string", + "tags": [], + "label": "architecture", + "description": [ + "\nOperating system architecture." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.boot", + "type": "Object", + "tags": [], + "label": "boot", + "description": [], + "signature": [ + "{ id?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.cpu", + "type": "Object", + "tags": [], + "label": "cpu", + "description": [], + "signature": [ + "{ usage?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.disk", + "type": "Object", + "tags": [], + "label": "disk", + "description": [], + "signature": [ + "{ read?: { bytes?: number | undefined; } | undefined; write?: { bytes?: number | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nName of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "signature": [ + "{ city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.hostname", + "type": "string", + "tags": [], + "label": "hostname", + "description": [ + "\nHostname of the host.\nIt normally contains what the `hostname` command returns on the host machine." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.ip", + "type": "Array", + "tags": [], + "label": "ip", + "description": [ + "\nHost ip addresses." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.mac", + "type": "Array", + "tags": [], + "label": "mac", + "description": [ + "\nHost MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.network", + "type": "Object", + "tags": [], + "label": "network", + "description": [], + "signature": [ + "{ egress?: { bytes?: number | undefined; packets?: number | undefined; } | undefined; ingress?: { bytes?: number | undefined; packets?: number | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.os", + "type": "Object", + "tags": [], + "label": "os", + "description": [], + "signature": [ + "{ family?: string | undefined; full?: string | undefined; kernel?: string | undefined; name?: string | undefined; platform?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.pid_ns_ino", + "type": "string", + "tags": [], + "label": "pid_ns_ino", + "description": [ + "\nThis is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.risk", + "type": "Object", + "tags": [], + "label": "risk", + "description": [], + "signature": [ + "{ calculated_level?: string | undefined; calculated_score?: number | undefined; calculated_score_norm?: number | undefined; static_level?: string | undefined; static_score?: number | undefined; static_score_norm?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nType of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHost.uptime", + "type": "number", + "tags": [], + "label": "uptime", + "description": [ + "\nSeconds the host has been up." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/host.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHttp", + "type": "Interface", + "tags": [], + "label": "EcsHttp", + "description": [ + "\nFields related to HTTP activity. Use the `url` field set to store the url of the request." + ], + "path": "packages/kbn-ecs/generated/http.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHttp.request", + "type": "Object", + "tags": [], + "label": "request", + "description": [], + "signature": [ + "{ body?: { bytes?: number | undefined; content?: string | undefined; } | undefined; bytes?: number | undefined; id?: string | undefined; method?: string | undefined; mime_type?: string | undefined; referrer?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/http.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHttp.response", + "type": "Object", + "tags": [], + "label": "response", + "description": [], + "signature": [ + "{ body?: { bytes?: number | undefined; content?: string | undefined; } | undefined; bytes?: number | undefined; mime_type?: string | undefined; status_code?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/http.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsHttp.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nHTTP version." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/http.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsInterface", + "type": "Interface", + "tags": [], + "label": "EcsInterface", + "description": [ + "\nThe interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection. In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated." + ], + "path": "packages/kbn-ecs/generated/interface.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsInterface.alias", + "type": "string", + "tags": [], + "label": "alias", + "description": [ + "\nInterface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/interface.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsInterface.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nInterface ID as reported by an observer (typically SNMP interface ID)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/interface.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsInterface.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nInterface name as reported by the system." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/interface.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsLog", + "type": "Interface", + "tags": [], + "label": "EcsLog", + "description": [ + "\nDetails about the event's logging mechanism or logging transport.\nThe log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`.\nThe details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields." + ], + "path": "packages/kbn-ecs/generated/log.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsLog.file", + "type": "Object", + "tags": [], + "label": "file", + "description": [], + "signature": [ + "{ path?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/log.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsLog.level", + "type": "string", + "tags": [], + "label": "level", + "description": [ + "\nOriginal log level of the log event.\nIf the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity).\nSome examples are `warn`, `err`, `i`, `informational`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/log.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsLog.logger", + "type": "string", + "tags": [], + "label": "logger", + "description": [ + "\nThe name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/log.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsLog.origin", + "type": "Object", + "tags": [], + "label": "origin", + "description": [], + "signature": [ + "{ file?: { line?: number | undefined; name?: string | undefined; } | undefined; function?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/log.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsLog.syslog", + "type": "Object", + "tags": [], + "label": "syslog", + "description": [ + "\nThe Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/log.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork", + "type": "Interface", + "tags": [], + "label": "EcsNetwork", + "description": [ + "\nThe network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event." + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.application", + "type": "string", + "tags": [], + "label": "application", + "description": [ + "\nWhen a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.\nFor example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.\nThe field value must be normalized to lowercase for querying." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.bytes", + "type": "number", + "tags": [], + "label": "bytes", + "description": [ + "\nTotal bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.community_id", + "type": "string", + "tags": [], + "label": "community_id", + "description": [ + "\nA hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.direction", + "type": "string", + "tags": [], + "label": "direction", + "description": [ + "\nDirection of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.forwarded_ip", + "type": "string", + "tags": [], + "label": "forwarded_ip", + "description": [ + "\nHost IP address when the source IP address is the proxy." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.iana_number", + "type": "string", + "tags": [], + "label": "iana_number", + "description": [ + "\nIANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.inner", + "type": "Object", + "tags": [], + "label": "inner", + "description": [ + "\nNetwork.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)" + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName given by operators to sections of their network." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.packets", + "type": "number", + "tags": [], + "label": "packets", + "description": [ + "\nTotal packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.protocol", + "type": "string", + "tags": [], + "label": "protocol", + "description": [ + "\nIn the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.transport", + "type": "string", + "tags": [], + "label": "transport", + "description": [ + "\nSame as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nIn the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNetwork.vlan", + "type": "Object", + "tags": [], + "label": "vlan", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/network.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver", + "type": "Interface", + "tags": [], + "label": "EcsObserver", + "description": [ + "\nAn observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics.\nThis could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS." + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.egress", + "type": "Object", + "tags": [], + "label": "egress", + "description": [ + "\nObserver.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "signature": [ + "{ city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.hostname", + "type": "string", + "tags": [], + "label": "hostname", + "description": [ + "\nHostname of the observer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.ingress", + "type": "Object", + "tags": [], + "label": "ingress", + "description": [ + "\nObserver.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.ip", + "type": "Array", + "tags": [], + "label": "ip", + "description": [ + "\nIP addresses of the observer." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.mac", + "type": "Array", + "tags": [], + "label": "mac", + "description": [ + "\nMAC addresses of the observer.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nCustom name of the observer.\nThis is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization.\nIf no custom name is needed, the field can be left empty." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.os", + "type": "Object", + "tags": [], + "label": "os", + "description": [], + "signature": [ + "{ family?: string | undefined; full?: string | undefined; kernel?: string | undefined; name?: string | undefined; platform?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.product", + "type": "string", + "tags": [], + "label": "product", + "description": [ + "\nThe product name of the observer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.serial_number", + "type": "string", + "tags": [], + "label": "serial_number", + "description": [ + "\nObserver serial number." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nThe type of the observer the data is coming from.\nThere is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.vendor", + "type": "string", + "tags": [], + "label": "vendor", + "description": [ + "\nVendor name of the observer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsObserver.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nObserver version." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/observer.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator", + "type": "Interface", + "tags": [], + "label": "EcsOrchestrator", + "description": [ + "\nFields that describe the resources which container orchestrators manage or act upon." + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator.api_version", + "type": "string", + "tags": [], + "label": "api_version", + "description": [ + "\nAPI version being used to carry out the action" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator.cluster", + "type": "Object", + "tags": [], + "label": "cluster", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; url?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator.namespace", + "type": "string", + "tags": [], + "label": "namespace", + "description": [ + "\nNamespace in which the action is taking place." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator.organization", + "type": "string", + "tags": [], + "label": "organization", + "description": [ + "\nOrganization affected by the event (for multi-tenant orchestrator setups)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator.resource", + "type": "Object", + "tags": [], + "label": "resource", + "description": [], + "signature": [ + "{ id?: string | undefined; ip?: string[] | undefined; name?: string | undefined; parent?: { type?: string | undefined; } | undefined; type?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrchestrator.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nOrchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/orchestrator.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrganization", + "type": "Interface", + "tags": [], + "label": "EcsOrganization", + "description": [ + "\nThe organization fields enrich data with information about the company or entity the data is associated with.\nThese fields help you arrange or filter data stored in an index by one or multiple organizations." + ], + "path": "packages/kbn-ecs/generated/organization.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrganization.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique identifier for the organization." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/organization.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOrganization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nOrganization name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/organization.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs", + "type": "Interface", + "tags": [], + "label": "EcsOs", + "description": [ + "\nThe OS fields contain information about the operating system." + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.family", + "type": "string", + "tags": [], + "label": "family", + "description": [ + "\nOS family (such as redhat, debian, freebsd, windows)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.full", + "type": "string", + "tags": [], + "label": "full", + "description": [ + "\nOperating system name, including the version or code name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.kernel", + "type": "string", + "tags": [], + "label": "kernel", + "description": [ + "\nOperating system kernel version as a raw string." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nOperating system name, without the version." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.platform", + "type": "string", + "tags": [], + "label": "platform", + "description": [ + "\nOperating system platform (such centos, ubuntu, windows)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nUse the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsOs.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nOperating system version as a raw string." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/os.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage", + "type": "Interface", + "tags": [], + "label": "EcsPackage", + "description": [ + "\nThese fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location." + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.architecture", + "type": "string", + "tags": [], + "label": "architecture", + "description": [ + "\nPackage architecture." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.build_version", + "type": "string", + "tags": [], + "label": "build_version", + "description": [ + "\nAdditional information about the build version of the installed package.\nFor example use the commit SHA of a non-released package." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.checksum", + "type": "string", + "tags": [], + "label": "checksum", + "description": [ + "\nChecksum of the installed package for verification." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [ + "\nDescription of the package." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.install_scope", + "type": "string", + "tags": [], + "label": "install_scope", + "description": [ + "\nIndicating how the package was installed, e.g. user-local, global." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.installed", + "type": "string", + "tags": [], + "label": "installed", + "description": [ + "\nTime when package was installed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.license", + "type": "string", + "tags": [], + "label": "license", + "description": [ + "\nLicense under which the package was released.\nUse a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nPackage name" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.path", + "type": "string", + "tags": [], + "label": "path", + "description": [ + "\nPath where the package is installed." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.reference", + "type": "string", + "tags": [], + "label": "reference", + "description": [ + "\nHome page or reference URL of the software in this package, if available." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.size", + "type": "number", + "tags": [], + "label": "size", + "description": [ + "\nPackage size in bytes." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nType of package.\nThis should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPackage.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nPackage version" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/package.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe", + "type": "Interface", + "tags": [], + "label": "EcsPe", + "description": [ + "\nThese fields contain Windows Portable Executable (PE) metadata." + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.architecture", + "type": "string", + "tags": [], + "label": "architecture", + "description": [ + "\nCPU architecture target for the file." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.company", + "type": "string", + "tags": [], + "label": "company", + "description": [ + "\nInternal company name of the file, provided at compile-time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.description", + "type": "string", + "tags": [], + "label": "description", + "description": [ + "\nInternal description of the file, provided at compile-time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.file_version", + "type": "string", + "tags": [], + "label": "file_version", + "description": [ + "\nInternal version of the file, provided at compile-time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.imphash", + "type": "string", + "tags": [], + "label": "imphash", + "description": [ + "\nA hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.original_file_name", + "type": "string", + "tags": [], + "label": "original_file_name", + "description": [ + "\nInternal name of the file, provided at compile-time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.pehash", + "type": "string", + "tags": [], + "label": "pehash", + "description": [ + "\nA hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsPe.product", + "type": "string", + "tags": [], + "label": "product", + "description": [ + "\nInternal product name of the file, provided at compile-time." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/pe.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess", + "type": "Interface", + "tags": [], + "label": "EcsProcess", + "description": [ + "\nThese fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation." + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.args", + "type": "Array", + "tags": [], + "label": "args", + "description": [ + "\nArray of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.args_count", + "type": "number", + "tags": [], + "label": "args_count", + "description": [ + "\nLength of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.code_signature", + "type": "Object", + "tags": [], + "label": "code_signature", + "description": [], + "signature": [ + "{ digest_algorithm?: string | undefined; exists?: boolean | undefined; signing_id?: string | undefined; status?: string | undefined; subject_name?: string | undefined; team_id?: string | undefined; timestamp?: string | undefined; trusted?: boolean | undefined; valid?: boolean | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.command_line", + "type": "string", + "tags": [], + "label": "command_line", + "description": [ + "\nFull command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.elf", + "type": "Object", + "tags": [], + "label": "elf", + "description": [], + "signature": [ + "{ architecture?: string | undefined; byte_order?: string | undefined; cpu_type?: string | undefined; creation_date?: string | undefined; exports?: Record[] | undefined; header?: { abi_version?: string | undefined; class?: string | undefined; data?: string | undefined; entrypoint?: number | undefined; object_version?: string | undefined; os_abi?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined; imports?: Record[] | undefined; sections?: Record[] | undefined; segments?: Record[] | undefined; shared_libraries?: string[] | undefined; telfhash?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.end", + "type": "string", + "tags": [], + "label": "end", + "description": [ + "\nThe time the process ended." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.entity_id", + "type": "string", + "tags": [], + "label": "entity_id", + "description": [ + "\nUnique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.entry_leader", + "type": "Object", + "tags": [], + "label": "entry_leader", + "description": [], + "signature": [ + "{ args?: string[] | undefined; args_count?: number | undefined; attested_groups?: { name?: string | undefined; } | undefined; attested_user?: { id?: string | undefined; name?: string | undefined; } | undefined; command_line?: string | undefined; entity_id?: string | undefined; entry_meta?: { source?: { ip?: string | undefined; } | undefined; type?: string | undefined; } | undefined; executable?: string | undefined; group?: { id?: string | undefined; name?: string | undefined; } | undefined; interactive?: boolean | undefined; name?: string | undefined; parent?: { entity_id?: string | undefined; pid?: number | undefined; session_leader?: { entity_id?: string | undefined; pid?: number | undefined; start?: string | undefined; } | undefined; start?: string | undefined; } | undefined; pid?: number | undefined; real_group?: { id?: string | undefined; name?: string | undefined; } | undefined; real_user?: { id?: string | undefined; name?: string | undefined; } | undefined; same_as_process?: boolean | undefined; saved_group?: { id?: string | undefined; name?: string | undefined; } | undefined; saved_user?: { id?: string | undefined; name?: string | undefined; } | undefined; start?: string | undefined; supplemental_groups?: { id?: string | undefined; name?: string | undefined; } | undefined; tty?: Record | undefined; user?: { id?: string | undefined; name?: string | undefined; } | undefined; working_directory?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.env_vars", + "type": "Array", + "tags": [], + "label": "env_vars", + "description": [ + "\nArray of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.executable", + "type": "string", + "tags": [], + "label": "executable", + "description": [ + "\nAbsolute path to the process executable." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.exit_code", + "type": "number", + "tags": [], + "label": "exit_code", + "description": [ + "\nThe exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.group_leader", + "type": "Object", + "tags": [], + "label": "group_leader", + "description": [], + "signature": [ + "{ args?: string[] | undefined; args_count?: number | undefined; command_line?: string | undefined; entity_id?: string | undefined; executable?: string | undefined; group?: { id?: string | undefined; name?: string | undefined; } | undefined; interactive?: boolean | undefined; name?: string | undefined; pid?: number | undefined; real_group?: { id?: string | undefined; name?: string | undefined; } | undefined; real_user?: { id?: string | undefined; name?: string | undefined; } | undefined; same_as_process?: boolean | undefined; saved_group?: { id?: string | undefined; name?: string | undefined; } | undefined; saved_user?: { id?: string | undefined; name?: string | undefined; } | undefined; start?: string | undefined; supplemental_groups?: { id?: string | undefined; name?: string | undefined; } | undefined; tty?: Record | undefined; user?: { id?: string | undefined; name?: string | undefined; } | undefined; working_directory?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.hash", + "type": "Object", + "tags": [], + "label": "hash", + "description": [], + "signature": [ + "{ md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; sha384?: string | undefined; sha512?: string | undefined; ssdeep?: string | undefined; tlsh?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.interactive", + "type": "CompoundType", + "tags": [], + "label": "interactive", + "description": [ + "\nWhether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.io", + "type": "Object", + "tags": [], + "label": "io", + "description": [ + "\nA chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nProcess name.\nSometimes called program name or similar." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.parent", + "type": "Object", + "tags": [], + "label": "parent", + "description": [], + "signature": [ + "{ args?: string[] | undefined; args_count?: number | undefined; code_signature?: { digest_algorithm?: string | undefined; exists?: boolean | undefined; signing_id?: string | undefined; status?: string | undefined; subject_name?: string | undefined; team_id?: string | undefined; timestamp?: string | undefined; trusted?: boolean | undefined; valid?: boolean | undefined; } | undefined; command_line?: string | undefined; elf?: { architecture?: string | undefined; byte_order?: string | undefined; cpu_type?: string | undefined; creation_date?: string | undefined; exports?: Record[] | undefined; header?: { abi_version?: string | undefined; class?: string | undefined; data?: string | undefined; entrypoint?: number | undefined; object_version?: string | undefined; os_abi?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined; imports?: Record[] | undefined; sections?: Record[] | undefined; segments?: Record[] | undefined; shared_libraries?: string[] | undefined; telfhash?: string | undefined; } | undefined; end?: string | undefined; entity_id?: string | undefined; executable?: string | undefined; exit_code?: number | undefined; group?: { id?: string | undefined; name?: string | undefined; } | undefined; group_leader?: { entity_id?: string | undefined; pid?: number | undefined; start?: string | undefined; } | undefined; hash?: { md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; sha384?: string | undefined; sha512?: string | undefined; ssdeep?: string | undefined; tlsh?: string | undefined; } | undefined; interactive?: boolean | undefined; name?: string | undefined; pe?: { architecture?: string | undefined; company?: string | undefined; description?: string | undefined; file_version?: string | undefined; imphash?: string | undefined; original_file_name?: string | undefined; pehash?: string | undefined; product?: string | undefined; } | undefined; pgid?: number | undefined; pid?: number | undefined; real_group?: { id?: string | undefined; name?: string | undefined; } | undefined; real_user?: { id?: string | undefined; name?: string | undefined; } | undefined; saved_group?: { id?: string | undefined; name?: string | undefined; } | undefined; saved_user?: { id?: string | undefined; name?: string | undefined; } | undefined; start?: string | undefined; supplemental_groups?: { id?: string | undefined; name?: string | undefined; } | undefined; thread?: { id?: number | undefined; name?: string | undefined; } | undefined; title?: string | undefined; tty?: Record | undefined; uptime?: number | undefined; user?: { id?: string | undefined; name?: string | undefined; } | undefined; working_directory?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.pe", + "type": "Object", + "tags": [], + "label": "pe", + "description": [], + "signature": [ + "{ architecture?: string | undefined; company?: string | undefined; description?: string | undefined; file_version?: string | undefined; imphash?: string | undefined; original_file_name?: string | undefined; pehash?: string | undefined; product?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.pgid", + "type": "number", + "tags": [], + "label": "pgid", + "description": [ + "\nDeprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.pid", + "type": "number", + "tags": [], + "label": "pid", + "description": [ + "\nProcess id." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.previous", + "type": "Object", + "tags": [], + "label": "previous", + "description": [], + "signature": [ + "{ args?: string[] | undefined; args_count?: number | undefined; executable?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.real_group", + "type": "Object", + "tags": [], + "label": "real_group", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.real_user", + "type": "Object", + "tags": [], + "label": "real_user", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.saved_group", + "type": "Object", + "tags": [], + "label": "saved_group", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.saved_user", + "type": "Object", + "tags": [], + "label": "saved_user", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.session_leader", + "type": "Object", + "tags": [], + "label": "session_leader", + "description": [], + "signature": [ + "{ args?: string[] | undefined; args_count?: number | undefined; command_line?: string | undefined; entity_id?: string | undefined; executable?: string | undefined; group?: { id?: string | undefined; name?: string | undefined; } | undefined; interactive?: boolean | undefined; name?: string | undefined; parent?: { entity_id?: string | undefined; pid?: number | undefined; session_leader?: { entity_id?: string | undefined; pid?: number | undefined; start?: string | undefined; } | undefined; start?: string | undefined; } | undefined; pid?: number | undefined; real_group?: { id?: string | undefined; name?: string | undefined; } | undefined; real_user?: { id?: string | undefined; name?: string | undefined; } | undefined; same_as_process?: boolean | undefined; saved_group?: { id?: string | undefined; name?: string | undefined; } | undefined; saved_user?: { id?: string | undefined; name?: string | undefined; } | undefined; start?: string | undefined; supplemental_groups?: { id?: string | undefined; name?: string | undefined; } | undefined; tty?: Record | undefined; user?: { id?: string | undefined; name?: string | undefined; } | undefined; working_directory?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.start", + "type": "string", + "tags": [], + "label": "start", + "description": [ + "\nThe time the process started." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.supplemental_groups", + "type": "Object", + "tags": [], + "label": "supplemental_groups", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.thread", + "type": "Object", + "tags": [], + "label": "thread", + "description": [], + "signature": [ + "{ id?: number | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.title", + "type": "string", + "tags": [], + "label": "title", + "description": [ + "\nProcess title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.tty", + "type": "Object", + "tags": [], + "label": "tty", + "description": [ + "\nInformation about the controlling TTY device. If set, the process belongs to an interactive session." + ], + "signature": [ + "Record | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.uptime", + "type": "number", + "tags": [], + "label": "uptime", + "description": [ + "\nSeconds the process has been up." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.user", + "type": "Object", + "tags": [], + "label": "user", + "description": [], + "signature": [ + "{ id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsProcess.working_directory", + "type": "string", + "tags": [], + "label": "working_directory", + "description": [ + "\nThe working directory of the process." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/process.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRegistry", + "type": "Interface", + "tags": [], + "label": "EcsRegistry", + "description": [ + "\nFields related to Windows Registry operations." + ], + "path": "packages/kbn-ecs/generated/registry.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRegistry.data", + "type": "Object", + "tags": [], + "label": "data", + "description": [], + "signature": [ + "{ bytes?: string | undefined; strings?: string[] | undefined; type?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/registry.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRegistry.hive", + "type": "string", + "tags": [], + "label": "hive", + "description": [ + "\nAbbreviated name for the hive." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/registry.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRegistry.key", + "type": "string", + "tags": [], + "label": "key", + "description": [ + "\nHive-relative path of keys." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/registry.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRegistry.path", + "type": "string", + "tags": [], + "label": "path", + "description": [ + "\nFull path, including hive, key and value" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/registry.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRegistry.value", + "type": "string", + "tags": [], + "label": "value", + "description": [ + "\nName of the value written." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/registry.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRelated", + "type": "Interface", + "tags": [], + "label": "EcsRelated", + "description": [ + "\nThis field set is meant to facilitate pivoting around a piece of data.\nSome pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`.\nA concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`." + ], + "path": "packages/kbn-ecs/generated/related.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRelated.hash", + "type": "Array", + "tags": [], + "label": "hash", + "description": [ + "\nAll the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search)." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/related.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRelated.hosts", + "type": "Array", + "tags": [], + "label": "hosts", + "description": [ + "\nAll hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/related.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRelated.ip", + "type": "Array", + "tags": [], + "label": "ip", + "description": [ + "\nAll of the IPs seen on your event." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/related.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRelated.user", + "type": "Array", + "tags": [], + "label": "user", + "description": [ + "\nAll the user names or other user identifiers seen on the event." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/related.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk", + "type": "Interface", + "tags": [], + "label": "EcsRisk", + "description": [ + "\nFields for describing risk score and risk level of entities such as hosts and users. These fields are not allowed to be nested under `event.*`. Please continue to use `event.risk_score` and `event.risk_score_norm` for event risk." + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk.calculated_level", + "type": "string", + "tags": [], + "label": "calculated_level", + "description": [ + "\nA risk classification level calculated by an internal system as part of entity analytics and entity risk scoring." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk.calculated_score", + "type": "number", + "tags": [], + "label": "calculated_score", + "description": [ + "\nA risk classification score calculated by an internal system as part of entity analytics and entity risk scoring." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk.calculated_score_norm", + "type": "number", + "tags": [], + "label": "calculated_score_norm", + "description": [ + "\nA risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk.static_level", + "type": "string", + "tags": [], + "label": "static_level", + "description": [ + "\nA risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk.static_score", + "type": "number", + "tags": [], + "label": "static_score", + "description": [ + "\nA risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRisk.static_score_norm", + "type": "number", + "tags": [], + "label": "static_score_norm", + "description": [ + "\nA risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/risk.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule", + "type": "Interface", + "tags": [], + "label": "EcsRule", + "description": [ + "\nRule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc." + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.author", + "type": "Array", + "tags": [], + "label": "author", + "description": [ + "\nName, organization, or pseudonym of the author or authors who created the rule used to generate this event." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.category", + "type": "string", + "tags": [], + "label": "category", + "description": [ + "\nA categorization value keyword used by the entity using the rule for detection of this event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.description", + "type": "string", + "tags": [], + "label": "description", + "description": [ + "\nThe description of the rule generating the event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nA rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.license", + "type": "string", + "tags": [], + "label": "license", + "description": [ + "\nName of the license under which the rule used to generate this event is made available." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nThe name of the rule or signature generating the event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.reference", + "type": "string", + "tags": [], + "label": "reference", + "description": [ + "\nReference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.ruleset", + "type": "string", + "tags": [], + "label": "ruleset", + "description": [ + "\nName of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.uuid", + "type": "string", + "tags": [], + "label": "uuid", + "description": [ + "\nA rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsRule.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nThe version / revision of the rule being used for analysis." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/rule.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer", + "type": "Interface", + "tags": [], + "label": "EcsServer", + "description": [ + "\nA Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records.\nFor TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term \"responder\" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events.\nClient / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately." + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.address", + "type": "string", + "tags": [], + "label": "address", + "description": [ + "\nSome event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.as", + "type": "Object", + "tags": [], + "label": "as", + "description": [], + "signature": [ + "{ number?: number | undefined; organization?: { name?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.bytes", + "type": "number", + "tags": [], + "label": "bytes", + "description": [ + "\nBytes sent from the server to the client." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nThe domain name of the server system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "signature": [ + "{ city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.ip", + "type": "string", + "tags": [], + "label": "ip", + "description": [ + "\nIP address of the server (IPv4 or IPv6)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.mac", + "type": "string", + "tags": [], + "label": "mac", + "description": [ + "\nMAC address of the server.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.nat", + "type": "Object", + "tags": [], + "label": "nat", + "description": [], + "signature": [ + "{ ip?: string | undefined; port?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.packets", + "type": "number", + "tags": [], + "label": "packets", + "description": [ + "\nPackets sent from the server to the client." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.port", + "type": "number", + "tags": [], + "label": "port", + "description": [ + "\nPort of the server." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.registered_domain", + "type": "string", + "tags": [], + "label": "registered_domain", + "description": [ + "\nThe highest registered server domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.subdomain", + "type": "string", + "tags": [], + "label": "subdomain", + "description": [ + "\nThe subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.top_level_domain", + "type": "string", + "tags": [], + "label": "top_level_domain", + "description": [ + "\nThe effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsServer.user", + "type": "Object", + "tags": [], + "label": "user", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/server.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService", + "type": "Interface", + "tags": [], + "label": "EcsService", + "description": [ + "\nThe service fields describe the service for or from which the data was collected.\nThese fields help you find and correlate logs for a specific service and version." + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.address", + "type": "string", + "tags": [], + "label": "address", + "description": [ + "\nAddress where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.environment", + "type": "string", + "tags": [], + "label": "environment", + "description": [ + "\nIdentifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.ephemeral_id", + "type": "string", + "tags": [], + "label": "ephemeral_id", + "description": [ + "\nEphemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.node", + "type": "Object", + "tags": [], + "label": "node", + "description": [], + "signature": [ + "{ name?: string | undefined; role?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.origin", + "type": "Object", + "tags": [], + "label": "origin", + "description": [], + "signature": [ + "{ address?: string | undefined; environment?: string | undefined; ephemeral_id?: string | undefined; id?: string | undefined; name?: string | undefined; node?: { name?: string | undefined; role?: string | undefined; roles?: string[] | undefined; } | undefined; state?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.state", + "type": "string", + "tags": [], + "label": "state", + "description": [ + "\nCurrent state of the service." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.target", + "type": "Object", + "tags": [], + "label": "target", + "description": [], + "signature": [ + "{ address?: string | undefined; environment?: string | undefined; ephemeral_id?: string | undefined; id?: string | undefined; name?: string | undefined; node?: { name?: string | undefined; role?: string | undefined; roles?: string[] | undefined; } | undefined; state?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.type", + "type": "string", + "tags": [], + "label": "type", + "description": [ + "\nThe type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsService.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nVersion of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/service.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource", + "type": "Interface", + "tags": [], + "label": "EcsSource", + "description": [ + "\nSource fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated." + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.address", + "type": "string", + "tags": [], + "label": "address", + "description": [ + "\nSome event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.as", + "type": "Object", + "tags": [], + "label": "as", + "description": [], + "signature": [ + "{ number?: number | undefined; organization?: { name?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.bytes", + "type": "number", + "tags": [], + "label": "bytes", + "description": [ + "\nBytes sent from the source to the destination." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nThe domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "signature": [ + "{ city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.ip", + "type": "string", + "tags": [], + "label": "ip", + "description": [ + "\nIP address of the source (IPv4 or IPv6)." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.mac", + "type": "string", + "tags": [], + "label": "mac", + "description": [ + "\nMAC address of the source.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.nat", + "type": "Object", + "tags": [], + "label": "nat", + "description": [], + "signature": [ + "{ ip?: string | undefined; port?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.packets", + "type": "number", + "tags": [], + "label": "packets", + "description": [ + "\nPackets sent from the source to the destination." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.port", + "type": "number", + "tags": [], + "label": "port", + "description": [ + "\nPort of the source." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.registered_domain", + "type": "string", + "tags": [], + "label": "registered_domain", + "description": [ + "\nThe highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.subdomain", + "type": "string", + "tags": [], + "label": "subdomain", + "description": [ + "\nThe subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.top_level_domain", + "type": "string", + "tags": [], + "label": "top_level_domain", + "description": [ + "\nThe effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsSource.user", + "type": "Object", + "tags": [], + "label": "user", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/source.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat", + "type": "Interface", + "tags": [], + "label": "EcsThreat", + "description": [ + "\nFields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. \"impact\"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. \"endpoint denial of service\")." + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.enrichments", + "type": "Array", + "tags": [], + "label": "enrichments", + "description": [ + "\nA list of associated indicators objects enriching the event, and the context of that association/enrichment." + ], + "signature": [ + "Record[] | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.feed", + "type": "Object", + "tags": [], + "label": "feed", + "description": [], + "signature": [ + "{ dashboard_id?: string | undefined; description?: string | undefined; name?: string | undefined; reference?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.framework", + "type": "string", + "tags": [], + "label": "framework", + "description": [ + "\nName of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.group", + "type": "Object", + "tags": [], + "label": "group", + "description": [], + "signature": [ + "{ alias?: string[] | undefined; id?: string | undefined; name?: string | undefined; reference?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.indicator", + "type": "Object", + "tags": [], + "label": "indicator", + "description": [], + "signature": [ + "{ as?: { number?: number | undefined; organization?: { name?: string | undefined; } | undefined; } | undefined; confidence?: string | undefined; description?: string | undefined; email?: { address?: string | undefined; } | undefined; file?: { accessed?: string | undefined; attributes?: string[] | undefined; code_signature?: { digest_algorithm?: string | undefined; exists?: boolean | undefined; signing_id?: string | undefined; status?: string | undefined; subject_name?: string | undefined; team_id?: string | undefined; timestamp?: string | undefined; trusted?: boolean | undefined; valid?: boolean | undefined; } | undefined; created?: string | undefined; ctime?: string | undefined; device?: string | undefined; directory?: string | undefined; drive_letter?: string | undefined; elf?: { architecture?: string | undefined; byte_order?: string | undefined; cpu_type?: string | undefined; creation_date?: string | undefined; exports?: Record[] | undefined; header?: { abi_version?: string | undefined; class?: string | undefined; data?: string | undefined; entrypoint?: number | undefined; object_version?: string | undefined; os_abi?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined; imports?: Record[] | undefined; sections?: Record[] | undefined; segments?: Record[] | undefined; shared_libraries?: string[] | undefined; telfhash?: string | undefined; } | undefined; extension?: string | undefined; fork_name?: string | undefined; gid?: string | undefined; group?: string | undefined; hash?: { md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; sha384?: string | undefined; sha512?: string | undefined; ssdeep?: string | undefined; tlsh?: string | undefined; } | undefined; inode?: string | undefined; mime_type?: string | undefined; mode?: string | undefined; mtime?: string | undefined; name?: string | undefined; owner?: string | undefined; path?: string | undefined; pe?: { architecture?: string | undefined; company?: string | undefined; description?: string | undefined; file_version?: string | undefined; imphash?: string | undefined; original_file_name?: string | undefined; pehash?: string | undefined; product?: string | undefined; } | undefined; size?: number | undefined; target_path?: string | undefined; type?: string | undefined; uid?: string | undefined; x509?: { alternative_names?: string[] | undefined; issuer?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; not_after?: string | undefined; not_before?: string | undefined; public_key_algorithm?: string | undefined; public_key_curve?: string | undefined; public_key_exponent?: number | undefined; public_key_size?: number | undefined; serial_number?: string | undefined; signature_algorithm?: string | undefined; subject?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; version_number?: string | undefined; } | undefined; } | undefined; first_seen?: string | undefined; geo?: { city_name?: string | undefined; continent_code?: string | undefined; continent_name?: string | undefined; country_iso_code?: string | undefined; country_name?: string | undefined; location?: { lat: number; lon: number; } | undefined; name?: string | undefined; postal_code?: string | undefined; region_iso_code?: string | undefined; region_name?: string | undefined; timezone?: string | undefined; } | undefined; ip?: string | undefined; last_seen?: string | undefined; marking?: { tlp?: string | undefined; } | undefined; modified_at?: string | undefined; port?: number | undefined; provider?: string | undefined; reference?: string | undefined; registry?: { data?: { bytes?: string | undefined; strings?: string[] | undefined; type?: string | undefined; } | undefined; hive?: string | undefined; key?: string | undefined; path?: string | undefined; value?: string | undefined; } | undefined; scanner_stats?: number | undefined; sightings?: number | undefined; type?: string | undefined; url?: { domain?: string | undefined; extension?: string | undefined; fragment?: string | undefined; full?: string | undefined; original?: string | undefined; password?: string | undefined; path?: string | undefined; port?: number | undefined; query?: string | undefined; registered_domain?: string | undefined; scheme?: string | undefined; subdomain?: string | undefined; top_level_domain?: string | undefined; username?: string | undefined; } | undefined; x509?: { alternative_names?: string[] | undefined; issuer?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; not_after?: string | undefined; not_before?: string | undefined; public_key_algorithm?: string | undefined; public_key_curve?: string | undefined; public_key_exponent?: number | undefined; public_key_size?: number | undefined; serial_number?: string | undefined; signature_algorithm?: string | undefined; subject?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; version_number?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.software", + "type": "Object", + "tags": [], + "label": "software", + "description": [], + "signature": [ + "{ alias?: string[] | undefined; id?: string | undefined; name?: string | undefined; platforms?: string[] | undefined; reference?: string | undefined; type?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.tactic", + "type": "Object", + "tags": [], + "label": "tactic", + "description": [], + "signature": [ + "{ id?: string[] | undefined; name?: string[] | undefined; reference?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.technique", + "type": "Object", + "tags": [], + "label": "technique", + "description": [], + "signature": [ + "{ id?: string[] | undefined; name?: string[] | undefined; reference?: string[] | undefined; subtechnique?: { id?: string[] | undefined; name?: string[] | undefined; reference?: string[] | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsThreat.threat", + "type": "Object", + "tags": [], + "label": "threat", + "description": [], + "signature": [ + "{ indicator?: { marking?: { tlp?: { version?: string | undefined; } | undefined; } | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/threat.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls", + "type": "Interface", + "tags": [], + "label": "EcsTls", + "description": [ + "\nFields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files." + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.cipher", + "type": "string", + "tags": [], + "label": "cipher", + "description": [ + "\nString indicating the cipher used during the current connection." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.client", + "type": "Object", + "tags": [], + "label": "client", + "description": [], + "signature": [ + "{ certificate?: string | undefined; certificate_chain?: string[] | undefined; hash?: { md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; } | undefined; issuer?: string | undefined; ja3?: string | undefined; not_after?: string | undefined; not_before?: string | undefined; server_name?: string | undefined; subject?: string | undefined; supported_ciphers?: string[] | undefined; x509?: { alternative_names?: string[] | undefined; issuer?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; not_after?: string | undefined; not_before?: string | undefined; public_key_algorithm?: string | undefined; public_key_curve?: string | undefined; public_key_exponent?: number | undefined; public_key_size?: number | undefined; serial_number?: string | undefined; signature_algorithm?: string | undefined; subject?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; version_number?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.curve", + "type": "string", + "tags": [], + "label": "curve", + "description": [ + "\nString indicating the curve used for the given cipher, when applicable." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.established", + "type": "CompoundType", + "tags": [], + "label": "established", + "description": [ + "\nBoolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.next_protocol", + "type": "string", + "tags": [], + "label": "next_protocol", + "description": [ + "\nString indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.resumed", + "type": "CompoundType", + "tags": [], + "label": "resumed", + "description": [ + "\nBoolean flag indicating if this TLS connection was resumed from an existing TLS negotiation." + ], + "signature": [ + "boolean | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.server", + "type": "Object", + "tags": [], + "label": "server", + "description": [], + "signature": [ + "{ certificate?: string | undefined; certificate_chain?: string[] | undefined; hash?: { md5?: string | undefined; sha1?: string | undefined; sha256?: string | undefined; } | undefined; issuer?: string | undefined; ja3s?: string | undefined; not_after?: string | undefined; not_before?: string | undefined; subject?: string | undefined; x509?: { alternative_names?: string[] | undefined; issuer?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; not_after?: string | undefined; not_before?: string | undefined; public_key_algorithm?: string | undefined; public_key_curve?: string | undefined; public_key_exponent?: number | undefined; public_key_size?: number | undefined; serial_number?: string | undefined; signature_algorithm?: string | undefined; subject?: { common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined; version_number?: string | undefined; } | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nNumeric part of the version parsed from the original string." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTls.version_protocol", + "type": "string", + "tags": [], + "label": "version_protocol", + "description": [ + "\nNormalized lowercase protocol name parsed from original string." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/tls.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTracing", + "type": "Interface", + "tags": [], + "label": "EcsTracing", + "description": [ + "\nDistributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.\nUnlike most field sets in ECS, the tracing fields are *not* nested under the field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, and so on." + ], + "path": "packages/kbn-ecs/generated/tracing.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTracing.span", + "type": "Object", + "tags": [], + "label": "span", + "description": [], + "signature": [ + "{ id?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/tracing.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTracing.trace", + "type": "Object", + "tags": [], + "label": "trace", + "description": [], + "signature": [ + "{ id?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/tracing.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsTracing.transaction", + "type": "Object", + "tags": [], + "label": "transaction", + "description": [], + "signature": [ + "{ id?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/tracing.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl", + "type": "Interface", + "tags": [], + "label": "EcsUrl", + "description": [ + "\nURL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on." + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nDomain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.extension", + "type": "string", + "tags": [], + "label": "extension", + "description": [ + "\nThe field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.fragment", + "type": "string", + "tags": [], + "label": "fragment", + "description": [ + "\nPortion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.full", + "type": "string", + "tags": [], + "label": "full", + "description": [ + "\nIf full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.original", + "type": "string", + "tags": [], + "label": "original", + "description": [ + "\nUnmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.password", + "type": "string", + "tags": [], + "label": "password", + "description": [ + "\nPassword of the request." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.path", + "type": "string", + "tags": [], + "label": "path", + "description": [ + "\nPath of the request, such as \"/search\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.port", + "type": "number", + "tags": [], + "label": "port", + "description": [ + "\nPort of the request, such as 443." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.query", + "type": "string", + "tags": [], + "label": "query", + "description": [ + "\nThe query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.registered_domain", + "type": "string", + "tags": [], + "label": "registered_domain", + "description": [ + "\nThe highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.scheme", + "type": "string", + "tags": [], + "label": "scheme", + "description": [ + "\nScheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.subdomain", + "type": "string", + "tags": [], + "label": "subdomain", + "description": [ + "\nThe subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.top_level_domain", + "type": "string", + "tags": [], + "label": "top_level_domain", + "description": [ + "\nThe effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUrl.username", + "type": "string", + "tags": [], + "label": "username", + "description": [ + "\nUsername of the request." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/url.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser", + "type": "Interface", + "tags": [], + "label": "EcsUser", + "description": [ + "\nThe user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them." + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.changes", + "type": "Object", + "tags": [], + "label": "changes", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.domain", + "type": "string", + "tags": [], + "label": "domain", + "description": [ + "\nName of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.effective", + "type": "Object", + "tags": [], + "label": "effective", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.email", + "type": "string", + "tags": [], + "label": "email", + "description": [ + "\nUser email address." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.full_name", + "type": "string", + "tags": [], + "label": "full_name", + "description": [ + "\nUser's full name, if available." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.group", + "type": "Object", + "tags": [], + "label": "group", + "description": [], + "signature": [ + "{ domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.hash", + "type": "string", + "tags": [], + "label": "hash", + "description": [ + "\nUnique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nUnique identifier of the user." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nShort name or login of the user." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.risk", + "type": "Object", + "tags": [], + "label": "risk", + "description": [], + "signature": [ + "{ calculated_level?: string | undefined; calculated_score?: number | undefined; calculated_score_norm?: number | undefined; static_level?: string | undefined; static_score?: number | undefined; static_score_norm?: number | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.roles", + "type": "Array", + "tags": [], + "label": "roles", + "description": [ + "\nArray of user roles at the time of the event." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUser.target", + "type": "Object", + "tags": [], + "label": "target", + "description": [], + "signature": [ + "{ domain?: string | undefined; email?: string | undefined; full_name?: string | undefined; group?: { domain?: string | undefined; id?: string | undefined; name?: string | undefined; } | undefined; hash?: string | undefined; id?: string | undefined; name?: string | undefined; roles?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUserAgent", + "type": "Interface", + "tags": [], + "label": "EcsUserAgent", + "description": [ + "\nThe user_agent fields normally come from a browser request.\nThey often show up in web service logs coming from the parsed user agent string." + ], + "path": "packages/kbn-ecs/generated/user_agent.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUserAgent.device", + "type": "Object", + "tags": [], + "label": "device", + "description": [], + "signature": [ + "{ name?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user_agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUserAgent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nName of the user agent." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user_agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUserAgent.original", + "type": "string", + "tags": [], + "label": "original", + "description": [ + "\nUnparsed user_agent string." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user_agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUserAgent.os", + "type": "Object", + "tags": [], + "label": "os", + "description": [], + "signature": [ + "{ family?: string | undefined; full?: string | undefined; kernel?: string | undefined; name?: string | undefined; platform?: string | undefined; type?: string | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/user_agent.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsUserAgent.version", + "type": "string", + "tags": [], + "label": "version", + "description": [ + "\nVersion of the user agent." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/user_agent.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVlan", + "type": "Interface", + "tags": [], + "label": "EcsVlan", + "description": [ + "\nThe VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection.\nNetwork.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic.\nNetwork.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging.\nObserver.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers." + ], + "path": "packages/kbn-ecs/generated/vlan.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVlan.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nVLAN ID as reported by the observer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vlan.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVlan.name", + "type": "string", + "tags": [], + "label": "name", + "description": [ + "\nOptional VLAN name as reported by the observer." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vlan.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability", + "type": "Interface", + "tags": [], + "label": "EcsVulnerability", + "description": [ + "\nThe vulnerability fields describe information about a vulnerability that is relevant to an event." + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.category", + "type": "Array", + "tags": [], + "label": "category", + "description": [ + "\nThe type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories])\nThis field must be an array." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.classification", + "type": "string", + "tags": [], + "label": "classification", + "description": [ + "\nThe classification of the vulnerability scoring system. For example (https://www.first.org/cvss/)" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.description", + "type": "string", + "tags": [], + "label": "description", + "description": [ + "\nThe description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description])" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.enumeration", + "type": "string", + "tags": [], + "label": "enumeration", + "description": [ + "\nThe type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/)" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.id", + "type": "string", + "tags": [], + "label": "id", + "description": [ + "\nThe identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID]" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.reference", + "type": "string", + "tags": [], + "label": "reference", + "description": [ + "\nA resource that provides additional information, context, and mitigations for the identified vulnerability." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.report_id", + "type": "string", + "tags": [], + "label": "report_id", + "description": [ + "\nThe report or scan identification number." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.scanner", + "type": "Object", + "tags": [], + "label": "scanner", + "description": [], + "signature": [ + "{ vendor?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.score", + "type": "Object", + "tags": [], + "label": "score", + "description": [], + "signature": [ + "{ base?: number | undefined; environmental?: number | undefined; temporal?: number | undefined; version?: string | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsVulnerability.severity", + "type": "string", + "tags": [], + "label": "severity", + "description": [ + "\nThe severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)" + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/vulnerability.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509", + "type": "Interface", + "tags": [], + "label": "EcsX509", + "description": [ + "\nThis implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk.\nWhen the certificate relates to a file, use the fields at `file.x509`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`).\nEvents that contain certificate information about network connections, should use the x509 fields under the relevant TLS fields: `tls.server.x509` and/or `tls.client.x509`." + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.alternative_names", + "type": "Array", + "tags": [], + "label": "alternative_names", + "description": [ + "\nList of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses." + ], + "signature": [ + "string[] | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.issuer", + "type": "Object", + "tags": [], + "label": "issuer", + "description": [], + "signature": [ + "{ common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.not_after", + "type": "string", + "tags": [], + "label": "not_after", + "description": [ + "\nTime at which the certificate is no longer considered valid." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.not_before", + "type": "string", + "tags": [], + "label": "not_before", + "description": [ + "\nTime at which the certificate is first considered valid." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.public_key_algorithm", + "type": "string", + "tags": [], + "label": "public_key_algorithm", + "description": [ + "\nAlgorithm used to generate the public key." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.public_key_curve", + "type": "string", + "tags": [], + "label": "public_key_curve", + "description": [ + "\nThe curve used by the elliptic curve public key algorithm. This is algorithm specific." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.public_key_exponent", + "type": "number", + "tags": [], + "label": "public_key_exponent", + "description": [ + "\nExponent used to derive the public key. This is algorithm specific." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.public_key_size", + "type": "number", + "tags": [], + "label": "public_key_size", + "description": [ + "\nThe size of the public key space in bits." + ], + "signature": [ + "number | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.serial_number", + "type": "string", + "tags": [], + "label": "serial_number", + "description": [ + "\nUnique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.signature_algorithm", + "type": "string", + "tags": [], + "label": "signature_algorithm", + "description": [ + "\nIdentifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.subject", + "type": "Object", + "tags": [], + "label": "subject", + "description": [], + "signature": [ + "{ common_name?: string[] | undefined; country?: string[] | undefined; distinguished_name?: string | undefined; locality?: string[] | undefined; organization?: string[] | undefined; organizational_unit?: string[] | undefined; state_or_province?: string[] | undefined; } | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsX509.version_number", + "type": "string", + "tags": [], + "label": "version_number", + "description": [ + "\nVersion of x509 format." + ], + "signature": [ + "string | undefined" + ], + "path": "packages/kbn-ecs/generated/x509.ts", + "deprecated": false, + "trackAdoption": false + } + ], + "initialIsOpen": false + } + ], "enums": [], "misc": [ { @@ -28,151 +8022,396960 @@ "type": "Type", "tags": [], "label": "Ecs", - "description": [ - "\nRepresents the full ECS schema.\n" - ], + "description": [], "signature": [ - "EcsBase", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsBase", + "text": "EcsBase" + }, " & ", - "EcsTracing", - " & { ecs: EcsField; agent?: ", - "EcsAgent", - " | undefined; as?: ", - "EcsAutonomousSystem", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTracing", + "text": "EcsTracing" + }, + " & { agent?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsAgent", + "text": "EcsAgent" + }, " | undefined; client?: ", - "EcsClient", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsClient", + "text": "EcsClient" + }, " | undefined; cloud?: ", - "EcsCloud", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsCloud", + "text": "EcsCloud" + }, " | undefined; container?: ", - "EcsContainer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsContainer", + "text": "EcsContainer" + }, " | undefined; data_stream?: ", - "EcsDataStream", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDataStream", + "text": "EcsDataStream" + }, " | undefined; destination?: ", - "EcsDestination", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDestination", + "text": "EcsDestination" + }, + " | undefined; device?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDevice", + "text": "EcsDevice" + }, + " | undefined; dll?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDll", + "text": "EcsDll" + }, " | undefined; dns?: ", - "EcsDns", - " | undefined; email?: ", - "EcsEmail", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDns", + "text": "EcsDns" + }, + " | undefined; ecs: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEcs", + "text": "EcsEcs" + }, + "; email?: ", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEmail", + "text": "EcsEmail" + }, " | undefined; error?: ", - "EcsError", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsError", + "text": "EcsError" + }, " | undefined; event?: ", - "EcsEvent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEvent", + "text": "EcsEvent" + }, " | undefined; faas?: ", - "EcsFaas", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsFaas", + "text": "EcsFaas" + }, " | undefined; file?: ", - "EcsFile", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsFile", + "text": "EcsFile" + }, " | undefined; group?: ", - "EcsGroup", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsGroup", + "text": "EcsGroup" + }, " | undefined; host?: ", - "EcsHost", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHost", + "text": "EcsHost" + }, " | undefined; http?: ", - "EcsHttp", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHttp", + "text": "EcsHttp" + }, " | undefined; log?: ", - "EcsLog", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsLog", + "text": "EcsLog" + }, " | undefined; network?: ", - "EcsNetwork", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsNetwork", + "text": "EcsNetwork" + }, " | undefined; observer?: ", - "EcsObserver", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsObserver", + "text": "EcsObserver" + }, " | undefined; orchestrator?: ", - "EcsOrchestrator", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsOrchestrator", + "text": "EcsOrchestrator" + }, " | undefined; organization?: ", - "EcsOrganization", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsOrganization", + "text": "EcsOrganization" + }, " | undefined; package?: ", - "EcsPackage", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsPackage", + "text": "EcsPackage" + }, " | undefined; process?: ", - "EcsProcess", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsProcess", + "text": "EcsProcess" + }, " | undefined; registry?: ", - "EcsRegistry", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRegistry", + "text": "EcsRegistry" + }, " | undefined; related?: ", - "EcsRelated", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRelated", + "text": "EcsRelated" + }, " | undefined; rule?: ", - "EcsRule", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRule", + "text": "EcsRule" + }, " | undefined; server?: ", - "EcsServer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsServer", + "text": "EcsServer" + }, " | undefined; service?: ", - "EcsService", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsService", + "text": "EcsService" + }, " | undefined; source?: ", - "EcsSource", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsSource", + "text": "EcsSource" + }, " | undefined; threat?: ", - "EcsThreat", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsThreat", + "text": "EcsThreat" + }, " | undefined; tls?: ", - "EcsTls", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTls", + "text": "EcsTls" + }, " | undefined; url?: ", - "EcsUrl", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUrl", + "text": "EcsUrl" + }, " | undefined; user?: ", - "EcsUser", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUser", + "text": "EcsUser" + }, " | undefined; user_agent?: ", - "EcsUserAgent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUserAgent", + "text": "EcsUserAgent" + }, " | undefined; vulnerability?: ", - "EcsVulnerability", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsVulnerability", + "text": "EcsVulnerability" + }, " | undefined; }" ], - "path": "packages/kbn-ecs/src/ecs/index.ts", + "path": "packages/kbn-ecs/generated/index.ts", "deprecated": false, "trackAdoption": false, "initialIsOpen": false }, { "parentPluginId": "@kbn/ecs", - "id": "def-common.EcsEventCategory", - "type": "Type", + "id": "def-common.EcsVersion", + "type": "string", "tags": [], - "label": "EcsEventCategory", + "label": "EcsVersion", "description": [], "signature": [ - "\"host\" | \"database\" | \"email\" | \"package\" | \"network\" | \"web\" | \"file\" | \"session\" | \"registry\" | \"process\" | \"authentication\" | \"configuration\" | \"driver\" | \"iam\" | \"intrusion_detection\" | \"malware\"" + "\"8.6.0\"" ], - "path": "packages/kbn-ecs/src/ecs/event.ts", + "path": "packages/kbn-ecs/generated/index.ts", "deprecated": false, "trackAdoption": false, "initialIsOpen": false - }, + } + ], + "objects": [ { "parentPluginId": "@kbn/ecs", - "id": "def-common.EcsEventKind", - "type": "Type", + "id": "def-common.EcsFlat", + "type": "Object", "tags": [], - "label": "EcsEventKind", + "label": "EcsFlat", "description": [], - "signature": [ - "\"metric\" | \"alert\" | \"signal\" | \"state\" | \"event\" | \"pipeline_error\"" - ], - "path": "packages/kbn-ecs/src/ecs/event.ts", + "path": "packages/kbn-ecs/generated/ecs_flat.ts", "deprecated": false, "trackAdoption": false, - "initialIsOpen": false - }, - { - "parentPluginId": "@kbn/ecs", - "id": "def-common.EcsEventOutcome", - "type": "Type", - "tags": [], - "label": "EcsEventOutcome", - "description": [], - "signature": [ - "\"success\" | \"unknown\" | \"failure\"" + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp", + "type": "Object", + "tags": [], + "label": "'@timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.required", + "type": "boolean", + "tags": [], + "label": "required", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original", + "type": "Object", + "tags": [], + "label": "'agent.build.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.build.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'agent.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id", + "type": "Object", + "tags": [], + "label": "'agent.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name", + "type": "Object", + "tags": [], + "label": "'agent.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type", + "type": "Object", + "tags": [], + "label": "'agent.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version", + "type": "Object", + "tags": [], + "label": "'agent.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.agent.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address", + "type": "Object", + "tags": [], + "label": "'client.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number", + "type": "Object", + "tags": [], + "label": "'client.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name", + "type": "Object", + "tags": [], + "label": "'client.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes", + "type": "Object", + "tags": [], + "label": "'client.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain", + "type": "Object", + "tags": [], + "label": "'client.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name", + "type": "Object", + "tags": [], + "label": "'client.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'client.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'client.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'client.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name", + "type": "Object", + "tags": [], + "label": "'client.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location", + "type": "Object", + "tags": [], + "label": "'client.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name", + "type": "Object", + "tags": [], + "label": "'client.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'client.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'client.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name", + "type": "Object", + "tags": [], + "label": "'client.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone", + "type": "Object", + "tags": [], + "label": "'client.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip", + "type": "Object", + "tags": [], + "label": "'client.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac", + "type": "Object", + "tags": [], + "label": "'client.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip", + "type": "Object", + "tags": [], + "label": "'client.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port", + "type": "Object", + "tags": [], + "label": "'client.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets", + "type": "Object", + "tags": [], + "label": "'client.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port", + "type": "Object", + "tags": [], + "label": "'client.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain", + "type": "Object", + "tags": [], + "label": "'client.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain", + "type": "Object", + "tags": [], + "label": "'client.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain", + "type": "Object", + "tags": [], + "label": "'client.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain", + "type": "Object", + "tags": [], + "label": "'client.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email", + "type": "Object", + "tags": [], + "label": "'client.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name", + "type": "Object", + "tags": [], + "label": "'client.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain", + "type": "Object", + "tags": [], + "label": "'client.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id", + "type": "Object", + "tags": [], + "label": "'client.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name", + "type": "Object", + "tags": [], + "label": "'client.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash", + "type": "Object", + "tags": [], + "label": "'client.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id", + "type": "Object", + "tags": [], + "label": "'client.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name", + "type": "Object", + "tags": [], + "label": "'client.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles", + "type": "Object", + "tags": [], + "label": "'client.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.client.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id", + "type": "Object", + "tags": [], + "label": "'cloud.account.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name", + "type": "Object", + "tags": [], + "label": "'cloud.account.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.account.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone", + "type": "Object", + "tags": [], + "label": "'cloud.availability_zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.availability_zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id", + "type": "Object", + "tags": [], + "label": "'cloud.instance.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name", + "type": "Object", + "tags": [], + "label": "'cloud.instance.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.instance.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type", + "type": "Object", + "tags": [], + "label": "'cloud.machine.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.machine.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id", + "type": "Object", + "tags": [], + "label": "'cloud.origin.account.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.account.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.account.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone", + "type": "Object", + "tags": [], + "label": "'cloud.origin.availability_zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.availability_zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id", + "type": "Object", + "tags": [], + "label": "'cloud.origin.instance.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.instance.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.instance.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type", + "type": "Object", + "tags": [], + "label": "'cloud.origin.machine.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.machine.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id", + "type": "Object", + "tags": [], + "label": "'cloud.origin.project.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.project.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.project.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider", + "type": "Object", + "tags": [], + "label": "'cloud.origin.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region", + "type": "Object", + "tags": [], + "label": "'cloud.origin.region'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.region.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.origin.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id", + "type": "Object", + "tags": [], + "label": "'cloud.project.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name", + "type": "Object", + "tags": [], + "label": "'cloud.project.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.project.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider", + "type": "Object", + "tags": [], + "label": "'cloud.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region", + "type": "Object", + "tags": [], + "label": "'cloud.region'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.region.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name", + "type": "Object", + "tags": [], + "label": "'cloud.service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id", + "type": "Object", + "tags": [], + "label": "'cloud.target.account.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.account.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.account.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone", + "type": "Object", + "tags": [], + "label": "'cloud.target.availability_zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.availability_zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id", + "type": "Object", + "tags": [], + "label": "'cloud.target.instance.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.instance.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.instance.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type", + "type": "Object", + "tags": [], + "label": "'cloud.target.machine.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.machine.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id", + "type": "Object", + "tags": [], + "label": "'cloud.target.project.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.project.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.project.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider", + "type": "Object", + "tags": [], + "label": "'cloud.target.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region", + "type": "Object", + "tags": [], + "label": "'cloud.target.region'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.region.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.cloud.target.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage", + "type": "Object", + "tags": [], + "label": "'container.cpu.usage'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.scaling_factor", + "type": "number", + "tags": [], + "label": "scaling_factor", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.cpu.usage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes", + "type": "Object", + "tags": [], + "label": "'container.disk.read.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.read.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes", + "type": "Object", + "tags": [], + "label": "'container.disk.write.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.disk.write.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id", + "type": "Object", + "tags": [], + "label": "'container.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all", + "type": "Object", + "tags": [], + "label": "'container.image.hash.all'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.hash.all.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name", + "type": "Object", + "tags": [], + "label": "'container.image.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag", + "type": "Object", + "tags": [], + "label": "'container.image.tag'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.image.tag.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels", + "type": "Object", + "tags": [], + "label": "'container.labels'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.object_type", + "type": "string", + "tags": [], + "label": "object_type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.labels.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage", + "type": "Object", + "tags": [], + "label": "'container.memory.usage'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.scaling_factor", + "type": "number", + "tags": [], + "label": "scaling_factor", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.memory.usage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name", + "type": "Object", + "tags": [], + "label": "'container.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes", + "type": "Object", + "tags": [], + "label": "'container.network.egress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.egress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes", + "type": "Object", + "tags": [], + "label": "'container.network.ingress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.network.ingress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime", + "type": "Object", + "tags": [], + "label": "'container.runtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.container.runtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset", + "type": "Object", + "tags": [], + "label": "'data_stream.dataset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.dataset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace", + "type": "Object", + "tags": [], + "label": "'data_stream.namespace'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.namespace.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type", + "type": "Object", + "tags": [], + "label": "'data_stream.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.data_stream.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address", + "type": "Object", + "tags": [], + "label": "'destination.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number", + "type": "Object", + "tags": [], + "label": "'destination.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name", + "type": "Object", + "tags": [], + "label": "'destination.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes", + "type": "Object", + "tags": [], + "label": "'destination.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain", + "type": "Object", + "tags": [], + "label": "'destination.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location", + "type": "Object", + "tags": [], + "label": "'destination.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name", + "type": "Object", + "tags": [], + "label": "'destination.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone", + "type": "Object", + "tags": [], + "label": "'destination.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip", + "type": "Object", + "tags": [], + "label": "'destination.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac", + "type": "Object", + "tags": [], + "label": "'destination.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip", + "type": "Object", + "tags": [], + "label": "'destination.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port", + "type": "Object", + "tags": [], + "label": "'destination.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets", + "type": "Object", + "tags": [], + "label": "'destination.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port", + "type": "Object", + "tags": [], + "label": "'destination.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain", + "type": "Object", + "tags": [], + "label": "'destination.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain", + "type": "Object", + "tags": [], + "label": "'destination.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain", + "type": "Object", + "tags": [], + "label": "'destination.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain", + "type": "Object", + "tags": [], + "label": "'destination.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email", + "type": "Object", + "tags": [], + "label": "'destination.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name", + "type": "Object", + "tags": [], + "label": "'destination.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain", + "type": "Object", + "tags": [], + "label": "'destination.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id", + "type": "Object", + "tags": [], + "label": "'destination.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name", + "type": "Object", + "tags": [], + "label": "'destination.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash", + "type": "Object", + "tags": [], + "label": "'destination.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id", + "type": "Object", + "tags": [], + "label": "'destination.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name", + "type": "Object", + "tags": [], + "label": "'destination.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles", + "type": "Object", + "tags": [], + "label": "'destination.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.destination.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id", + "type": "Object", + "tags": [], + "label": "'device.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer", + "type": "Object", + "tags": [], + "label": "'device.manufacturer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.manufacturer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier", + "type": "Object", + "tags": [], + "label": "'device.model.identifier'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.identifier.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name", + "type": "Object", + "tags": [], + "label": "'device.model.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.device.model.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5", + "type": "Object", + "tags": [], + "label": "'dll.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'dll.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'dll.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name", + "type": "Object", + "tags": [], + "label": "'dll.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path", + "type": "Object", + "tags": [], + "label": "'dll.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture", + "type": "Object", + "tags": [], + "label": "'dll.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company", + "type": "Object", + "tags": [], + "label": "'dll.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description", + "type": "Object", + "tags": [], + "label": "'dll.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version", + "type": "Object", + "tags": [], + "label": "'dll.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash", + "type": "Object", + "tags": [], + "label": "'dll.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'dll.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash", + "type": "Object", + "tags": [], + "label": "'dll.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product", + "type": "Object", + "tags": [], + "label": "'dll.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dll.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers", + "type": "Object", + "tags": [], + "label": "'dns.answers'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class", + "type": "Object", + "tags": [], + "label": "'dns.answers.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data", + "type": "Object", + "tags": [], + "label": "'dns.answers.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name", + "type": "Object", + "tags": [], + "label": "'dns.answers.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl", + "type": "Object", + "tags": [], + "label": "'dns.answers.ttl'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.ttl.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type", + "type": "Object", + "tags": [], + "label": "'dns.answers.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.answers.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags", + "type": "Object", + "tags": [], + "label": "'dns.header_flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.header_flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id", + "type": "Object", + "tags": [], + "label": "'dns.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code", + "type": "Object", + "tags": [], + "label": "'dns.op_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.op_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class", + "type": "Object", + "tags": [], + "label": "'dns.question.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name", + "type": "Object", + "tags": [], + "label": "'dns.question.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain", + "type": "Object", + "tags": [], + "label": "'dns.question.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain", + "type": "Object", + "tags": [], + "label": "'dns.question.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain", + "type": "Object", + "tags": [], + "label": "'dns.question.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type", + "type": "Object", + "tags": [], + "label": "'dns.question.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.question.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip", + "type": "Object", + "tags": [], + "label": "'dns.resolved_ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.resolved_ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code", + "type": "Object", + "tags": [], + "label": "'dns.response_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.response_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type", + "type": "Object", + "tags": [], + "label": "'dns.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.dns.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version", + "type": "Object", + "tags": [], + "label": "'ecs.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.required", + "type": "boolean", + "tags": [], + "label": "required", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.ecs.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments", + "type": "Object", + "tags": [], + "label": "'email.attachments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.attachments.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address", + "type": "Object", + "tags": [], + "label": "'email.bcc.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.bcc.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address", + "type": "Object", + "tags": [], + "label": "'email.cc.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.cc.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type", + "type": "Object", + "tags": [], + "label": "'email.content_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.content_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp", + "type": "Object", + "tags": [], + "label": "'email.delivery_timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.delivery_timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction", + "type": "Object", + "tags": [], + "label": "'email.direction'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.direction.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address", + "type": "Object", + "tags": [], + "label": "'email.from.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.from.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id", + "type": "Object", + "tags": [], + "label": "'email.local_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.local_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id", + "type": "Object", + "tags": [], + "label": "'email.message_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.message_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp", + "type": "Object", + "tags": [], + "label": "'email.origination_timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.origination_timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address", + "type": "Object", + "tags": [], + "label": "'email.reply_to.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.reply_to.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address", + "type": "Object", + "tags": [], + "label": "'email.sender.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.sender.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject", + "type": "Object", + "tags": [], + "label": "'email.subject'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.subject.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address", + "type": "Object", + "tags": [], + "label": "'email.to.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.to.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer", + "type": "Object", + "tags": [], + "label": "'email.x_mailer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.email.x_mailer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code", + "type": "Object", + "tags": [], + "label": "'error.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id", + "type": "Object", + "tags": [], + "label": "'error.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message", + "type": "Object", + "tags": [], + "label": "'error.message'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.message.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace", + "type": "Object", + "tags": [], + "label": "'error.stack_trace'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.stack_trace.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type", + "type": "Object", + "tags": [], + "label": "'error.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.error.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action", + "type": "Object", + "tags": [], + "label": "'event.action'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.action.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status", + "type": "Object", + "tags": [], + "label": "'event.agent_id_status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.agent_id_status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category", + "type": "Object", + "tags": [], + "label": "'event.category'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; expected_event_types: string[]; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.category.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code", + "type": "Object", + "tags": [], + "label": "'event.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created", + "type": "Object", + "tags": [], + "label": "'event.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset", + "type": "Object", + "tags": [], + "label": "'event.dataset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.dataset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration", + "type": "Object", + "tags": [], + "label": "'event.duration'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.input_format", + "type": "string", + "tags": [], + "label": "input_format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.output_format", + "type": "string", + "tags": [], + "label": "output_format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.output_precision", + "type": "number", + "tags": [], + "label": "output_precision", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.duration.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end", + "type": "Object", + "tags": [], + "label": "'event.end'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.end.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash", + "type": "Object", + "tags": [], + "label": "'event.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id", + "type": "Object", + "tags": [], + "label": "'event.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested", + "type": "Object", + "tags": [], + "label": "'event.ingested'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.ingested.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind", + "type": "Object", + "tags": [], + "label": "'event.kind'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.kind.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module", + "type": "Object", + "tags": [], + "label": "'event.module'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.module.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original", + "type": "Object", + "tags": [], + "label": "'event.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome", + "type": "Object", + "tags": [], + "label": "'event.outcome'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.outcome.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider", + "type": "Object", + "tags": [], + "label": "'event.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason", + "type": "Object", + "tags": [], + "label": "'event.reason'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reason.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference", + "type": "Object", + "tags": [], + "label": "'event.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score", + "type": "Object", + "tags": [], + "label": "'event.risk_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm", + "type": "Object", + "tags": [], + "label": "'event.risk_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.risk_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence", + "type": "Object", + "tags": [], + "label": "'event.sequence'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.sequence.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity", + "type": "Object", + "tags": [], + "label": "'event.severity'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.severity.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start", + "type": "Object", + "tags": [], + "label": "'event.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone", + "type": "Object", + "tags": [], + "label": "'event.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type", + "type": "Object", + "tags": [], + "label": "'event.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url", + "type": "Object", + "tags": [], + "label": "'event.url'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.event.url.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart", + "type": "Object", + "tags": [], + "label": "'faas.coldstart'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.coldstart.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution", + "type": "Object", + "tags": [], + "label": "'faas.execution'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.execution.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id", + "type": "Object", + "tags": [], + "label": "'faas.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name", + "type": "Object", + "tags": [], + "label": "'faas.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger", + "type": "Object", + "tags": [], + "label": "'faas.trigger'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id", + "type": "Object", + "tags": [], + "label": "'faas.trigger.request_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.request_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type", + "type": "Object", + "tags": [], + "label": "'faas.trigger.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.trigger.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version", + "type": "Object", + "tags": [], + "label": "'faas.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.faas.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed", + "type": "Object", + "tags": [], + "label": "'file.accessed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.accessed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes", + "type": "Object", + "tags": [], + "label": "'file.attributes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.attributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'file.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'file.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'file.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status", + "type": "Object", + "tags": [], + "label": "'file.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'file.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'file.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'file.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'file.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'file.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created", + "type": "Object", + "tags": [], + "label": "'file.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime", + "type": "Object", + "tags": [], + "label": "'file.ctime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.ctime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device", + "type": "Object", + "tags": [], + "label": "'file.device'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory", + "type": "Object", + "tags": [], + "label": "'file.directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter", + "type": "Object", + "tags": [], + "label": "'file.drive_letter'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.drive_letter.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture", + "type": "Object", + "tags": [], + "label": "'file.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'file.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'file.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'file.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports", + "type": "Object", + "tags": [], + "label": "'file.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'file.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class", + "type": "Object", + "tags": [], + "label": "'file.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data", + "type": "Object", + "tags": [], + "label": "'file.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'file.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'file.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'file.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type", + "type": "Object", + "tags": [], + "label": "'file.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version", + "type": "Object", + "tags": [], + "label": "'file.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports", + "type": "Object", + "tags": [], + "label": "'file.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections", + "type": "Object", + "tags": [], + "label": "'file.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments", + "type": "Object", + "tags": [], + "label": "'file.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'file.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'file.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'file.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'file.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension", + "type": "Object", + "tags": [], + "label": "'file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name", + "type": "Object", + "tags": [], + "label": "'file.fork_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.fork_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid", + "type": "Object", + "tags": [], + "label": "'file.gid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.gid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group", + "type": "Object", + "tags": [], + "label": "'file.group'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode", + "type": "Object", + "tags": [], + "label": "'file.inode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.inode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type", + "type": "Object", + "tags": [], + "label": "'file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode", + "type": "Object", + "tags": [], + "label": "'file.mode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime", + "type": "Object", + "tags": [], + "label": "'file.mtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.mtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name", + "type": "Object", + "tags": [], + "label": "'file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner", + "type": "Object", + "tags": [], + "label": "'file.owner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.owner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path", + "type": "Object", + "tags": [], + "label": "'file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture", + "type": "Object", + "tags": [], + "label": "'file.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company", + "type": "Object", + "tags": [], + "label": "'file.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description", + "type": "Object", + "tags": [], + "label": "'file.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version", + "type": "Object", + "tags": [], + "label": "'file.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash", + "type": "Object", + "tags": [], + "label": "'file.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'file.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash", + "type": "Object", + "tags": [], + "label": "'file.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product", + "type": "Object", + "tags": [], + "label": "'file.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size", + "type": "Object", + "tags": [], + "label": "'file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path", + "type": "Object", + "tags": [], + "label": "'file.target_path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.target_path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type", + "type": "Object", + "tags": [], + "label": "'file.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid", + "type": "Object", + "tags": [], + "label": "'file.uid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.uid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'file.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after", + "type": "Object", + "tags": [], + "label": "'file.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before", + "type": "Object", + "tags": [], + "label": "'file.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'file.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'file.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number", + "type": "Object", + "tags": [], + "label": "'file.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.file.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain", + "type": "Object", + "tags": [], + "label": "'group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id", + "type": "Object", + "tags": [], + "label": "'group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name", + "type": "Object", + "tags": [], + "label": "'group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture", + "type": "Object", + "tags": [], + "label": "'host.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id", + "type": "Object", + "tags": [], + "label": "'host.boot.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.boot.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage", + "type": "Object", + "tags": [], + "label": "'host.cpu.usage'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.scaling_factor", + "type": "number", + "tags": [], + "label": "scaling_factor", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.cpu.usage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes", + "type": "Object", + "tags": [], + "label": "'host.disk.read.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.read.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes", + "type": "Object", + "tags": [], + "label": "'host.disk.write.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.disk.write.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain", + "type": "Object", + "tags": [], + "label": "'host.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name", + "type": "Object", + "tags": [], + "label": "'host.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'host.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'host.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'host.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name", + "type": "Object", + "tags": [], + "label": "'host.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location", + "type": "Object", + "tags": [], + "label": "'host.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name", + "type": "Object", + "tags": [], + "label": "'host.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'host.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'host.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name", + "type": "Object", + "tags": [], + "label": "'host.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone", + "type": "Object", + "tags": [], + "label": "'host.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname", + "type": "Object", + "tags": [], + "label": "'host.hostname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.hostname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id", + "type": "Object", + "tags": [], + "label": "'host.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip", + "type": "Object", + "tags": [], + "label": "'host.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac", + "type": "Object", + "tags": [], + "label": "'host.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name", + "type": "Object", + "tags": [], + "label": "'host.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes", + "type": "Object", + "tags": [], + "label": "'host.network.egress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets", + "type": "Object", + "tags": [], + "label": "'host.network.egress.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.egress.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes", + "type": "Object", + "tags": [], + "label": "'host.network.ingress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets", + "type": "Object", + "tags": [], + "label": "'host.network.ingress.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.network.ingress.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family", + "type": "Object", + "tags": [], + "label": "'host.os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full", + "type": "Object", + "tags": [], + "label": "'host.os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel", + "type": "Object", + "tags": [], + "label": "'host.os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name", + "type": "Object", + "tags": [], + "label": "'host.os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform", + "type": "Object", + "tags": [], + "label": "'host.os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type", + "type": "Object", + "tags": [], + "label": "'host.os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version", + "type": "Object", + "tags": [], + "label": "'host.os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino", + "type": "Object", + "tags": [], + "label": "'host.pid_ns_ino'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.pid_ns_ino.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level", + "type": "Object", + "tags": [], + "label": "'host.risk.calculated_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score", + "type": "Object", + "tags": [], + "label": "'host.risk.calculated_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm", + "type": "Object", + "tags": [], + "label": "'host.risk.calculated_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.calculated_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level", + "type": "Object", + "tags": [], + "label": "'host.risk.static_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score", + "type": "Object", + "tags": [], + "label": "'host.risk.static_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm", + "type": "Object", + "tags": [], + "label": "'host.risk.static_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.risk.static_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type", + "type": "Object", + "tags": [], + "label": "'host.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime", + "type": "Object", + "tags": [], + "label": "'host.uptime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.host.uptime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes", + "type": "Object", + "tags": [], + "label": "'http.request.body.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content", + "type": "Object", + "tags": [], + "label": "'http.request.body.content'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.body.content.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes", + "type": "Object", + "tags": [], + "label": "'http.request.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id", + "type": "Object", + "tags": [], + "label": "'http.request.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method", + "type": "Object", + "tags": [], + "label": "'http.request.method'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.method.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type", + "type": "Object", + "tags": [], + "label": "'http.request.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer", + "type": "Object", + "tags": [], + "label": "'http.request.referrer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.request.referrer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes", + "type": "Object", + "tags": [], + "label": "'http.response.body.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content", + "type": "Object", + "tags": [], + "label": "'http.response.body.content'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.body.content.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes", + "type": "Object", + "tags": [], + "label": "'http.response.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type", + "type": "Object", + "tags": [], + "label": "'http.response.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code", + "type": "Object", + "tags": [], + "label": "'http.response.status_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.response.status_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version", + "type": "Object", + "tags": [], + "label": "'http.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.http.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels", + "type": "Object", + "tags": [], + "label": "labels", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.object_type", + "type": "string", + "tags": [], + "label": "object_type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.labels.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path", + "type": "Object", + "tags": [], + "label": "'log.file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level", + "type": "Object", + "tags": [], + "label": "'log.level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger", + "type": "Object", + "tags": [], + "label": "'log.logger'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.logger.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line", + "type": "Object", + "tags": [], + "label": "'log.origin.file.line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name", + "type": "Object", + "tags": [], + "label": "'log.origin.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function", + "type": "Object", + "tags": [], + "label": "'log.origin.function'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.origin.function.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog", + "type": "Object", + "tags": [], + "label": "'log.syslog'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname", + "type": "Object", + "tags": [], + "label": "'log.syslog.appname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.appname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code", + "type": "Object", + "tags": [], + "label": "'log.syslog.facility.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name", + "type": "Object", + "tags": [], + "label": "'log.syslog.facility.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.facility.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname", + "type": "Object", + "tags": [], + "label": "'log.syslog.hostname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.hostname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid", + "type": "Object", + "tags": [], + "label": "'log.syslog.msgid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.msgid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority", + "type": "Object", + "tags": [], + "label": "'log.syslog.priority'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.priority.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid", + "type": "Object", + "tags": [], + "label": "'log.syslog.procid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.procid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code", + "type": "Object", + "tags": [], + "label": "'log.syslog.severity.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name", + "type": "Object", + "tags": [], + "label": "'log.syslog.severity.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.severity.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data", + "type": "Object", + "tags": [], + "label": "'log.syslog.structured_data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.structured_data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version", + "type": "Object", + "tags": [], + "label": "'log.syslog.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.log.syslog.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message", + "type": "Object", + "tags": [], + "label": "message", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.message.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application", + "type": "Object", + "tags": [], + "label": "'network.application'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.application.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes", + "type": "Object", + "tags": [], + "label": "'network.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id", + "type": "Object", + "tags": [], + "label": "'network.community_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.community_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction", + "type": "Object", + "tags": [], + "label": "'network.direction'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.direction.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip", + "type": "Object", + "tags": [], + "label": "'network.forwarded_ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.forwarded_ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number", + "type": "Object", + "tags": [], + "label": "'network.iana_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.iana_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner", + "type": "Object", + "tags": [], + "label": "'network.inner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id", + "type": "Object", + "tags": [], + "label": "'network.inner.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name", + "type": "Object", + "tags": [], + "label": "'network.inner.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.inner.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name", + "type": "Object", + "tags": [], + "label": "'network.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets", + "type": "Object", + "tags": [], + "label": "'network.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol", + "type": "Object", + "tags": [], + "label": "'network.protocol'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.protocol.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport", + "type": "Object", + "tags": [], + "label": "'network.transport'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.transport.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type", + "type": "Object", + "tags": [], + "label": "'network.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id", + "type": "Object", + "tags": [], + "label": "'network.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name", + "type": "Object", + "tags": [], + "label": "'network.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.network.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress", + "type": "Object", + "tags": [], + "label": "'observer.egress'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias", + "type": "Object", + "tags": [], + "label": "'observer.egress.interface.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id", + "type": "Object", + "tags": [], + "label": "'observer.egress.interface.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name", + "type": "Object", + "tags": [], + "label": "'observer.egress.interface.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.interface.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id", + "type": "Object", + "tags": [], + "label": "'observer.egress.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name", + "type": "Object", + "tags": [], + "label": "'observer.egress.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone", + "type": "Object", + "tags": [], + "label": "'observer.egress.zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.egress.zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location", + "type": "Object", + "tags": [], + "label": "'observer.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name", + "type": "Object", + "tags": [], + "label": "'observer.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone", + "type": "Object", + "tags": [], + "label": "'observer.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname", + "type": "Object", + "tags": [], + "label": "'observer.hostname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.hostname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress", + "type": "Object", + "tags": [], + "label": "'observer.ingress'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias", + "type": "Object", + "tags": [], + "label": "'observer.ingress.interface.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id", + "type": "Object", + "tags": [], + "label": "'observer.ingress.interface.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name", + "type": "Object", + "tags": [], + "label": "'observer.ingress.interface.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.interface.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id", + "type": "Object", + "tags": [], + "label": "'observer.ingress.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name", + "type": "Object", + "tags": [], + "label": "'observer.ingress.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone", + "type": "Object", + "tags": [], + "label": "'observer.ingress.zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ingress.zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip", + "type": "Object", + "tags": [], + "label": "'observer.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac", + "type": "Object", + "tags": [], + "label": "'observer.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name", + "type": "Object", + "tags": [], + "label": "'observer.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family", + "type": "Object", + "tags": [], + "label": "'observer.os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full", + "type": "Object", + "tags": [], + "label": "'observer.os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel", + "type": "Object", + "tags": [], + "label": "'observer.os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name", + "type": "Object", + "tags": [], + "label": "'observer.os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform", + "type": "Object", + "tags": [], + "label": "'observer.os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type", + "type": "Object", + "tags": [], + "label": "'observer.os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version", + "type": "Object", + "tags": [], + "label": "'observer.os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product", + "type": "Object", + "tags": [], + "label": "'observer.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number", + "type": "Object", + "tags": [], + "label": "'observer.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type", + "type": "Object", + "tags": [], + "label": "'observer.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor", + "type": "Object", + "tags": [], + "label": "'observer.vendor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.vendor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version", + "type": "Object", + "tags": [], + "label": "'observer.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.observer.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version", + "type": "Object", + "tags": [], + "label": "'orchestrator.api_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.api_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.url'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.url.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.cluster.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace", + "type": "Object", + "tags": [], + "label": "'orchestrator.namespace'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.namespace.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization", + "type": "Object", + "tags": [], + "label": "'orchestrator.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.parent.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.parent.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.resource.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type", + "type": "Object", + "tags": [], + "label": "'orchestrator.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.orchestrator.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id", + "type": "Object", + "tags": [], + "label": "'organization.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name", + "type": "Object", + "tags": [], + "label": "'organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture", + "type": "Object", + "tags": [], + "label": "'package.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version", + "type": "Object", + "tags": [], + "label": "'package.build_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.build_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum", + "type": "Object", + "tags": [], + "label": "'package.checksum'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.checksum.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description", + "type": "Object", + "tags": [], + "label": "'package.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope", + "type": "Object", + "tags": [], + "label": "'package.install_scope'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.install_scope.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed", + "type": "Object", + "tags": [], + "label": "'package.installed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.installed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license", + "type": "Object", + "tags": [], + "label": "'package.license'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.license.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name", + "type": "Object", + "tags": [], + "label": "'package.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path", + "type": "Object", + "tags": [], + "label": "'package.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference", + "type": "Object", + "tags": [], + "label": "'package.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size", + "type": "Object", + "tags": [], + "label": "'package.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type", + "type": "Object", + "tags": [], + "label": "'package.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version", + "type": "Object", + "tags": [], + "label": "'package.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.package.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args", + "type": "Object", + "tags": [], + "label": "'process.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count", + "type": "Object", + "tags": [], + "label": "'process.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'process.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'process.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'process.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status", + "type": "Object", + "tags": [], + "label": "'process.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'process.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'process.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'process.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'process.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'process.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line", + "type": "Object", + "tags": [], + "label": "'process.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture", + "type": "Object", + "tags": [], + "label": "'process.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'process.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'process.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'process.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports", + "type": "Object", + "tags": [], + "label": "'process.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'process.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class", + "type": "Object", + "tags": [], + "label": "'process.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data", + "type": "Object", + "tags": [], + "label": "'process.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'process.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'process.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'process.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type", + "type": "Object", + "tags": [], + "label": "'process.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version", + "type": "Object", + "tags": [], + "label": "'process.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports", + "type": "Object", + "tags": [], + "label": "'process.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections", + "type": "Object", + "tags": [], + "label": "'process.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments", + "type": "Object", + "tags": [], + "label": "'process.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'process.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'process.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'process.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'process.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end", + "type": "Object", + "tags": [], + "label": "'process.end'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.end.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.attested_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.attested_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.attested_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.attested_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.entry_meta.source.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.source.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.entry_meta.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.entry_meta.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.session_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.session_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.session_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.session_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.parent.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.same_as_process'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.same_as_process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.entry_leader.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars", + "type": "Object", + "tags": [], + "label": "'process.env_vars'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.env_vars.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable", + "type": "Object", + "tags": [], + "label": "'process.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code", + "type": "Object", + "tags": [], + "label": "'process.exit_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.exit_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args", + "type": "Object", + "tags": [], + "label": "'process.group_leader.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count", + "type": "Object", + "tags": [], + "label": "'process.group_leader.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line", + "type": "Object", + "tags": [], + "label": "'process.group_leader.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable", + "type": "Object", + "tags": [], + "label": "'process.group_leader.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive", + "type": "Object", + "tags": [], + "label": "'process.group_leader.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.group_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process", + "type": "Object", + "tags": [], + "label": "'process.group_leader.same_as_process'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.same_as_process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start", + "type": "Object", + "tags": [], + "label": "'process.group_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty", + "type": "Object", + "tags": [], + "label": "'process.group_leader.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.group_leader.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.group_leader.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory", + "type": "Object", + "tags": [], + "label": "'process.group_leader.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.group_leader.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5", + "type": "Object", + "tags": [], + "label": "'process.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1", + "type": "Object", + "tags": [], + "label": "'process.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256", + "type": "Object", + "tags": [], + "label": "'process.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384", + "type": "Object", + "tags": [], + "label": "'process.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512", + "type": "Object", + "tags": [], + "label": "'process.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'process.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'process.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive", + "type": "Object", + "tags": [], + "label": "'process.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io", + "type": "Object", + "tags": [], + "label": "'process.io'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped", + "type": "Object", + "tags": [], + "label": "'process.io.bytes_skipped'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length", + "type": "Object", + "tags": [], + "label": "'process.io.bytes_skipped.length'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.length.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset", + "type": "Object", + "tags": [], + "label": "'process.io.bytes_skipped.offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.bytes_skipped.offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded", + "type": "Object", + "tags": [], + "label": "'process.io.max_bytes_per_process_exceeded'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.max_bytes_per_process_exceeded.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text", + "type": "Object", + "tags": [], + "label": "'process.io.text'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.text.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured", + "type": "Object", + "tags": [], + "label": "'process.io.total_bytes_captured'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_captured.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped", + "type": "Object", + "tags": [], + "label": "'process.io.total_bytes_skipped'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.total_bytes_skipped.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type", + "type": "Object", + "tags": [], + "label": "'process.io.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.io.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name", + "type": "Object", + "tags": [], + "label": "'process.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args", + "type": "Object", + "tags": [], + "label": "'process.parent.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count", + "type": "Object", + "tags": [], + "label": "'process.parent.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line", + "type": "Object", + "tags": [], + "label": "'process.parent.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end", + "type": "Object", + "tags": [], + "label": "'process.parent.end'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.end.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id", + "type": "Object", + "tags": [], + "label": "'process.parent.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable", + "type": "Object", + "tags": [], + "label": "'process.parent.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code", + "type": "Object", + "tags": [], + "label": "'process.parent.exit_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.exit_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id", + "type": "Object", + "tags": [], + "label": "'process.parent.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name", + "type": "Object", + "tags": [], + "label": "'process.parent.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.parent.group_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.parent.group_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start", + "type": "Object", + "tags": [], + "label": "'process.parent.group_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.group_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive", + "type": "Object", + "tags": [], + "label": "'process.parent.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name", + "type": "Object", + "tags": [], + "label": "'process.parent.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid", + "type": "Object", + "tags": [], + "label": "'process.parent.pgid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pgid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid", + "type": "Object", + "tags": [], + "label": "'process.parent.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.parent.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.parent.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.parent.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.parent.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start", + "type": "Object", + "tags": [], + "label": "'process.parent.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.parent.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.parent.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id", + "type": "Object", + "tags": [], + "label": "'process.parent.thread.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name", + "type": "Object", + "tags": [], + "label": "'process.parent.thread.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.thread.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title", + "type": "Object", + "tags": [], + "label": "'process.parent.title'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.title.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty", + "type": "Object", + "tags": [], + "label": "'process.parent.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.parent.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.parent.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime", + "type": "Object", + "tags": [], + "label": "'process.parent.uptime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.uptime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id", + "type": "Object", + "tags": [], + "label": "'process.parent.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name", + "type": "Object", + "tags": [], + "label": "'process.parent.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory", + "type": "Object", + "tags": [], + "label": "'process.parent.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.parent.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture", + "type": "Object", + "tags": [], + "label": "'process.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company", + "type": "Object", + "tags": [], + "label": "'process.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description", + "type": "Object", + "tags": [], + "label": "'process.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version", + "type": "Object", + "tags": [], + "label": "'process.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash", + "type": "Object", + "tags": [], + "label": "'process.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'process.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash", + "type": "Object", + "tags": [], + "label": "'process.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product", + "type": "Object", + "tags": [], + "label": "'process.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid", + "type": "Object", + "tags": [], + "label": "'process.pgid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pgid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid", + "type": "Object", + "tags": [], + "label": "'process.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args", + "type": "Object", + "tags": [], + "label": "'process.previous.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count", + "type": "Object", + "tags": [], + "label": "'process.previous.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable", + "type": "Object", + "tags": [], + "label": "'process.previous.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.previous.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args", + "type": "Object", + "tags": [], + "label": "'process.session_leader.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count", + "type": "Object", + "tags": [], + "label": "'process.session_leader.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line", + "type": "Object", + "tags": [], + "label": "'process.session_leader.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable", + "type": "Object", + "tags": [], + "label": "'process.session_leader.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive", + "type": "Object", + "tags": [], + "label": "'process.session_leader.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.session_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.session_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.session_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.session_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.parent.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.session_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process", + "type": "Object", + "tags": [], + "label": "'process.session_leader.same_as_process'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.same_as_process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start", + "type": "Object", + "tags": [], + "label": "'process.session_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty", + "type": "Object", + "tags": [], + "label": "'process.session_leader.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.session_leader.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.session_leader.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory", + "type": "Object", + "tags": [], + "label": "'process.session_leader.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.session_leader.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start", + "type": "Object", + "tags": [], + "label": "'process.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id", + "type": "Object", + "tags": [], + "label": "'process.thread.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name", + "type": "Object", + "tags": [], + "label": "'process.thread.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.thread.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title", + "type": "Object", + "tags": [], + "label": "'process.title'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.title.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty", + "type": "Object", + "tags": [], + "label": "'process.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns", + "type": "Object", + "tags": [], + "label": "'process.tty.columns'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.columns.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows", + "type": "Object", + "tags": [], + "label": "'process.tty.rows'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.tty.rows.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime", + "type": "Object", + "tags": [], + "label": "'process.uptime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.uptime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id", + "type": "Object", + "tags": [], + "label": "'process.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name", + "type": "Object", + "tags": [], + "label": "'process.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory", + "type": "Object", + "tags": [], + "label": "'process.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.process.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes", + "type": "Object", + "tags": [], + "label": "'registry.data.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings", + "type": "Object", + "tags": [], + "label": "'registry.data.strings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.strings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type", + "type": "Object", + "tags": [], + "label": "'registry.data.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.data.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive", + "type": "Object", + "tags": [], + "label": "'registry.hive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.hive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key", + "type": "Object", + "tags": [], + "label": "'registry.key'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.key.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path", + "type": "Object", + "tags": [], + "label": "'registry.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value", + "type": "Object", + "tags": [], + "label": "'registry.value'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.registry.value.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash", + "type": "Object", + "tags": [], + "label": "'related.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts", + "type": "Object", + "tags": [], + "label": "'related.hosts'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.hosts.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip", + "type": "Object", + "tags": [], + "label": "'related.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user", + "type": "Object", + "tags": [], + "label": "'related.user'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.related.user.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author", + "type": "Object", + "tags": [], + "label": "'rule.author'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.author.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category", + "type": "Object", + "tags": [], + "label": "'rule.category'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.category.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description", + "type": "Object", + "tags": [], + "label": "'rule.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id", + "type": "Object", + "tags": [], + "label": "'rule.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license", + "type": "Object", + "tags": [], + "label": "'rule.license'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.license.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name", + "type": "Object", + "tags": [], + "label": "'rule.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference", + "type": "Object", + "tags": [], + "label": "'rule.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset", + "type": "Object", + "tags": [], + "label": "'rule.ruleset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.ruleset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid", + "type": "Object", + "tags": [], + "label": "'rule.uuid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.uuid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version", + "type": "Object", + "tags": [], + "label": "'rule.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.rule.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address", + "type": "Object", + "tags": [], + "label": "'server.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number", + "type": "Object", + "tags": [], + "label": "'server.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name", + "type": "Object", + "tags": [], + "label": "'server.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes", + "type": "Object", + "tags": [], + "label": "'server.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain", + "type": "Object", + "tags": [], + "label": "'server.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name", + "type": "Object", + "tags": [], + "label": "'server.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'server.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'server.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'server.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name", + "type": "Object", + "tags": [], + "label": "'server.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location", + "type": "Object", + "tags": [], + "label": "'server.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name", + "type": "Object", + "tags": [], + "label": "'server.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'server.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'server.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name", + "type": "Object", + "tags": [], + "label": "'server.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone", + "type": "Object", + "tags": [], + "label": "'server.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip", + "type": "Object", + "tags": [], + "label": "'server.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac", + "type": "Object", + "tags": [], + "label": "'server.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip", + "type": "Object", + "tags": [], + "label": "'server.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port", + "type": "Object", + "tags": [], + "label": "'server.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets", + "type": "Object", + "tags": [], + "label": "'server.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port", + "type": "Object", + "tags": [], + "label": "'server.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain", + "type": "Object", + "tags": [], + "label": "'server.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain", + "type": "Object", + "tags": [], + "label": "'server.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain", + "type": "Object", + "tags": [], + "label": "'server.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain", + "type": "Object", + "tags": [], + "label": "'server.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email", + "type": "Object", + "tags": [], + "label": "'server.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name", + "type": "Object", + "tags": [], + "label": "'server.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain", + "type": "Object", + "tags": [], + "label": "'server.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id", + "type": "Object", + "tags": [], + "label": "'server.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name", + "type": "Object", + "tags": [], + "label": "'server.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash", + "type": "Object", + "tags": [], + "label": "'server.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id", + "type": "Object", + "tags": [], + "label": "'server.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name", + "type": "Object", + "tags": [], + "label": "'server.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles", + "type": "Object", + "tags": [], + "label": "'server.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.server.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address", + "type": "Object", + "tags": [], + "label": "'service.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment", + "type": "Object", + "tags": [], + "label": "'service.environment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.environment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'service.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id", + "type": "Object", + "tags": [], + "label": "'service.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name", + "type": "Object", + "tags": [], + "label": "'service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name", + "type": "Object", + "tags": [], + "label": "'service.node.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role", + "type": "Object", + "tags": [], + "label": "'service.node.role'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.role.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles", + "type": "Object", + "tags": [], + "label": "'service.node.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.node.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address", + "type": "Object", + "tags": [], + "label": "'service.origin.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment", + "type": "Object", + "tags": [], + "label": "'service.origin.environment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.environment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'service.origin.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id", + "type": "Object", + "tags": [], + "label": "'service.origin.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name", + "type": "Object", + "tags": [], + "label": "'service.origin.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name", + "type": "Object", + "tags": [], + "label": "'service.origin.node.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role", + "type": "Object", + "tags": [], + "label": "'service.origin.node.role'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.role.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles", + "type": "Object", + "tags": [], + "label": "'service.origin.node.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.node.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state", + "type": "Object", + "tags": [], + "label": "'service.origin.state'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.state.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type", + "type": "Object", + "tags": [], + "label": "'service.origin.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version", + "type": "Object", + "tags": [], + "label": "'service.origin.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.origin.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state", + "type": "Object", + "tags": [], + "label": "'service.state'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.state.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address", + "type": "Object", + "tags": [], + "label": "'service.target.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment", + "type": "Object", + "tags": [], + "label": "'service.target.environment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.environment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'service.target.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id", + "type": "Object", + "tags": [], + "label": "'service.target.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name", + "type": "Object", + "tags": [], + "label": "'service.target.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name", + "type": "Object", + "tags": [], + "label": "'service.target.node.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role", + "type": "Object", + "tags": [], + "label": "'service.target.node.role'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.role.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles", + "type": "Object", + "tags": [], + "label": "'service.target.node.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.node.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state", + "type": "Object", + "tags": [], + "label": "'service.target.state'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.state.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type", + "type": "Object", + "tags": [], + "label": "'service.target.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version", + "type": "Object", + "tags": [], + "label": "'service.target.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.target.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type", + "type": "Object", + "tags": [], + "label": "'service.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version", + "type": "Object", + "tags": [], + "label": "'service.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.service.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address", + "type": "Object", + "tags": [], + "label": "'source.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number", + "type": "Object", + "tags": [], + "label": "'source.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name", + "type": "Object", + "tags": [], + "label": "'source.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes", + "type": "Object", + "tags": [], + "label": "'source.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain", + "type": "Object", + "tags": [], + "label": "'source.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name", + "type": "Object", + "tags": [], + "label": "'source.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'source.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'source.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'source.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name", + "type": "Object", + "tags": [], + "label": "'source.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location", + "type": "Object", + "tags": [], + "label": "'source.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name", + "type": "Object", + "tags": [], + "label": "'source.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'source.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'source.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name", + "type": "Object", + "tags": [], + "label": "'source.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone", + "type": "Object", + "tags": [], + "label": "'source.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip", + "type": "Object", + "tags": [], + "label": "'source.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac", + "type": "Object", + "tags": [], + "label": "'source.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip", + "type": "Object", + "tags": [], + "label": "'source.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port", + "type": "Object", + "tags": [], + "label": "'source.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets", + "type": "Object", + "tags": [], + "label": "'source.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port", + "type": "Object", + "tags": [], + "label": "'source.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain", + "type": "Object", + "tags": [], + "label": "'source.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain", + "type": "Object", + "tags": [], + "label": "'source.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain", + "type": "Object", + "tags": [], + "label": "'source.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain", + "type": "Object", + "tags": [], + "label": "'source.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email", + "type": "Object", + "tags": [], + "label": "'source.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name", + "type": "Object", + "tags": [], + "label": "'source.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain", + "type": "Object", + "tags": [], + "label": "'source.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id", + "type": "Object", + "tags": [], + "label": "'source.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name", + "type": "Object", + "tags": [], + "label": "'source.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash", + "type": "Object", + "tags": [], + "label": "'source.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id", + "type": "Object", + "tags": [], + "label": "'source.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name", + "type": "Object", + "tags": [], + "label": "'source.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles", + "type": "Object", + "tags": [], + "label": "'source.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.source.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id", + "type": "Object", + "tags": [], + "label": "'span.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.span.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags", + "type": "Object", + "tags": [], + "label": "tags", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments", + "type": "Object", + "tags": [], + "label": "'threat.enrichments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.confidence'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.confidence.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.email.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.email.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.accessed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.accessed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.attributes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.attributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.ctime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.ctime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.device'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.drive_letter'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.drive_letter.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.fork_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.fork_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.gid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.gid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.group'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.inode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.inode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.mode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.mtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.mtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.owner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.owner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.target_path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.target_path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.uid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.uid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.file.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.first_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.first_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.last_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.last_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.marking.tlp.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.marking.tlp.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.modified_at'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.modified_at.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.data.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.data.strings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.strings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.data.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.data.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.hive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.hive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.key'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.key.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.value'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.registry.value.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.scanner_stats'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.scanner_stats.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.sightings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.sightings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.fragment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.fragment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.password'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.password.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.query'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.query.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.scheme'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.scheme.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.username'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.url.username.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.indicator.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.atomic'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.atomic.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.field'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.field.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.index'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.index.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.occurred'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.occurred.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.enrichments.matched.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id", + "type": "Object", + "tags": [], + "label": "'threat.feed.dashboard_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.dashboard_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description", + "type": "Object", + "tags": [], + "label": "'threat.feed.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name", + "type": "Object", + "tags": [], + "label": "'threat.feed.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference", + "type": "Object", + "tags": [], + "label": "'threat.feed.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.feed.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework", + "type": "Object", + "tags": [], + "label": "'threat.framework'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.framework.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias", + "type": "Object", + "tags": [], + "label": "'threat.group.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id", + "type": "Object", + "tags": [], + "label": "'threat.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name", + "type": "Object", + "tags": [], + "label": "'threat.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference", + "type": "Object", + "tags": [], + "label": "'threat.group.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.group.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence", + "type": "Object", + "tags": [], + "label": "'threat.indicator.confidence'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.confidence.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description", + "type": "Object", + "tags": [], + "label": "'threat.indicator.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address", + "type": "Object", + "tags": [], + "label": "'threat.indicator.email.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.email.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.accessed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.accessed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.attributes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.attributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.ctime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.ctime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.device'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.drive_letter'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.drive_letter.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.fork_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.fork_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.gid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.gid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.group'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.inode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.inode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.mode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.mtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.mtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.owner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.owner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.target_path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.target_path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.uid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.uid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.file.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen", + "type": "Object", + "tags": [], + "label": "'threat.indicator.first_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.first_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip", + "type": "Object", + "tags": [], + "label": "'threat.indicator.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen", + "type": "Object", + "tags": [], + "label": "'threat.indicator.last_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.last_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp", + "type": "Object", + "tags": [], + "label": "'threat.indicator.marking.tlp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.marking.tlp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at", + "type": "Object", + "tags": [], + "label": "'threat.indicator.modified_at'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.modified_at.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port", + "type": "Object", + "tags": [], + "label": "'threat.indicator.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider", + "type": "Object", + "tags": [], + "label": "'threat.indicator.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference", + "type": "Object", + "tags": [], + "label": "'threat.indicator.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.data.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.data.strings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.strings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.data.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.data.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.hive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.hive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.key'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.key.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.value'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.registry.value.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats", + "type": "Object", + "tags": [], + "label": "'threat.indicator.scanner_stats'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.scanner_stats.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings", + "type": "Object", + "tags": [], + "label": "'threat.indicator.sightings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.sightings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.fragment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.fragment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.password'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.password.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.query'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.query.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.scheme'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.scheme.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.username'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.url.username.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.indicator.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias", + "type": "Object", + "tags": [], + "label": "'threat.software.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id", + "type": "Object", + "tags": [], + "label": "'threat.software.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name", + "type": "Object", + "tags": [], + "label": "'threat.software.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms", + "type": "Object", + "tags": [], + "label": "'threat.software.platforms'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.platforms.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference", + "type": "Object", + "tags": [], + "label": "'threat.software.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type", + "type": "Object", + "tags": [], + "label": "'threat.software.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.software.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id", + "type": "Object", + "tags": [], + "label": "'threat.tactic.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name", + "type": "Object", + "tags": [], + "label": "'threat.tactic.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference", + "type": "Object", + "tags": [], + "label": "'threat.tactic.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.tactic.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id", + "type": "Object", + "tags": [], + "label": "'threat.technique.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name", + "type": "Object", + "tags": [], + "label": "'threat.technique.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference", + "type": "Object", + "tags": [], + "label": "'threat.technique.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id", + "type": "Object", + "tags": [], + "label": "'threat.technique.subtechnique.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name", + "type": "Object", + "tags": [], + "label": "'threat.technique.subtechnique.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference", + "type": "Object", + "tags": [], + "label": "'threat.technique.subtechnique.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.technique.subtechnique.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version", + "type": "Object", + "tags": [], + "label": "'threat.threat.indicator.marking.tlp.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.threat.threat.indicator.marking.tlp.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher", + "type": "Object", + "tags": [], + "label": "'tls.cipher'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.cipher.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate", + "type": "Object", + "tags": [], + "label": "'tls.client.certificate'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain", + "type": "Object", + "tags": [], + "label": "'tls.client.certificate_chain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.certificate_chain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5", + "type": "Object", + "tags": [], + "label": "'tls.client.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1", + "type": "Object", + "tags": [], + "label": "'tls.client.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256", + "type": "Object", + "tags": [], + "label": "'tls.client.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer", + "type": "Object", + "tags": [], + "label": "'tls.client.issuer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.issuer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3", + "type": "Object", + "tags": [], + "label": "'tls.client.ja3'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.ja3.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after", + "type": "Object", + "tags": [], + "label": "'tls.client.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before", + "type": "Object", + "tags": [], + "label": "'tls.client.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name", + "type": "Object", + "tags": [], + "label": "'tls.client.server_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.server_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject", + "type": "Object", + "tags": [], + "label": "'tls.client.subject'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.subject.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers", + "type": "Object", + "tags": [], + "label": "'tls.client.supported_ciphers'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.supported_ciphers.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.client.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve", + "type": "Object", + "tags": [], + "label": "'tls.curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established", + "type": "Object", + "tags": [], + "label": "'tls.established'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.established.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol", + "type": "Object", + "tags": [], + "label": "'tls.next_protocol'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.next_protocol.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed", + "type": "Object", + "tags": [], + "label": "'tls.resumed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.resumed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate", + "type": "Object", + "tags": [], + "label": "'tls.server.certificate'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain", + "type": "Object", + "tags": [], + "label": "'tls.server.certificate_chain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.certificate_chain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5", + "type": "Object", + "tags": [], + "label": "'tls.server.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1", + "type": "Object", + "tags": [], + "label": "'tls.server.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256", + "type": "Object", + "tags": [], + "label": "'tls.server.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer", + "type": "Object", + "tags": [], + "label": "'tls.server.issuer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.issuer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s", + "type": "Object", + "tags": [], + "label": "'tls.server.ja3s'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.ja3s.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after", + "type": "Object", + "tags": [], + "label": "'tls.server.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before", + "type": "Object", + "tags": [], + "label": "'tls.server.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject", + "type": "Object", + "tags": [], + "label": "'tls.server.subject'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.subject.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.server.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version", + "type": "Object", + "tags": [], + "label": "'tls.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol", + "type": "Object", + "tags": [], + "label": "'tls.version_protocol'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.tls.version_protocol.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id", + "type": "Object", + "tags": [], + "label": "'trace.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.trace.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id", + "type": "Object", + "tags": [], + "label": "'transaction.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.transaction.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain", + "type": "Object", + "tags": [], + "label": "'url.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension", + "type": "Object", + "tags": [], + "label": "'url.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment", + "type": "Object", + "tags": [], + "label": "'url.fragment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.fragment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full", + "type": "Object", + "tags": [], + "label": "'url.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original", + "type": "Object", + "tags": [], + "label": "'url.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password", + "type": "Object", + "tags": [], + "label": "'url.password'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.password.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path", + "type": "Object", + "tags": [], + "label": "'url.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port", + "type": "Object", + "tags": [], + "label": "'url.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query", + "type": "Object", + "tags": [], + "label": "'url.query'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.query.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain", + "type": "Object", + "tags": [], + "label": "'url.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme", + "type": "Object", + "tags": [], + "label": "'url.scheme'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.scheme.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain", + "type": "Object", + "tags": [], + "label": "'url.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain", + "type": "Object", + "tags": [], + "label": "'url.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username", + "type": "Object", + "tags": [], + "label": "'url.username'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.url.username.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain", + "type": "Object", + "tags": [], + "label": "'user.changes.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email", + "type": "Object", + "tags": [], + "label": "'user.changes.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name", + "type": "Object", + "tags": [], + "label": "'user.changes.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain", + "type": "Object", + "tags": [], + "label": "'user.changes.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id", + "type": "Object", + "tags": [], + "label": "'user.changes.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name", + "type": "Object", + "tags": [], + "label": "'user.changes.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash", + "type": "Object", + "tags": [], + "label": "'user.changes.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id", + "type": "Object", + "tags": [], + "label": "'user.changes.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name", + "type": "Object", + "tags": [], + "label": "'user.changes.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles", + "type": "Object", + "tags": [], + "label": "'user.changes.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.changes.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain", + "type": "Object", + "tags": [], + "label": "'user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain", + "type": "Object", + "tags": [], + "label": "'user.effective.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email", + "type": "Object", + "tags": [], + "label": "'user.effective.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name", + "type": "Object", + "tags": [], + "label": "'user.effective.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain", + "type": "Object", + "tags": [], + "label": "'user.effective.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id", + "type": "Object", + "tags": [], + "label": "'user.effective.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name", + "type": "Object", + "tags": [], + "label": "'user.effective.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash", + "type": "Object", + "tags": [], + "label": "'user.effective.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id", + "type": "Object", + "tags": [], + "label": "'user.effective.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name", + "type": "Object", + "tags": [], + "label": "'user.effective.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles", + "type": "Object", + "tags": [], + "label": "'user.effective.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.effective.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email", + "type": "Object", + "tags": [], + "label": "'user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name", + "type": "Object", + "tags": [], + "label": "'user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain", + "type": "Object", + "tags": [], + "label": "'user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id", + "type": "Object", + "tags": [], + "label": "'user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name", + "type": "Object", + "tags": [], + "label": "'user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash", + "type": "Object", + "tags": [], + "label": "'user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id", + "type": "Object", + "tags": [], + "label": "'user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name", + "type": "Object", + "tags": [], + "label": "'user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level", + "type": "Object", + "tags": [], + "label": "'user.risk.calculated_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score", + "type": "Object", + "tags": [], + "label": "'user.risk.calculated_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm", + "type": "Object", + "tags": [], + "label": "'user.risk.calculated_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.calculated_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level", + "type": "Object", + "tags": [], + "label": "'user.risk.static_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score", + "type": "Object", + "tags": [], + "label": "'user.risk.static_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm", + "type": "Object", + "tags": [], + "label": "'user.risk.static_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.risk.static_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles", + "type": "Object", + "tags": [], + "label": "'user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain", + "type": "Object", + "tags": [], + "label": "'user.target.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email", + "type": "Object", + "tags": [], + "label": "'user.target.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name", + "type": "Object", + "tags": [], + "label": "'user.target.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain", + "type": "Object", + "tags": [], + "label": "'user.target.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id", + "type": "Object", + "tags": [], + "label": "'user.target.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name", + "type": "Object", + "tags": [], + "label": "'user.target.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash", + "type": "Object", + "tags": [], + "label": "'user.target.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id", + "type": "Object", + "tags": [], + "label": "'user.target.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name", + "type": "Object", + "tags": [], + "label": "'user.target.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles", + "type": "Object", + "tags": [], + "label": "'user.target.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user.target.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name", + "type": "Object", + "tags": [], + "label": "'user_agent.device.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.device.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name", + "type": "Object", + "tags": [], + "label": "'user_agent.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original", + "type": "Object", + "tags": [], + "label": "'user_agent.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family", + "type": "Object", + "tags": [], + "label": "'user_agent.os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full", + "type": "Object", + "tags": [], + "label": "'user_agent.os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel", + "type": "Object", + "tags": [], + "label": "'user_agent.os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name", + "type": "Object", + "tags": [], + "label": "'user_agent.os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform", + "type": "Object", + "tags": [], + "label": "'user_agent.os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type", + "type": "Object", + "tags": [], + "label": "'user_agent.os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version", + "type": "Object", + "tags": [], + "label": "'user_agent.os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version", + "type": "Object", + "tags": [], + "label": "'user_agent.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.user_agent.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category", + "type": "Object", + "tags": [], + "label": "'vulnerability.category'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.category.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification", + "type": "Object", + "tags": [], + "label": "'vulnerability.classification'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.classification.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description", + "type": "Object", + "tags": [], + "label": "'vulnerability.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration", + "type": "Object", + "tags": [], + "label": "'vulnerability.enumeration'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.enumeration.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id", + "type": "Object", + "tags": [], + "label": "'vulnerability.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference", + "type": "Object", + "tags": [], + "label": "'vulnerability.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id", + "type": "Object", + "tags": [], + "label": "'vulnerability.report_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.report_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor", + "type": "Object", + "tags": [], + "label": "'vulnerability.scanner.vendor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.scanner.vendor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.base'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.base.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.environmental'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.environmental.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.temporal'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.temporal.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.score.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity", + "type": "Object", + "tags": [], + "label": "'vulnerability.severity'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsFlat.vulnerability.severity.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_flat.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } ], - "path": "packages/kbn-ecs/src/ecs/event.ts", - "deprecated": false, - "trackAdoption": false, "initialIsOpen": false }, { "parentPluginId": "@kbn/ecs", - "id": "def-common.EcsEventType", - "type": "Type", + "id": "def-common.EcsNested", + "type": "Object", "tags": [], - "label": "EcsEventType", + "label": "EcsNested", "description": [], - "signature": [ - "\"start\" | \"error\" | \"connection\" | \"user\" | \"info\" | \"group\" | \"end\" | \"admin\" | \"protocol\" | \"access\" | \"allowed\" | \"change\" | \"creation\" | \"deletion\" | \"denied\" | \"installation\"" - ], - "path": "packages/kbn-ecs/src/ecs/event.ts", + "path": "packages/kbn-ecs/generated/ecs_nested.ts", "deprecated": false, "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent", + "type": "Object", + "tags": [], + "label": "agent", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original", + "type": "Object", + "tags": [], + "label": "'agent.build.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.build.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'agent.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id", + "type": "Object", + "tags": [], + "label": "'agent.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name", + "type": "Object", + "tags": [], + "label": "'agent.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type", + "type": "Object", + "tags": [], + "label": "'agent.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version", + "type": "Object", + "tags": [], + "label": "'agent.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.fields.agent.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.footnote", + "type": "string", + "tags": [], + "label": "footnote", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.agent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as", + "type": "Object", + "tags": [], + "label": "as", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number", + "type": "Object", + "tags": [], + "label": "'as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name", + "type": "Object", + "tags": [], + "label": "'as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.fields.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.as.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base", + "type": "Object", + "tags": [], + "label": "base", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp", + "type": "Object", + "tags": [], + "label": "'@timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.required", + "type": "boolean", + "tags": [], + "label": "required", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels", + "type": "Object", + "tags": [], + "label": "labels", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.object_type", + "type": "string", + "tags": [], + "label": "object_type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.labels.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message", + "type": "Object", + "tags": [], + "label": "message", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.message.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags", + "type": "Object", + "tags": [], + "label": "tags", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.fields.tags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.root", + "type": "boolean", + "tags": [], + "label": "root", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.base.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client", + "type": "Object", + "tags": [], + "label": "client", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address", + "type": "Object", + "tags": [], + "label": "'client.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number", + "type": "Object", + "tags": [], + "label": "'client.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name", + "type": "Object", + "tags": [], + "label": "'client.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes", + "type": "Object", + "tags": [], + "label": "'client.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain", + "type": "Object", + "tags": [], + "label": "'client.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name", + "type": "Object", + "tags": [], + "label": "'client.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'client.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'client.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'client.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name", + "type": "Object", + "tags": [], + "label": "'client.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location", + "type": "Object", + "tags": [], + "label": "'client.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name", + "type": "Object", + "tags": [], + "label": "'client.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'client.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'client.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name", + "type": "Object", + "tags": [], + "label": "'client.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone", + "type": "Object", + "tags": [], + "label": "'client.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip", + "type": "Object", + "tags": [], + "label": "'client.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac", + "type": "Object", + "tags": [], + "label": "'client.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip", + "type": "Object", + "tags": [], + "label": "'client.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port", + "type": "Object", + "tags": [], + "label": "'client.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets", + "type": "Object", + "tags": [], + "label": "'client.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port", + "type": "Object", + "tags": [], + "label": "'client.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain", + "type": "Object", + "tags": [], + "label": "'client.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain", + "type": "Object", + "tags": [], + "label": "'client.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain", + "type": "Object", + "tags": [], + "label": "'client.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain", + "type": "Object", + "tags": [], + "label": "'client.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email", + "type": "Object", + "tags": [], + "label": "'client.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name", + "type": "Object", + "tags": [], + "label": "'client.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain", + "type": "Object", + "tags": [], + "label": "'client.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id", + "type": "Object", + "tags": [], + "label": "'client.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name", + "type": "Object", + "tags": [], + "label": "'client.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash", + "type": "Object", + "tags": [], + "label": "'client.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id", + "type": "Object", + "tags": [], + "label": "'client.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name", + "type": "Object", + "tags": [], + "label": "'client.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles", + "type": "Object", + "tags": [], + "label": "'client.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.fields.client.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.client.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud", + "type": "Object", + "tags": [], + "label": "cloud", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id", + "type": "Object", + "tags": [], + "label": "'cloud.account.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name", + "type": "Object", + "tags": [], + "label": "'cloud.account.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.account.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone", + "type": "Object", + "tags": [], + "label": "'cloud.availability_zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.availability_zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id", + "type": "Object", + "tags": [], + "label": "'cloud.instance.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name", + "type": "Object", + "tags": [], + "label": "'cloud.instance.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.instance.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type", + "type": "Object", + "tags": [], + "label": "'cloud.machine.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.machine.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id", + "type": "Object", + "tags": [], + "label": "'cloud.origin.account.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.account.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.account.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone", + "type": "Object", + "tags": [], + "label": "'cloud.origin.availability_zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.availability_zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id", + "type": "Object", + "tags": [], + "label": "'cloud.origin.instance.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.instance.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.instance.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type", + "type": "Object", + "tags": [], + "label": "'cloud.origin.machine.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.machine.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id", + "type": "Object", + "tags": [], + "label": "'cloud.origin.project.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.project.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.project.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider", + "type": "Object", + "tags": [], + "label": "'cloud.origin.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region", + "type": "Object", + "tags": [], + "label": "'cloud.origin.region'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.region.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name", + "type": "Object", + "tags": [], + "label": "'cloud.origin.service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.origin.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id", + "type": "Object", + "tags": [], + "label": "'cloud.project.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name", + "type": "Object", + "tags": [], + "label": "'cloud.project.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.project.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider", + "type": "Object", + "tags": [], + "label": "'cloud.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region", + "type": "Object", + "tags": [], + "label": "'cloud.region'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.region.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name", + "type": "Object", + "tags": [], + "label": "'cloud.service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id", + "type": "Object", + "tags": [], + "label": "'cloud.target.account.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.account.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.account.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone", + "type": "Object", + "tags": [], + "label": "'cloud.target.availability_zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.availability_zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id", + "type": "Object", + "tags": [], + "label": "'cloud.target.instance.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.instance.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.instance.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type", + "type": "Object", + "tags": [], + "label": "'cloud.target.machine.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.machine.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id", + "type": "Object", + "tags": [], + "label": "'cloud.target.project.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.project.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.project.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider", + "type": "Object", + "tags": [], + "label": "'cloud.target.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region", + "type": "Object", + "tags": [], + "label": "'cloud.target.region'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.region.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name", + "type": "Object", + "tags": [], + "label": "'cloud.target.service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.fields.cloud.target.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.footnote", + "type": "string", + "tags": [], + "label": "footnote", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; beta: string; full: string; short_override: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ beta: string; full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.cloud.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature", + "type": "Object", + "tags": [], + "label": "code_signature", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status", + "type": "Object", + "tags": [], + "label": "'code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.fields.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.code_signature.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container", + "type": "Object", + "tags": [], + "label": "container", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage", + "type": "Object", + "tags": [], + "label": "'container.cpu.usage'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.scaling_factor", + "type": "number", + "tags": [], + "label": "scaling_factor", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.cpu.usage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes", + "type": "Object", + "tags": [], + "label": "'container.disk.read.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.read.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes", + "type": "Object", + "tags": [], + "label": "'container.disk.write.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.disk.write.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id", + "type": "Object", + "tags": [], + "label": "'container.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all", + "type": "Object", + "tags": [], + "label": "'container.image.hash.all'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.hash.all.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name", + "type": "Object", + "tags": [], + "label": "'container.image.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag", + "type": "Object", + "tags": [], + "label": "'container.image.tag'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.image.tag.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels", + "type": "Object", + "tags": [], + "label": "'container.labels'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.object_type", + "type": "string", + "tags": [], + "label": "object_type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.labels.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage", + "type": "Object", + "tags": [], + "label": "'container.memory.usage'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.scaling_factor", + "type": "number", + "tags": [], + "label": "scaling_factor", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.memory.usage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name", + "type": "Object", + "tags": [], + "label": "'container.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes", + "type": "Object", + "tags": [], + "label": "'container.network.egress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.egress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes", + "type": "Object", + "tags": [], + "label": "'container.network.ingress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.network.ingress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime", + "type": "Object", + "tags": [], + "label": "'container.runtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.fields.container.runtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.container.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream", + "type": "Object", + "tags": [], + "label": "data_stream", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset", + "type": "Object", + "tags": [], + "label": "'data_stream.dataset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.dataset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace", + "type": "Object", + "tags": [], + "label": "'data_stream.namespace'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.namespace.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type", + "type": "Object", + "tags": [], + "label": "'data_stream.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.fields.data_stream.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.data_stream.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination", + "type": "Object", + "tags": [], + "label": "destination", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address", + "type": "Object", + "tags": [], + "label": "'destination.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number", + "type": "Object", + "tags": [], + "label": "'destination.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name", + "type": "Object", + "tags": [], + "label": "'destination.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes", + "type": "Object", + "tags": [], + "label": "'destination.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain", + "type": "Object", + "tags": [], + "label": "'destination.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location", + "type": "Object", + "tags": [], + "label": "'destination.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name", + "type": "Object", + "tags": [], + "label": "'destination.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'destination.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name", + "type": "Object", + "tags": [], + "label": "'destination.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone", + "type": "Object", + "tags": [], + "label": "'destination.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip", + "type": "Object", + "tags": [], + "label": "'destination.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac", + "type": "Object", + "tags": [], + "label": "'destination.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip", + "type": "Object", + "tags": [], + "label": "'destination.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port", + "type": "Object", + "tags": [], + "label": "'destination.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets", + "type": "Object", + "tags": [], + "label": "'destination.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port", + "type": "Object", + "tags": [], + "label": "'destination.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain", + "type": "Object", + "tags": [], + "label": "'destination.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain", + "type": "Object", + "tags": [], + "label": "'destination.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain", + "type": "Object", + "tags": [], + "label": "'destination.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain", + "type": "Object", + "tags": [], + "label": "'destination.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email", + "type": "Object", + "tags": [], + "label": "'destination.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name", + "type": "Object", + "tags": [], + "label": "'destination.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain", + "type": "Object", + "tags": [], + "label": "'destination.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id", + "type": "Object", + "tags": [], + "label": "'destination.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name", + "type": "Object", + "tags": [], + "label": "'destination.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash", + "type": "Object", + "tags": [], + "label": "'destination.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id", + "type": "Object", + "tags": [], + "label": "'destination.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name", + "type": "Object", + "tags": [], + "label": "'destination.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles", + "type": "Object", + "tags": [], + "label": "'destination.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.fields.destination.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.destination.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device", + "type": "Object", + "tags": [], + "label": "device", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id", + "type": "Object", + "tags": [], + "label": "'device.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer", + "type": "Object", + "tags": [], + "label": "'device.manufacturer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.manufacturer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier", + "type": "Object", + "tags": [], + "label": "'device.model.identifier'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.identifier.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name", + "type": "Object", + "tags": [], + "label": "'device.model.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.fields.device.model.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll", + "type": "Object", + "tags": [], + "label": "dll", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'dll.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5", + "type": "Object", + "tags": [], + "label": "'dll.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512", + "type": "Object", + "tags": [], + "label": "'dll.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'dll.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'dll.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name", + "type": "Object", + "tags": [], + "label": "'dll.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path", + "type": "Object", + "tags": [], + "label": "'dll.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture", + "type": "Object", + "tags": [], + "label": "'dll.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company", + "type": "Object", + "tags": [], + "label": "'dll.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description", + "type": "Object", + "tags": [], + "label": "'dll.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version", + "type": "Object", + "tags": [], + "label": "'dll.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash", + "type": "Object", + "tags": [], + "label": "'dll.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'dll.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash", + "type": "Object", + "tags": [], + "label": "'dll.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product", + "type": "Object", + "tags": [], + "label": "'dll.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.fields.dll.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dll.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns", + "type": "Object", + "tags": [], + "label": "dns", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers", + "type": "Object", + "tags": [], + "label": "'dns.answers'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class", + "type": "Object", + "tags": [], + "label": "'dns.answers.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data", + "type": "Object", + "tags": [], + "label": "'dns.answers.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name", + "type": "Object", + "tags": [], + "label": "'dns.answers.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl", + "type": "Object", + "tags": [], + "label": "'dns.answers.ttl'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.ttl.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type", + "type": "Object", + "tags": [], + "label": "'dns.answers.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.answers.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags", + "type": "Object", + "tags": [], + "label": "'dns.header_flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.header_flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id", + "type": "Object", + "tags": [], + "label": "'dns.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code", + "type": "Object", + "tags": [], + "label": "'dns.op_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.op_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class", + "type": "Object", + "tags": [], + "label": "'dns.question.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name", + "type": "Object", + "tags": [], + "label": "'dns.question.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain", + "type": "Object", + "tags": [], + "label": "'dns.question.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain", + "type": "Object", + "tags": [], + "label": "'dns.question.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain", + "type": "Object", + "tags": [], + "label": "'dns.question.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type", + "type": "Object", + "tags": [], + "label": "'dns.question.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.question.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip", + "type": "Object", + "tags": [], + "label": "'dns.resolved_ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.resolved_ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code", + "type": "Object", + "tags": [], + "label": "'dns.response_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.response_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type", + "type": "Object", + "tags": [], + "label": "'dns.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.fields.dns.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.dns.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs", + "type": "Object", + "tags": [], + "label": "ecs", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version", + "type": "Object", + "tags": [], + "label": "'ecs.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.required", + "type": "boolean", + "tags": [], + "label": "required", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.fields.ecs.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.ecs.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf", + "type": "Object", + "tags": [], + "label": "elf", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture", + "type": "Object", + "tags": [], + "label": "'elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports", + "type": "Object", + "tags": [], + "label": "'elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class", + "type": "Object", + "tags": [], + "label": "'elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data", + "type": "Object", + "tags": [], + "label": "'elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type", + "type": "Object", + "tags": [], + "label": "'elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version", + "type": "Object", + "tags": [], + "label": "'elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports", + "type": "Object", + "tags": [], + "label": "'elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections", + "type": "Object", + "tags": [], + "label": "'elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments", + "type": "Object", + "tags": [], + "label": "'elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.fields.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; beta: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.elf.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email", + "type": "Object", + "tags": [], + "label": "email", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments", + "type": "Object", + "tags": [], + "label": "'email.attachments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size", + "type": "Object", + "tags": [], + "label": "'email.attachments.file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.attachments.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address", + "type": "Object", + "tags": [], + "label": "'email.bcc.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.bcc.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address", + "type": "Object", + "tags": [], + "label": "'email.cc.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.cc.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type", + "type": "Object", + "tags": [], + "label": "'email.content_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.content_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp", + "type": "Object", + "tags": [], + "label": "'email.delivery_timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.delivery_timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction", + "type": "Object", + "tags": [], + "label": "'email.direction'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.direction.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address", + "type": "Object", + "tags": [], + "label": "'email.from.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.from.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id", + "type": "Object", + "tags": [], + "label": "'email.local_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.local_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id", + "type": "Object", + "tags": [], + "label": "'email.message_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.message_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp", + "type": "Object", + "tags": [], + "label": "'email.origination_timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.origination_timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address", + "type": "Object", + "tags": [], + "label": "'email.reply_to.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.reply_to.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address", + "type": "Object", + "tags": [], + "label": "'email.sender.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.sender.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject", + "type": "Object", + "tags": [], + "label": "'email.subject'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.subject.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address", + "type": "Object", + "tags": [], + "label": "'email.to.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.to.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer", + "type": "Object", + "tags": [], + "label": "'email.x_mailer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.fields.email.x_mailer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error", + "type": "Object", + "tags": [], + "label": "error", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code", + "type": "Object", + "tags": [], + "label": "'error.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id", + "type": "Object", + "tags": [], + "label": "'error.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message", + "type": "Object", + "tags": [], + "label": "'error.message'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.message.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace", + "type": "Object", + "tags": [], + "label": "'error.stack_trace'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.stack_trace.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type", + "type": "Object", + "tags": [], + "label": "'error.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.fields.error.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.error.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event", + "type": "Object", + "tags": [], + "label": "event", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action", + "type": "Object", + "tags": [], + "label": "'event.action'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.action.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status", + "type": "Object", + "tags": [], + "label": "'event.agent_id_status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.agent_id_status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category", + "type": "Object", + "tags": [], + "label": "'event.category'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; expected_event_types: string[]; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.category.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code", + "type": "Object", + "tags": [], + "label": "'event.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created", + "type": "Object", + "tags": [], + "label": "'event.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset", + "type": "Object", + "tags": [], + "label": "'event.dataset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.dataset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration", + "type": "Object", + "tags": [], + "label": "'event.duration'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.input_format", + "type": "string", + "tags": [], + "label": "input_format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.output_format", + "type": "string", + "tags": [], + "label": "output_format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.output_precision", + "type": "number", + "tags": [], + "label": "output_precision", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.duration.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end", + "type": "Object", + "tags": [], + "label": "'event.end'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.end.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash", + "type": "Object", + "tags": [], + "label": "'event.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id", + "type": "Object", + "tags": [], + "label": "'event.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested", + "type": "Object", + "tags": [], + "label": "'event.ingested'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.ingested.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind", + "type": "Object", + "tags": [], + "label": "'event.kind'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.kind.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module", + "type": "Object", + "tags": [], + "label": "'event.module'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.module.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original", + "type": "Object", + "tags": [], + "label": "'event.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome", + "type": "Object", + "tags": [], + "label": "'event.outcome'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.outcome.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider", + "type": "Object", + "tags": [], + "label": "'event.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason", + "type": "Object", + "tags": [], + "label": "'event.reason'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reason.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference", + "type": "Object", + "tags": [], + "label": "'event.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score", + "type": "Object", + "tags": [], + "label": "'event.risk_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm", + "type": "Object", + "tags": [], + "label": "'event.risk_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.risk_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence", + "type": "Object", + "tags": [], + "label": "'event.sequence'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.sequence.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity", + "type": "Object", + "tags": [], + "label": "'event.severity'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.severity.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start", + "type": "Object", + "tags": [], + "label": "'event.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone", + "type": "Object", + "tags": [], + "label": "'event.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type", + "type": "Object", + "tags": [], + "label": "'event.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.allowed_values", + "type": "Array", + "tags": [], + "label": "allowed_values", + "description": [], + "signature": [ + "{ description: string; name: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url", + "type": "Object", + "tags": [], + "label": "'event.url'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.fields.event.url.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.event.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas", + "type": "Object", + "tags": [], + "label": "faas", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart", + "type": "Object", + "tags": [], + "label": "'faas.coldstart'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.coldstart.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution", + "type": "Object", + "tags": [], + "label": "'faas.execution'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.execution.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id", + "type": "Object", + "tags": [], + "label": "'faas.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name", + "type": "Object", + "tags": [], + "label": "'faas.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger", + "type": "Object", + "tags": [], + "label": "'faas.trigger'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id", + "type": "Object", + "tags": [], + "label": "'faas.trigger.request_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.request_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type", + "type": "Object", + "tags": [], + "label": "'faas.trigger.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.trigger.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version", + "type": "Object", + "tags": [], + "label": "'faas.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.fields.faas.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.faas.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file", + "type": "Object", + "tags": [], + "label": "file", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed", + "type": "Object", + "tags": [], + "label": "'file.accessed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.accessed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes", + "type": "Object", + "tags": [], + "label": "'file.attributes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.attributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'file.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'file.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'file.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status", + "type": "Object", + "tags": [], + "label": "'file.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'file.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'file.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'file.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'file.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'file.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created", + "type": "Object", + "tags": [], + "label": "'file.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime", + "type": "Object", + "tags": [], + "label": "'file.ctime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.ctime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device", + "type": "Object", + "tags": [], + "label": "'file.device'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory", + "type": "Object", + "tags": [], + "label": "'file.directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter", + "type": "Object", + "tags": [], + "label": "'file.drive_letter'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.drive_letter.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture", + "type": "Object", + "tags": [], + "label": "'file.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'file.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'file.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'file.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports", + "type": "Object", + "tags": [], + "label": "'file.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'file.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class", + "type": "Object", + "tags": [], + "label": "'file.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data", + "type": "Object", + "tags": [], + "label": "'file.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'file.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'file.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'file.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type", + "type": "Object", + "tags": [], + "label": "'file.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version", + "type": "Object", + "tags": [], + "label": "'file.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports", + "type": "Object", + "tags": [], + "label": "'file.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections", + "type": "Object", + "tags": [], + "label": "'file.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'file.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments", + "type": "Object", + "tags": [], + "label": "'file.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'file.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'file.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'file.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'file.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension", + "type": "Object", + "tags": [], + "label": "'file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name", + "type": "Object", + "tags": [], + "label": "'file.fork_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.fork_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid", + "type": "Object", + "tags": [], + "label": "'file.gid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.gid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group", + "type": "Object", + "tags": [], + "label": "'file.group'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode", + "type": "Object", + "tags": [], + "label": "'file.inode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.inode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type", + "type": "Object", + "tags": [], + "label": "'file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode", + "type": "Object", + "tags": [], + "label": "'file.mode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime", + "type": "Object", + "tags": [], + "label": "'file.mtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.mtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name", + "type": "Object", + "tags": [], + "label": "'file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner", + "type": "Object", + "tags": [], + "label": "'file.owner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.owner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path", + "type": "Object", + "tags": [], + "label": "'file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture", + "type": "Object", + "tags": [], + "label": "'file.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company", + "type": "Object", + "tags": [], + "label": "'file.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description", + "type": "Object", + "tags": [], + "label": "'file.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version", + "type": "Object", + "tags": [], + "label": "'file.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash", + "type": "Object", + "tags": [], + "label": "'file.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'file.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash", + "type": "Object", + "tags": [], + "label": "'file.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product", + "type": "Object", + "tags": [], + "label": "'file.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size", + "type": "Object", + "tags": [], + "label": "'file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path", + "type": "Object", + "tags": [], + "label": "'file.target_path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.target_path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type", + "type": "Object", + "tags": [], + "label": "'file.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid", + "type": "Object", + "tags": [], + "label": "'file.uid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.uid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'file.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'file.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after", + "type": "Object", + "tags": [], + "label": "'file.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before", + "type": "Object", + "tags": [], + "label": "'file.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'file.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'file.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'file.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'file.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number", + "type": "Object", + "tags": [], + "label": "'file.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.fields.file.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "({ full: string; schema_name: string; short: string; } | { beta: string; full: string; schema_name: string; short: string; })[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.file.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo", + "type": "Object", + "tags": [], + "label": "geo", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name", + "type": "Object", + "tags": [], + "label": "'geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name", + "type": "Object", + "tags": [], + "label": "'geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location", + "type": "Object", + "tags": [], + "label": "'geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name", + "type": "Object", + "tags": [], + "label": "'geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name", + "type": "Object", + "tags": [], + "label": "'geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone", + "type": "Object", + "tags": [], + "label": "'geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.fields.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.geo.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group", + "type": "Object", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain", + "type": "Object", + "tags": [], + "label": "'group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id", + "type": "Object", + "tags": [], + "label": "'group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name", + "type": "Object", + "tags": [], + "label": "'group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.fields.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "({ as: string; at: string; full: string; } | { as: string; at: string; full: string; short_override: string; } | { as: string; at: string; full: string; normalize: string[]; short_override: string; } | { as: string; at: string; beta: string; full: string; normalize: string[]; short_override: string; })[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash", + "type": "Object", + "tags": [], + "label": "hash", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5", + "type": "Object", + "tags": [], + "label": "'hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1", + "type": "Object", + "tags": [], + "label": "'hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256", + "type": "Object", + "tags": [], + "label": "'hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384", + "type": "Object", + "tags": [], + "label": "'hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512", + "type": "Object", + "tags": [], + "label": "'hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.fields.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host", + "type": "Object", + "tags": [], + "label": "host", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture", + "type": "Object", + "tags": [], + "label": "'host.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id", + "type": "Object", + "tags": [], + "label": "'host.boot.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.boot.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage", + "type": "Object", + "tags": [], + "label": "'host.cpu.usage'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.scaling_factor", + "type": "number", + "tags": [], + "label": "scaling_factor", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.cpu.usage.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes", + "type": "Object", + "tags": [], + "label": "'host.disk.read.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.read.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes", + "type": "Object", + "tags": [], + "label": "'host.disk.write.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.disk.write.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain", + "type": "Object", + "tags": [], + "label": "'host.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name", + "type": "Object", + "tags": [], + "label": "'host.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'host.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'host.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'host.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name", + "type": "Object", + "tags": [], + "label": "'host.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location", + "type": "Object", + "tags": [], + "label": "'host.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name", + "type": "Object", + "tags": [], + "label": "'host.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'host.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'host.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name", + "type": "Object", + "tags": [], + "label": "'host.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone", + "type": "Object", + "tags": [], + "label": "'host.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname", + "type": "Object", + "tags": [], + "label": "'host.hostname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.hostname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id", + "type": "Object", + "tags": [], + "label": "'host.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip", + "type": "Object", + "tags": [], + "label": "'host.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac", + "type": "Object", + "tags": [], + "label": "'host.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name", + "type": "Object", + "tags": [], + "label": "'host.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes", + "type": "Object", + "tags": [], + "label": "'host.network.egress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets", + "type": "Object", + "tags": [], + "label": "'host.network.egress.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.egress.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes", + "type": "Object", + "tags": [], + "label": "'host.network.ingress.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets", + "type": "Object", + "tags": [], + "label": "'host.network.ingress.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.network.ingress.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family", + "type": "Object", + "tags": [], + "label": "'host.os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full", + "type": "Object", + "tags": [], + "label": "'host.os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel", + "type": "Object", + "tags": [], + "label": "'host.os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name", + "type": "Object", + "tags": [], + "label": "'host.os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform", + "type": "Object", + "tags": [], + "label": "'host.os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type", + "type": "Object", + "tags": [], + "label": "'host.os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version", + "type": "Object", + "tags": [], + "label": "'host.os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino", + "type": "Object", + "tags": [], + "label": "'host.pid_ns_ino'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.pid_ns_ino.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level", + "type": "Object", + "tags": [], + "label": "'host.risk.calculated_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score", + "type": "Object", + "tags": [], + "label": "'host.risk.calculated_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm", + "type": "Object", + "tags": [], + "label": "'host.risk.calculated_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.calculated_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level", + "type": "Object", + "tags": [], + "label": "'host.risk.static_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score", + "type": "Object", + "tags": [], + "label": "'host.risk.static_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm", + "type": "Object", + "tags": [], + "label": "'host.risk.static_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.risk.static_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type", + "type": "Object", + "tags": [], + "label": "'host.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime", + "type": "Object", + "tags": [], + "label": "'host.uptime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.fields.host.uptime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.host.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http", + "type": "Object", + "tags": [], + "label": "http", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes", + "type": "Object", + "tags": [], + "label": "'http.request.body.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content", + "type": "Object", + "tags": [], + "label": "'http.request.body.content'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.body.content.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes", + "type": "Object", + "tags": [], + "label": "'http.request.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id", + "type": "Object", + "tags": [], + "label": "'http.request.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method", + "type": "Object", + "tags": [], + "label": "'http.request.method'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.method.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type", + "type": "Object", + "tags": [], + "label": "'http.request.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer", + "type": "Object", + "tags": [], + "label": "'http.request.referrer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.request.referrer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes", + "type": "Object", + "tags": [], + "label": "'http.response.body.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content", + "type": "Object", + "tags": [], + "label": "'http.response.body.content'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.body.content.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes", + "type": "Object", + "tags": [], + "label": "'http.response.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type", + "type": "Object", + "tags": [], + "label": "'http.response.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code", + "type": "Object", + "tags": [], + "label": "'http.response.status_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.response.status_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version", + "type": "Object", + "tags": [], + "label": "'http.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.fields.http.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.http.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface", + "type": "Object", + "tags": [], + "label": "interface", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias", + "type": "Object", + "tags": [], + "label": "'interface.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id", + "type": "Object", + "tags": [], + "label": "'interface.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name", + "type": "Object", + "tags": [], + "label": "'interface.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.fields.interface.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.interface.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log", + "type": "Object", + "tags": [], + "label": "log", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path", + "type": "Object", + "tags": [], + "label": "'log.file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level", + "type": "Object", + "tags": [], + "label": "'log.level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger", + "type": "Object", + "tags": [], + "label": "'log.logger'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.logger.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line", + "type": "Object", + "tags": [], + "label": "'log.origin.file.line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name", + "type": "Object", + "tags": [], + "label": "'log.origin.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function", + "type": "Object", + "tags": [], + "label": "'log.origin.function'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.origin.function.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog", + "type": "Object", + "tags": [], + "label": "'log.syslog'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname", + "type": "Object", + "tags": [], + "label": "'log.syslog.appname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.appname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code", + "type": "Object", + "tags": [], + "label": "'log.syslog.facility.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name", + "type": "Object", + "tags": [], + "label": "'log.syslog.facility.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.facility.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname", + "type": "Object", + "tags": [], + "label": "'log.syslog.hostname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.hostname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid", + "type": "Object", + "tags": [], + "label": "'log.syslog.msgid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.msgid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority", + "type": "Object", + "tags": [], + "label": "'log.syslog.priority'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.priority.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid", + "type": "Object", + "tags": [], + "label": "'log.syslog.procid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.procid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code", + "type": "Object", + "tags": [], + "label": "'log.syslog.severity.code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name", + "type": "Object", + "tags": [], + "label": "'log.syslog.severity.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.severity.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data", + "type": "Object", + "tags": [], + "label": "'log.syslog.structured_data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.structured_data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version", + "type": "Object", + "tags": [], + "label": "'log.syslog.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.fields.log.syslog.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.log.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network", + "type": "Object", + "tags": [], + "label": "network", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application", + "type": "Object", + "tags": [], + "label": "'network.application'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.application.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes", + "type": "Object", + "tags": [], + "label": "'network.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id", + "type": "Object", + "tags": [], + "label": "'network.community_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.community_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction", + "type": "Object", + "tags": [], + "label": "'network.direction'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.direction.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip", + "type": "Object", + "tags": [], + "label": "'network.forwarded_ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.forwarded_ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number", + "type": "Object", + "tags": [], + "label": "'network.iana_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.iana_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner", + "type": "Object", + "tags": [], + "label": "'network.inner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id", + "type": "Object", + "tags": [], + "label": "'network.inner.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name", + "type": "Object", + "tags": [], + "label": "'network.inner.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.inner.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name", + "type": "Object", + "tags": [], + "label": "'network.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets", + "type": "Object", + "tags": [], + "label": "'network.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol", + "type": "Object", + "tags": [], + "label": "'network.protocol'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.protocol.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport", + "type": "Object", + "tags": [], + "label": "'network.transport'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.transport.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type", + "type": "Object", + "tags": [], + "label": "'network.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id", + "type": "Object", + "tags": [], + "label": "'network.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name", + "type": "Object", + "tags": [], + "label": "'network.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.fields.network.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.network.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer", + "type": "Object", + "tags": [], + "label": "observer", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress", + "type": "Object", + "tags": [], + "label": "'observer.egress'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias", + "type": "Object", + "tags": [], + "label": "'observer.egress.interface.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id", + "type": "Object", + "tags": [], + "label": "'observer.egress.interface.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name", + "type": "Object", + "tags": [], + "label": "'observer.egress.interface.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.interface.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id", + "type": "Object", + "tags": [], + "label": "'observer.egress.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name", + "type": "Object", + "tags": [], + "label": "'observer.egress.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone", + "type": "Object", + "tags": [], + "label": "'observer.egress.zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.egress.zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location", + "type": "Object", + "tags": [], + "label": "'observer.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name", + "type": "Object", + "tags": [], + "label": "'observer.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'observer.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name", + "type": "Object", + "tags": [], + "label": "'observer.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone", + "type": "Object", + "tags": [], + "label": "'observer.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname", + "type": "Object", + "tags": [], + "label": "'observer.hostname'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.hostname.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress", + "type": "Object", + "tags": [], + "label": "'observer.ingress'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias", + "type": "Object", + "tags": [], + "label": "'observer.ingress.interface.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id", + "type": "Object", + "tags": [], + "label": "'observer.ingress.interface.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name", + "type": "Object", + "tags": [], + "label": "'observer.ingress.interface.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.interface.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id", + "type": "Object", + "tags": [], + "label": "'observer.ingress.vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name", + "type": "Object", + "tags": [], + "label": "'observer.ingress.vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone", + "type": "Object", + "tags": [], + "label": "'observer.ingress.zone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ingress.zone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip", + "type": "Object", + "tags": [], + "label": "'observer.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac", + "type": "Object", + "tags": [], + "label": "'observer.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name", + "type": "Object", + "tags": [], + "label": "'observer.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family", + "type": "Object", + "tags": [], + "label": "'observer.os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full", + "type": "Object", + "tags": [], + "label": "'observer.os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel", + "type": "Object", + "tags": [], + "label": "'observer.os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name", + "type": "Object", + "tags": [], + "label": "'observer.os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform", + "type": "Object", + "tags": [], + "label": "'observer.os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type", + "type": "Object", + "tags": [], + "label": "'observer.os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version", + "type": "Object", + "tags": [], + "label": "'observer.os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product", + "type": "Object", + "tags": [], + "label": "'observer.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number", + "type": "Object", + "tags": [], + "label": "'observer.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type", + "type": "Object", + "tags": [], + "label": "'observer.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor", + "type": "Object", + "tags": [], + "label": "'observer.vendor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.vendor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version", + "type": "Object", + "tags": [], + "label": "'observer.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.fields.observer.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.observer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator", + "type": "Object", + "tags": [], + "label": "orchestrator", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version", + "type": "Object", + "tags": [], + "label": "'orchestrator.api_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.api_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.url'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.url.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version", + "type": "Object", + "tags": [], + "label": "'orchestrator.cluster.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.cluster.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace", + "type": "Object", + "tags": [], + "label": "'orchestrator.namespace'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.namespace.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization", + "type": "Object", + "tags": [], + "label": "'orchestrator.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.parent.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.parent.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type", + "type": "Object", + "tags": [], + "label": "'orchestrator.resource.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.resource.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type", + "type": "Object", + "tags": [], + "label": "'orchestrator.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.fields.orchestrator.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.orchestrator.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization", + "type": "Object", + "tags": [], + "label": "organization", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id", + "type": "Object", + "tags": [], + "label": "'organization.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name", + "type": "Object", + "tags": [], + "label": "'organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.fields.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os", + "type": "Object", + "tags": [], + "label": "os", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family", + "type": "Object", + "tags": [], + "label": "'os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full", + "type": "Object", + "tags": [], + "label": "'os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel", + "type": "Object", + "tags": [], + "label": "'os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name", + "type": "Object", + "tags": [], + "label": "'os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform", + "type": "Object", + "tags": [], + "label": "'os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type", + "type": "Object", + "tags": [], + "label": "'os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version", + "type": "Object", + "tags": [], + "label": "'os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.fields.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.os.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package", + "type": "Object", + "tags": [], + "label": "package", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture", + "type": "Object", + "tags": [], + "label": "'package.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version", + "type": "Object", + "tags": [], + "label": "'package.build_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.build_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum", + "type": "Object", + "tags": [], + "label": "'package.checksum'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.checksum.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description", + "type": "Object", + "tags": [], + "label": "'package.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope", + "type": "Object", + "tags": [], + "label": "'package.install_scope'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.install_scope.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed", + "type": "Object", + "tags": [], + "label": "'package.installed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.installed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license", + "type": "Object", + "tags": [], + "label": "'package.license'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.license.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name", + "type": "Object", + "tags": [], + "label": "'package.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path", + "type": "Object", + "tags": [], + "label": "'package.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference", + "type": "Object", + "tags": [], + "label": "'package.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size", + "type": "Object", + "tags": [], + "label": "'package.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type", + "type": "Object", + "tags": [], + "label": "'package.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version", + "type": "Object", + "tags": [], + "label": "'package.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.fields.package.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.package.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe", + "type": "Object", + "tags": [], + "label": "pe", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture", + "type": "Object", + "tags": [], + "label": "'pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company", + "type": "Object", + "tags": [], + "label": "'pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description", + "type": "Object", + "tags": [], + "label": "'pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version", + "type": "Object", + "tags": [], + "label": "'pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash", + "type": "Object", + "tags": [], + "label": "'pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash", + "type": "Object", + "tags": [], + "label": "'pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product", + "type": "Object", + "tags": [], + "label": "'pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.fields.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.pe.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process", + "type": "Object", + "tags": [], + "label": "process", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args", + "type": "Object", + "tags": [], + "label": "'process.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count", + "type": "Object", + "tags": [], + "label": "'process.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'process.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'process.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'process.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status", + "type": "Object", + "tags": [], + "label": "'process.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'process.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'process.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'process.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'process.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'process.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line", + "type": "Object", + "tags": [], + "label": "'process.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture", + "type": "Object", + "tags": [], + "label": "'process.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'process.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'process.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'process.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports", + "type": "Object", + "tags": [], + "label": "'process.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'process.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class", + "type": "Object", + "tags": [], + "label": "'process.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data", + "type": "Object", + "tags": [], + "label": "'process.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'process.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'process.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'process.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type", + "type": "Object", + "tags": [], + "label": "'process.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version", + "type": "Object", + "tags": [], + "label": "'process.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports", + "type": "Object", + "tags": [], + "label": "'process.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections", + "type": "Object", + "tags": [], + "label": "'process.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'process.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments", + "type": "Object", + "tags": [], + "label": "'process.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'process.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'process.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'process.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'process.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end", + "type": "Object", + "tags": [], + "label": "'process.end'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.end.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.attested_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.attested_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.attested_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.attested_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.entry_meta.source.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.source.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.entry_meta.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.entry_meta.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.session_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.session_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.session_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.session_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.parent.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.parent.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.same_as_process'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.same_as_process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory", + "type": "Object", + "tags": [], + "label": "'process.entry_leader.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.entry_leader.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars", + "type": "Object", + "tags": [], + "label": "'process.env_vars'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.env_vars.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable", + "type": "Object", + "tags": [], + "label": "'process.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code", + "type": "Object", + "tags": [], + "label": "'process.exit_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.exit_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args", + "type": "Object", + "tags": [], + "label": "'process.group_leader.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count", + "type": "Object", + "tags": [], + "label": "'process.group_leader.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line", + "type": "Object", + "tags": [], + "label": "'process.group_leader.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable", + "type": "Object", + "tags": [], + "label": "'process.group_leader.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive", + "type": "Object", + "tags": [], + "label": "'process.group_leader.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.group_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process", + "type": "Object", + "tags": [], + "label": "'process.group_leader.same_as_process'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.same_as_process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start", + "type": "Object", + "tags": [], + "label": "'process.group_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty", + "type": "Object", + "tags": [], + "label": "'process.group_leader.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.group_leader.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.group_leader.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id", + "type": "Object", + "tags": [], + "label": "'process.group_leader.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name", + "type": "Object", + "tags": [], + "label": "'process.group_leader.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory", + "type": "Object", + "tags": [], + "label": "'process.group_leader.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.group_leader.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5", + "type": "Object", + "tags": [], + "label": "'process.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1", + "type": "Object", + "tags": [], + "label": "'process.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256", + "type": "Object", + "tags": [], + "label": "'process.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384", + "type": "Object", + "tags": [], + "label": "'process.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512", + "type": "Object", + "tags": [], + "label": "'process.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'process.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'process.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive", + "type": "Object", + "tags": [], + "label": "'process.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io", + "type": "Object", + "tags": [], + "label": "'process.io'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped", + "type": "Object", + "tags": [], + "label": "'process.io.bytes_skipped'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length", + "type": "Object", + "tags": [], + "label": "'process.io.bytes_skipped.length'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.length.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset", + "type": "Object", + "tags": [], + "label": "'process.io.bytes_skipped.offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.bytes_skipped.offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded", + "type": "Object", + "tags": [], + "label": "'process.io.max_bytes_per_process_exceeded'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.max_bytes_per_process_exceeded.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text", + "type": "Object", + "tags": [], + "label": "'process.io.text'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.text.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured", + "type": "Object", + "tags": [], + "label": "'process.io.total_bytes_captured'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_captured.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped", + "type": "Object", + "tags": [], + "label": "'process.io.total_bytes_skipped'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.total_bytes_skipped.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type", + "type": "Object", + "tags": [], + "label": "'process.io.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.io.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name", + "type": "Object", + "tags": [], + "label": "'process.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args", + "type": "Object", + "tags": [], + "label": "'process.parent.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count", + "type": "Object", + "tags": [], + "label": "'process.parent.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'process.parent.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line", + "type": "Object", + "tags": [], + "label": "'process.parent.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'process.parent.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end", + "type": "Object", + "tags": [], + "label": "'process.parent.end'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.end.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id", + "type": "Object", + "tags": [], + "label": "'process.parent.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable", + "type": "Object", + "tags": [], + "label": "'process.parent.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code", + "type": "Object", + "tags": [], + "label": "'process.parent.exit_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.exit_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id", + "type": "Object", + "tags": [], + "label": "'process.parent.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name", + "type": "Object", + "tags": [], + "label": "'process.parent.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.parent.group_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.parent.group_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start", + "type": "Object", + "tags": [], + "label": "'process.parent.group_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.group_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'process.parent.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive", + "type": "Object", + "tags": [], + "label": "'process.parent.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name", + "type": "Object", + "tags": [], + "label": "'process.parent.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product", + "type": "Object", + "tags": [], + "label": "'process.parent.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid", + "type": "Object", + "tags": [], + "label": "'process.parent.pgid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pgid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid", + "type": "Object", + "tags": [], + "label": "'process.parent.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.parent.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.parent.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.parent.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.parent.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.parent.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start", + "type": "Object", + "tags": [], + "label": "'process.parent.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.parent.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.parent.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id", + "type": "Object", + "tags": [], + "label": "'process.parent.thread.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name", + "type": "Object", + "tags": [], + "label": "'process.parent.thread.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.thread.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title", + "type": "Object", + "tags": [], + "label": "'process.parent.title'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.title.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty", + "type": "Object", + "tags": [], + "label": "'process.parent.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.parent.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.parent.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime", + "type": "Object", + "tags": [], + "label": "'process.parent.uptime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.uptime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id", + "type": "Object", + "tags": [], + "label": "'process.parent.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name", + "type": "Object", + "tags": [], + "label": "'process.parent.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory", + "type": "Object", + "tags": [], + "label": "'process.parent.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.parent.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture", + "type": "Object", + "tags": [], + "label": "'process.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company", + "type": "Object", + "tags": [], + "label": "'process.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description", + "type": "Object", + "tags": [], + "label": "'process.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version", + "type": "Object", + "tags": [], + "label": "'process.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash", + "type": "Object", + "tags": [], + "label": "'process.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'process.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash", + "type": "Object", + "tags": [], + "label": "'process.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product", + "type": "Object", + "tags": [], + "label": "'process.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid", + "type": "Object", + "tags": [], + "label": "'process.pgid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pgid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid", + "type": "Object", + "tags": [], + "label": "'process.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args", + "type": "Object", + "tags": [], + "label": "'process.previous.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count", + "type": "Object", + "tags": [], + "label": "'process.previous.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable", + "type": "Object", + "tags": [], + "label": "'process.previous.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.previous.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args", + "type": "Object", + "tags": [], + "label": "'process.session_leader.args'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count", + "type": "Object", + "tags": [], + "label": "'process.session_leader.args_count'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.args_count.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line", + "type": "Object", + "tags": [], + "label": "'process.session_leader.command_line'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.command_line.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable", + "type": "Object", + "tags": [], + "label": "'process.session_leader.executable'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.executable.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive", + "type": "Object", + "tags": [], + "label": "'process.session_leader.interactive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.interactive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.session_leader.entity_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.entity_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.session_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.session_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.session_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start", + "type": "Object", + "tags": [], + "label": "'process.session_leader.parent.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.parent.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid", + "type": "Object", + "tags": [], + "label": "'process.session_leader.pid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.pid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.real_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.real_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process", + "type": "Object", + "tags": [], + "label": "'process.session_leader.same_as_process'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.example", + "type": "boolean", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.same_as_process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.saved_user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.saved_user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start", + "type": "Object", + "tags": [], + "label": "'process.session_leader.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty", + "type": "Object", + "tags": [], + "label": "'process.session_leader.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.session_leader.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.session_leader.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id", + "type": "Object", + "tags": [], + "label": "'process.session_leader.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name", + "type": "Object", + "tags": [], + "label": "'process.session_leader.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory", + "type": "Object", + "tags": [], + "label": "'process.session_leader.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.session_leader.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start", + "type": "Object", + "tags": [], + "label": "'process.start'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.start.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id", + "type": "Object", + "tags": [], + "label": "'process.supplemental_groups.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name", + "type": "Object", + "tags": [], + "label": "'process.supplemental_groups.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.supplemental_groups.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id", + "type": "Object", + "tags": [], + "label": "'process.thread.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name", + "type": "Object", + "tags": [], + "label": "'process.thread.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.thread.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title", + "type": "Object", + "tags": [], + "label": "'process.title'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.title.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty", + "type": "Object", + "tags": [], + "label": "'process.tty'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major", + "type": "Object", + "tags": [], + "label": "'process.tty.char_device.major'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.major.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor", + "type": "Object", + "tags": [], + "label": "'process.tty.char_device.minor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.char_device.minor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns", + "type": "Object", + "tags": [], + "label": "'process.tty.columns'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.columns.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows", + "type": "Object", + "tags": [], + "label": "'process.tty.rows'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.tty.rows.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime", + "type": "Object", + "tags": [], + "label": "'process.uptime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.uptime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id", + "type": "Object", + "tags": [], + "label": "'process.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name", + "type": "Object", + "tags": [], + "label": "'process.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory", + "type": "Object", + "tags": [], + "label": "'process.working_directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.fields.process.working_directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "({ as: string; at: string; full: string; short_override: string; } | { as: string; at: string; full: string; normalize: string[]; short_override: string; })[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "({ full: string; schema_name: string; short: string; } | { full: string; normalize: string[]; schema_name: string; short: string; } | { beta: string; full: string; normalize: string[]; schema_name: string; short: string; } | { beta: string; full: string; schema_name: string; short: string; })[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.process.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry", + "type": "Object", + "tags": [], + "label": "registry", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes", + "type": "Object", + "tags": [], + "label": "'registry.data.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings", + "type": "Object", + "tags": [], + "label": "'registry.data.strings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.strings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type", + "type": "Object", + "tags": [], + "label": "'registry.data.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.data.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive", + "type": "Object", + "tags": [], + "label": "'registry.hive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.hive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key", + "type": "Object", + "tags": [], + "label": "'registry.key'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.key.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path", + "type": "Object", + "tags": [], + "label": "'registry.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value", + "type": "Object", + "tags": [], + "label": "'registry.value'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.fields.registry.value.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.registry.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related", + "type": "Object", + "tags": [], + "label": "related", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash", + "type": "Object", + "tags": [], + "label": "'related.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts", + "type": "Object", + "tags": [], + "label": "'related.hosts'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.hosts.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip", + "type": "Object", + "tags": [], + "label": "'related.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user", + "type": "Object", + "tags": [], + "label": "'related.user'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.fields.related.user.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.related.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk", + "type": "Object", + "tags": [], + "label": "risk", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level", + "type": "Object", + "tags": [], + "label": "'risk.calculated_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score", + "type": "Object", + "tags": [], + "label": "'risk.calculated_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm", + "type": "Object", + "tags": [], + "label": "'risk.calculated_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.calculated_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level", + "type": "Object", + "tags": [], + "label": "'risk.static_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score", + "type": "Object", + "tags": [], + "label": "'risk.static_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm", + "type": "Object", + "tags": [], + "label": "'risk.static_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.fields.risk.static_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.risk.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule", + "type": "Object", + "tags": [], + "label": "rule", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author", + "type": "Object", + "tags": [], + "label": "'rule.author'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.author.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category", + "type": "Object", + "tags": [], + "label": "'rule.category'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.category.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description", + "type": "Object", + "tags": [], + "label": "'rule.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id", + "type": "Object", + "tags": [], + "label": "'rule.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license", + "type": "Object", + "tags": [], + "label": "'rule.license'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.license.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name", + "type": "Object", + "tags": [], + "label": "'rule.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference", + "type": "Object", + "tags": [], + "label": "'rule.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset", + "type": "Object", + "tags": [], + "label": "'rule.ruleset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.ruleset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid", + "type": "Object", + "tags": [], + "label": "'rule.uuid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.uuid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version", + "type": "Object", + "tags": [], + "label": "'rule.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.fields.rule.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.rule.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server", + "type": "Object", + "tags": [], + "label": "server", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address", + "type": "Object", + "tags": [], + "label": "'server.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number", + "type": "Object", + "tags": [], + "label": "'server.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name", + "type": "Object", + "tags": [], + "label": "'server.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes", + "type": "Object", + "tags": [], + "label": "'server.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain", + "type": "Object", + "tags": [], + "label": "'server.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name", + "type": "Object", + "tags": [], + "label": "'server.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'server.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'server.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'server.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name", + "type": "Object", + "tags": [], + "label": "'server.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location", + "type": "Object", + "tags": [], + "label": "'server.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name", + "type": "Object", + "tags": [], + "label": "'server.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'server.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'server.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name", + "type": "Object", + "tags": [], + "label": "'server.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone", + "type": "Object", + "tags": [], + "label": "'server.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip", + "type": "Object", + "tags": [], + "label": "'server.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac", + "type": "Object", + "tags": [], + "label": "'server.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip", + "type": "Object", + "tags": [], + "label": "'server.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port", + "type": "Object", + "tags": [], + "label": "'server.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets", + "type": "Object", + "tags": [], + "label": "'server.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port", + "type": "Object", + "tags": [], + "label": "'server.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain", + "type": "Object", + "tags": [], + "label": "'server.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain", + "type": "Object", + "tags": [], + "label": "'server.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain", + "type": "Object", + "tags": [], + "label": "'server.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain", + "type": "Object", + "tags": [], + "label": "'server.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email", + "type": "Object", + "tags": [], + "label": "'server.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name", + "type": "Object", + "tags": [], + "label": "'server.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain", + "type": "Object", + "tags": [], + "label": "'server.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id", + "type": "Object", + "tags": [], + "label": "'server.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name", + "type": "Object", + "tags": [], + "label": "'server.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash", + "type": "Object", + "tags": [], + "label": "'server.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id", + "type": "Object", + "tags": [], + "label": "'server.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name", + "type": "Object", + "tags": [], + "label": "'server.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles", + "type": "Object", + "tags": [], + "label": "'server.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.fields.server.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.server.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service", + "type": "Object", + "tags": [], + "label": "service", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address", + "type": "Object", + "tags": [], + "label": "'service.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment", + "type": "Object", + "tags": [], + "label": "'service.environment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.environment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'service.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id", + "type": "Object", + "tags": [], + "label": "'service.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name", + "type": "Object", + "tags": [], + "label": "'service.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name", + "type": "Object", + "tags": [], + "label": "'service.node.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role", + "type": "Object", + "tags": [], + "label": "'service.node.role'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.role.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles", + "type": "Object", + "tags": [], + "label": "'service.node.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.node.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address", + "type": "Object", + "tags": [], + "label": "'service.origin.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment", + "type": "Object", + "tags": [], + "label": "'service.origin.environment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.environment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'service.origin.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id", + "type": "Object", + "tags": [], + "label": "'service.origin.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name", + "type": "Object", + "tags": [], + "label": "'service.origin.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name", + "type": "Object", + "tags": [], + "label": "'service.origin.node.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role", + "type": "Object", + "tags": [], + "label": "'service.origin.node.role'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.role.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles", + "type": "Object", + "tags": [], + "label": "'service.origin.node.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.node.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state", + "type": "Object", + "tags": [], + "label": "'service.origin.state'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.state.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type", + "type": "Object", + "tags": [], + "label": "'service.origin.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version", + "type": "Object", + "tags": [], + "label": "'service.origin.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.origin.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state", + "type": "Object", + "tags": [], + "label": "'service.state'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.state.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address", + "type": "Object", + "tags": [], + "label": "'service.target.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment", + "type": "Object", + "tags": [], + "label": "'service.target.environment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.beta", + "type": "string", + "tags": [], + "label": "beta", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.environment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id", + "type": "Object", + "tags": [], + "label": "'service.target.ephemeral_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.ephemeral_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id", + "type": "Object", + "tags": [], + "label": "'service.target.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name", + "type": "Object", + "tags": [], + "label": "'service.target.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name", + "type": "Object", + "tags": [], + "label": "'service.target.node.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role", + "type": "Object", + "tags": [], + "label": "'service.target.node.role'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.role.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles", + "type": "Object", + "tags": [], + "label": "'service.target.node.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.node.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state", + "type": "Object", + "tags": [], + "label": "'service.target.state'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.state.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type", + "type": "Object", + "tags": [], + "label": "'service.target.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version", + "type": "Object", + "tags": [], + "label": "'service.target.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.target.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type", + "type": "Object", + "tags": [], + "label": "'service.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version", + "type": "Object", + "tags": [], + "label": "'service.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.fields.service.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.footnote", + "type": "string", + "tags": [], + "label": "footnote", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; beta: string; full: string; short_override: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ beta: string; full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.service.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source", + "type": "Object", + "tags": [], + "label": "source", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address", + "type": "Object", + "tags": [], + "label": "'source.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number", + "type": "Object", + "tags": [], + "label": "'source.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name", + "type": "Object", + "tags": [], + "label": "'source.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes", + "type": "Object", + "tags": [], + "label": "'source.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain", + "type": "Object", + "tags": [], + "label": "'source.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name", + "type": "Object", + "tags": [], + "label": "'source.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'source.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'source.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'source.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name", + "type": "Object", + "tags": [], + "label": "'source.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location", + "type": "Object", + "tags": [], + "label": "'source.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name", + "type": "Object", + "tags": [], + "label": "'source.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'source.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'source.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name", + "type": "Object", + "tags": [], + "label": "'source.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone", + "type": "Object", + "tags": [], + "label": "'source.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip", + "type": "Object", + "tags": [], + "label": "'source.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac", + "type": "Object", + "tags": [], + "label": "'source.mac'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.pattern", + "type": "string", + "tags": [], + "label": "pattern", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.mac.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip", + "type": "Object", + "tags": [], + "label": "'source.nat.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port", + "type": "Object", + "tags": [], + "label": "'source.nat.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.nat.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets", + "type": "Object", + "tags": [], + "label": "'source.packets'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.packets.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port", + "type": "Object", + "tags": [], + "label": "'source.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain", + "type": "Object", + "tags": [], + "label": "'source.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain", + "type": "Object", + "tags": [], + "label": "'source.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain", + "type": "Object", + "tags": [], + "label": "'source.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain", + "type": "Object", + "tags": [], + "label": "'source.user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email", + "type": "Object", + "tags": [], + "label": "'source.user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name", + "type": "Object", + "tags": [], + "label": "'source.user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain", + "type": "Object", + "tags": [], + "label": "'source.user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id", + "type": "Object", + "tags": [], + "label": "'source.user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name", + "type": "Object", + "tags": [], + "label": "'source.user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash", + "type": "Object", + "tags": [], + "label": "'source.user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id", + "type": "Object", + "tags": [], + "label": "'source.user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name", + "type": "Object", + "tags": [], + "label": "'source.user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles", + "type": "Object", + "tags": [], + "label": "'source.user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.fields.source.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; short_override: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.source.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat", + "type": "Object", + "tags": [], + "label": "threat", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments", + "type": "Object", + "tags": [], + "label": "'threat.enrichments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.confidence'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.confidence.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.email.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.email.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.accessed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.accessed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.attributes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.attributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.ctime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.ctime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.device'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.drive_letter'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.drive_letter.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.fork_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.fork_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.gid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.gid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.group'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.inode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.inode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.mode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.mtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.mtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.owner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.owner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.target_path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.target_path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.uid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.uid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.file.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.file.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.first_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.first_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.last_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.last_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.marking.tlp.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.marking.tlp.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.modified_at'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.modified_at.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.data.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.data.strings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.strings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.data.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.data.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.hive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.hive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.key'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.key.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.registry.value'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.registry.value.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.scanner_stats'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.scanner_stats.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.sightings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.sightings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.fragment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.fragment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.password'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.password.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.query'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.query.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.scheme'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.scheme.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.url.username'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.url.username.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.indicator.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.indicator.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.atomic'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.atomic.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.field'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.field.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.index'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.index.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.occurred'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.occurred.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type", + "type": "Object", + "tags": [], + "label": "'threat.enrichments.matched.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.enrichments.matched.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id", + "type": "Object", + "tags": [], + "label": "'threat.feed.dashboard_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.dashboard_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description", + "type": "Object", + "tags": [], + "label": "'threat.feed.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name", + "type": "Object", + "tags": [], + "label": "'threat.feed.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference", + "type": "Object", + "tags": [], + "label": "'threat.feed.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.feed.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework", + "type": "Object", + "tags": [], + "label": "'threat.framework'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.framework.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias", + "type": "Object", + "tags": [], + "label": "'threat.group.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id", + "type": "Object", + "tags": [], + "label": "'threat.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name", + "type": "Object", + "tags": [], + "label": "'threat.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference", + "type": "Object", + "tags": [], + "label": "'threat.group.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.group.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.as.number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.as.organization.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.as.organization.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence", + "type": "Object", + "tags": [], + "label": "'threat.indicator.confidence'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.confidence.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description", + "type": "Object", + "tags": [], + "label": "'threat.indicator.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address", + "type": "Object", + "tags": [], + "label": "'threat.indicator.email.address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.email.address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.accessed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.accessed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.attributes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.attributes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.digest_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.digest_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.exists'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.exists.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.signing_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.signing_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.status'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.status.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.subject_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.subject_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.team_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.team_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.timestamp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.timestamp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.trusted'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.trusted.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.code_signature.valid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.code_signature.valid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.created'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.created.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.ctime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.ctime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.device'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.device.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.directory'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.directory.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.drive_letter'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.drive_letter.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.byte_order'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.byte_order.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.cpu_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.cpu_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.creation_date'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.creation_date.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.exports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.exports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.abi_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.abi_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.class'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.class.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.data'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.data.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.entrypoint'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.entrypoint.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.object_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.object_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.os_abi'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.os_abi.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.header.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.header.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.imports'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.imports.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.chi2'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.chi2.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.entropy'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.entropy.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.flags'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.flags.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.physical_offset'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_offset.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.physical_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.physical_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.virtual_address'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_address.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.sections.virtual_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.sections.virtual_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.segments'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.segments.sections'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.sections.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.segments.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.segments.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.shared_libraries'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.shared_libraries.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.elf.telfhash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.elf.telfhash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.fork_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.fork_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.gid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.gid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.group'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.group.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha384'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha384.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.sha512'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.sha512.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.ssdeep'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.ssdeep.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.hash.tlsh'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.hash.tlsh.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.inode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.inode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.mime_type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mime_type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.mode'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mode.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.mtime'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.mtime.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.owner'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.owner.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.architecture'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.architecture.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.company'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.company.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.file_version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.file_version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.imphash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.imphash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.original_file_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.original_file_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.pehash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.pehash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.pe.product'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.pe.product.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.target_path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.target_path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.uid'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.uid.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.file.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.file.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen", + "type": "Object", + "tags": [], + "label": "'threat.indicator.first_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.first_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.city_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.city_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.continent_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.continent_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.continent_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.country_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.country_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.country_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.location'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.location.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.postal_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.postal_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.region_iso_code'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_iso_code.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.region_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.region_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone", + "type": "Object", + "tags": [], + "label": "'threat.indicator.geo.timezone'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.geo.timezone.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip", + "type": "Object", + "tags": [], + "label": "'threat.indicator.ip'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.ip.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen", + "type": "Object", + "tags": [], + "label": "'threat.indicator.last_seen'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.last_seen.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp", + "type": "Object", + "tags": [], + "label": "'threat.indicator.marking.tlp'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.marking.tlp.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at", + "type": "Object", + "tags": [], + "label": "'threat.indicator.modified_at'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.modified_at.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port", + "type": "Object", + "tags": [], + "label": "'threat.indicator.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider", + "type": "Object", + "tags": [], + "label": "'threat.indicator.provider'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.provider.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference", + "type": "Object", + "tags": [], + "label": "'threat.indicator.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.data.bytes'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.bytes.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.data.strings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.strings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.data.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.data.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.hive'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.hive.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.key'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.key.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value", + "type": "Object", + "tags": [], + "label": "'threat.indicator.registry.value'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.registry.value.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats", + "type": "Object", + "tags": [], + "label": "'threat.indicator.scanner_stats'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.scanner_stats.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings", + "type": "Object", + "tags": [], + "label": "'threat.indicator.sightings'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.sightings.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type", + "type": "Object", + "tags": [], + "label": "'threat.indicator.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.fragment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.fragment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.password'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.password.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.query'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.query.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.scheme'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.scheme.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username", + "type": "Object", + "tags": [], + "label": "'threat.indicator.url.username'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.url.username.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number", + "type": "Object", + "tags": [], + "label": "'threat.indicator.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.indicator.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias", + "type": "Object", + "tags": [], + "label": "'threat.software.alias'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.alias.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id", + "type": "Object", + "tags": [], + "label": "'threat.software.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name", + "type": "Object", + "tags": [], + "label": "'threat.software.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms", + "type": "Object", + "tags": [], + "label": "'threat.software.platforms'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.platforms.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference", + "type": "Object", + "tags": [], + "label": "'threat.software.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type", + "type": "Object", + "tags": [], + "label": "'threat.software.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.software.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id", + "type": "Object", + "tags": [], + "label": "'threat.tactic.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name", + "type": "Object", + "tags": [], + "label": "'threat.tactic.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference", + "type": "Object", + "tags": [], + "label": "'threat.tactic.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.tactic.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id", + "type": "Object", + "tags": [], + "label": "'threat.technique.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name", + "type": "Object", + "tags": [], + "label": "'threat.technique.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference", + "type": "Object", + "tags": [], + "label": "'threat.technique.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id", + "type": "Object", + "tags": [], + "label": "'threat.technique.subtechnique.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name", + "type": "Object", + "tags": [], + "label": "'threat.technique.subtechnique.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference", + "type": "Object", + "tags": [], + "label": "'threat.technique.subtechnique.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.technique.subtechnique.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version", + "type": "Object", + "tags": [], + "label": "'threat.threat.indicator.marking.tlp.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.fields.threat.threat.indicator.marking.tlp.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.threat.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls", + "type": "Object", + "tags": [], + "label": "tls", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher", + "type": "Object", + "tags": [], + "label": "'tls.cipher'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.cipher.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate", + "type": "Object", + "tags": [], + "label": "'tls.client.certificate'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain", + "type": "Object", + "tags": [], + "label": "'tls.client.certificate_chain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.certificate_chain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5", + "type": "Object", + "tags": [], + "label": "'tls.client.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1", + "type": "Object", + "tags": [], + "label": "'tls.client.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256", + "type": "Object", + "tags": [], + "label": "'tls.client.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer", + "type": "Object", + "tags": [], + "label": "'tls.client.issuer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.issuer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3", + "type": "Object", + "tags": [], + "label": "'tls.client.ja3'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.ja3.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after", + "type": "Object", + "tags": [], + "label": "'tls.client.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before", + "type": "Object", + "tags": [], + "label": "'tls.client.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name", + "type": "Object", + "tags": [], + "label": "'tls.client.server_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.server_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject", + "type": "Object", + "tags": [], + "label": "'tls.client.subject'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.subject.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers", + "type": "Object", + "tags": [], + "label": "'tls.client.supported_ciphers'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.supported_ciphers.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number", + "type": "Object", + "tags": [], + "label": "'tls.client.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.client.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve", + "type": "Object", + "tags": [], + "label": "'tls.curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established", + "type": "Object", + "tags": [], + "label": "'tls.established'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.established.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol", + "type": "Object", + "tags": [], + "label": "'tls.next_protocol'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.next_protocol.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed", + "type": "Object", + "tags": [], + "label": "'tls.resumed'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.resumed.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate", + "type": "Object", + "tags": [], + "label": "'tls.server.certificate'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain", + "type": "Object", + "tags": [], + "label": "'tls.server.certificate_chain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.certificate_chain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5", + "type": "Object", + "tags": [], + "label": "'tls.server.hash.md5'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.md5.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1", + "type": "Object", + "tags": [], + "label": "'tls.server.hash.sha1'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha1.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256", + "type": "Object", + "tags": [], + "label": "'tls.server.hash.sha256'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.hash.sha256.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer", + "type": "Object", + "tags": [], + "label": "'tls.server.issuer'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.issuer.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s", + "type": "Object", + "tags": [], + "label": "'tls.server.ja3s'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.ja3s.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after", + "type": "Object", + "tags": [], + "label": "'tls.server.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before", + "type": "Object", + "tags": [], + "label": "'tls.server.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject", + "type": "Object", + "tags": [], + "label": "'tls.server.subject'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.subject.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number", + "type": "Object", + "tags": [], + "label": "'tls.server.x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.server.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version", + "type": "Object", + "tags": [], + "label": "'tls.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol", + "type": "Object", + "tags": [], + "label": "'tls.version_protocol'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.fields.tls.version_protocol.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tls.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing", + "type": "Object", + "tags": [], + "label": "tracing", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id", + "type": "Object", + "tags": [], + "label": "'span.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.span.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id", + "type": "Object", + "tags": [], + "label": "'trace.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.trace.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id", + "type": "Object", + "tags": [], + "label": "'transaction.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.fields.transaction.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.root", + "type": "boolean", + "tags": [], + "label": "root", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.tracing.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url", + "type": "Object", + "tags": [], + "label": "url", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain", + "type": "Object", + "tags": [], + "label": "'url.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension", + "type": "Object", + "tags": [], + "label": "'url.extension'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.extension.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment", + "type": "Object", + "tags": [], + "label": "'url.fragment'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.fragment.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full", + "type": "Object", + "tags": [], + "label": "'url.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original", + "type": "Object", + "tags": [], + "label": "'url.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password", + "type": "Object", + "tags": [], + "label": "'url.password'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.password.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path", + "type": "Object", + "tags": [], + "label": "'url.path'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.path.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port", + "type": "Object", + "tags": [], + "label": "'url.port'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.format", + "type": "string", + "tags": [], + "label": "format", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.port.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query", + "type": "Object", + "tags": [], + "label": "'url.query'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.query.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain", + "type": "Object", + "tags": [], + "label": "'url.registered_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.registered_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme", + "type": "Object", + "tags": [], + "label": "'url.scheme'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.scheme.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain", + "type": "Object", + "tags": [], + "label": "'url.subdomain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.subdomain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain", + "type": "Object", + "tags": [], + "label": "'url.top_level_domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.top_level_domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username", + "type": "Object", + "tags": [], + "label": "'url.username'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.fields.url.username.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.url.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user", + "type": "Object", + "tags": [], + "label": "user", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain", + "type": "Object", + "tags": [], + "label": "'user.changes.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email", + "type": "Object", + "tags": [], + "label": "'user.changes.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name", + "type": "Object", + "tags": [], + "label": "'user.changes.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain", + "type": "Object", + "tags": [], + "label": "'user.changes.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id", + "type": "Object", + "tags": [], + "label": "'user.changes.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name", + "type": "Object", + "tags": [], + "label": "'user.changes.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash", + "type": "Object", + "tags": [], + "label": "'user.changes.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id", + "type": "Object", + "tags": [], + "label": "'user.changes.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name", + "type": "Object", + "tags": [], + "label": "'user.changes.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles", + "type": "Object", + "tags": [], + "label": "'user.changes.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.changes.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain", + "type": "Object", + "tags": [], + "label": "'user.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain", + "type": "Object", + "tags": [], + "label": "'user.effective.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email", + "type": "Object", + "tags": [], + "label": "'user.effective.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name", + "type": "Object", + "tags": [], + "label": "'user.effective.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain", + "type": "Object", + "tags": [], + "label": "'user.effective.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id", + "type": "Object", + "tags": [], + "label": "'user.effective.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name", + "type": "Object", + "tags": [], + "label": "'user.effective.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash", + "type": "Object", + "tags": [], + "label": "'user.effective.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id", + "type": "Object", + "tags": [], + "label": "'user.effective.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name", + "type": "Object", + "tags": [], + "label": "'user.effective.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles", + "type": "Object", + "tags": [], + "label": "'user.effective.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.effective.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email", + "type": "Object", + "tags": [], + "label": "'user.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name", + "type": "Object", + "tags": [], + "label": "'user.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain", + "type": "Object", + "tags": [], + "label": "'user.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id", + "type": "Object", + "tags": [], + "label": "'user.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name", + "type": "Object", + "tags": [], + "label": "'user.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash", + "type": "Object", + "tags": [], + "label": "'user.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id", + "type": "Object", + "tags": [], + "label": "'user.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name", + "type": "Object", + "tags": [], + "label": "'user.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level", + "type": "Object", + "tags": [], + "label": "'user.risk.calculated_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score", + "type": "Object", + "tags": [], + "label": "'user.risk.calculated_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm", + "type": "Object", + "tags": [], + "label": "'user.risk.calculated_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.calculated_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level", + "type": "Object", + "tags": [], + "label": "'user.risk.static_level'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_level.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score", + "type": "Object", + "tags": [], + "label": "'user.risk.static_score'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm", + "type": "Object", + "tags": [], + "label": "'user.risk.static_score_norm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.risk.static_score_norm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles", + "type": "Object", + "tags": [], + "label": "'user.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain", + "type": "Object", + "tags": [], + "label": "'user.target.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email", + "type": "Object", + "tags": [], + "label": "'user.target.email'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.email.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name", + "type": "Object", + "tags": [], + "label": "'user.target.full_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.full_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain", + "type": "Object", + "tags": [], + "label": "'user.target.group.domain'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.domain.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id", + "type": "Object", + "tags": [], + "label": "'user.target.group.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name", + "type": "Object", + "tags": [], + "label": "'user.target.group.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.group.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash", + "type": "Object", + "tags": [], + "label": "'user.target.hash'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.hash.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id", + "type": "Object", + "tags": [], + "label": "'user.target.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name", + "type": "Object", + "tags": [], + "label": "'user.target.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles", + "type": "Object", + "tags": [], + "label": "'user.target.roles'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.fields.user.target.roles.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "({ as: string; at: string; full: string; } | { as: string; at: string; full: string; short_override: string; } | { as: string; at: string; beta: string; full: string; short_override: string; })[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent", + "type": "Object", + "tags": [], + "label": "user_agent", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name", + "type": "Object", + "tags": [], + "label": "'user_agent.device.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.device.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name", + "type": "Object", + "tags": [], + "label": "'user_agent.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original", + "type": "Object", + "tags": [], + "label": "'user_agent.original'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.original.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family", + "type": "Object", + "tags": [], + "label": "'user_agent.os.family'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.family.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full", + "type": "Object", + "tags": [], + "label": "'user_agent.os.full'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.full.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel", + "type": "Object", + "tags": [], + "label": "'user_agent.os.kernel'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.kernel.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name", + "type": "Object", + "tags": [], + "label": "'user_agent.os.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform", + "type": "Object", + "tags": [], + "label": "'user_agent.os.platform'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.platform.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type", + "type": "Object", + "tags": [], + "label": "'user_agent.os.type'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.expected_values", + "type": "Array", + "tags": [], + "label": "expected_values", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.type.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version", + "type": "Object", + "tags": [], + "label": "'user_agent.os.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.original_fieldset", + "type": "string", + "tags": [], + "label": "original_fieldset", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.os.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version", + "type": "Object", + "tags": [], + "label": "'user_agent.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.fields.user_agent.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.nestings", + "type": "Array", + "tags": [], + "label": "nestings", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.reused_here", + "type": "Array", + "tags": [], + "label": "reused_here", + "description": [], + "signature": [ + "{ full: string; schema_name: string; short: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.user_agent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan", + "type": "Object", + "tags": [], + "label": "vlan", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id", + "type": "Object", + "tags": [], + "label": "'vlan.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name", + "type": "Object", + "tags": [], + "label": "'vlan.name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.fields.vlan.name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vlan.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability", + "type": "Object", + "tags": [], + "label": "vulnerability", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category", + "type": "Object", + "tags": [], + "label": "'vulnerability.category'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.category.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification", + "type": "Object", + "tags": [], + "label": "'vulnerability.classification'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.classification.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description", + "type": "Object", + "tags": [], + "label": "'vulnerability.description'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.multi_fields", + "type": "Array", + "tags": [], + "label": "multi_fields", + "description": [], + "signature": [ + "{ flat_name: string; name: string; type: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.description.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration", + "type": "Object", + "tags": [], + "label": "'vulnerability.enumeration'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.enumeration.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id", + "type": "Object", + "tags": [], + "label": "'vulnerability.id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference", + "type": "Object", + "tags": [], + "label": "'vulnerability.reference'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.reference.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id", + "type": "Object", + "tags": [], + "label": "'vulnerability.report_id'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.report_id.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor", + "type": "Object", + "tags": [], + "label": "'vulnerability.scanner.vendor'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.scanner.vendor.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.base'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.base.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.environmental'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.environmental.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.temporal'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.temporal.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version", + "type": "Object", + "tags": [], + "label": "'vulnerability.score.version'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.score.version.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity", + "type": "Object", + "tags": [], + "label": "'vulnerability.severity'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.fields.vulnerability.severity.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.vulnerability.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509", + "type": "Object", + "tags": [], + "label": "x509", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields", + "type": "Object", + "tags": [], + "label": "fields", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names", + "type": "Object", + "tags": [], + "label": "'x509.alternative_names'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.alternative_names.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name", + "type": "Object", + "tags": [], + "label": "'x509.issuer.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country", + "type": "Object", + "tags": [], + "label": "'x509.issuer.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name", + "type": "Object", + "tags": [], + "label": "'x509.issuer.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality", + "type": "Object", + "tags": [], + "label": "'x509.issuer.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization", + "type": "Object", + "tags": [], + "label": "'x509.issuer.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit", + "type": "Object", + "tags": [], + "label": "'x509.issuer.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province", + "type": "Object", + "tags": [], + "label": "'x509.issuer.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.issuer.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after", + "type": "Object", + "tags": [], + "label": "'x509.not_after'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_after.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before", + "type": "Object", + "tags": [], + "label": "'x509.not_before'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.not_before.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm", + "type": "Object", + "tags": [], + "label": "'x509.public_key_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve", + "type": "Object", + "tags": [], + "label": "'x509.public_key_curve'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_curve.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent", + "type": "Object", + "tags": [], + "label": "'x509.public_key_exponent'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.doc_values", + "type": "boolean", + "tags": [], + "label": "doc_values", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.index", + "type": "boolean", + "tags": [], + "label": "index", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_exponent.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size", + "type": "Object", + "tags": [], + "label": "'x509.public_key_size'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.public_key_size.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number", + "type": "Object", + "tags": [], + "label": "'x509.serial_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.serial_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm", + "type": "Object", + "tags": [], + "label": "'x509.signature_algorithm'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.signature_algorithm.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name", + "type": "Object", + "tags": [], + "label": "'x509.subject.common_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.common_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country", + "type": "Object", + "tags": [], + "label": "'x509.subject.country'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.country.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name", + "type": "Object", + "tags": [], + "label": "'x509.subject.distinguished_name'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.distinguished_name.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality", + "type": "Object", + "tags": [], + "label": "'x509.subject.locality'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.locality.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization", + "type": "Object", + "tags": [], + "label": "'x509.subject.organization'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organization.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit", + "type": "Object", + "tags": [], + "label": "'x509.subject.organizational_unit'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.organizational_unit.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province", + "type": "Object", + "tags": [], + "label": "'x509.subject.state_or_province'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.example", + "type": "string", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "string[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.subject.state_or_province.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number", + "type": "Object", + "tags": [], + "label": "'x509.version_number'", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.dashed_name", + "type": "string", + "tags": [], + "label": "dashed_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.description", + "type": "string", + "tags": [], + "label": "description", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.example", + "type": "number", + "tags": [], + "label": "example", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.flat_name", + "type": "string", + "tags": [], + "label": "flat_name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.ignore_above", + "type": "number", + "tags": [], + "label": "ignore_above", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.level", + "type": "string", + "tags": [], + "label": "level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.normalize", + "type": "Array", + "tags": [], + "label": "normalize", + "description": [], + "signature": [ + "never[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.fields.x509.version_number.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.group", + "type": "number", + "tags": [], + "label": "group", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.name", + "type": "string", + "tags": [], + "label": "name", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.prefix", + "type": "string", + "tags": [], + "label": "prefix", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.reusable", + "type": "Object", + "tags": [], + "label": "reusable", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false, + "children": [ + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.reusable.expected", + "type": "Array", + "tags": [], + "label": "expected", + "description": [], + "signature": [ + "{ as: string; at: string; full: string; }[]" + ], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.reusable.top_level", + "type": "boolean", + "tags": [], + "label": "top_level", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.short", + "type": "string", + "tags": [], + "label": "short", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.title", + "type": "string", + "tags": [], + "label": "title", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + }, + { + "parentPluginId": "@kbn/ecs", + "id": "def-common.EcsNested.x509.type", + "type": "string", + "tags": [], + "label": "type", + "description": [], + "path": "packages/kbn-ecs/generated/ecs_nested.ts", + "deprecated": false, + "trackAdoption": false + } + ] + } + ], "initialIsOpen": false } - ], - "objects": [] + ] } } \ No newline at end of file diff --git a/api_docs/kbn_ecs.mdx b/api_docs/kbn_ecs.mdx index bc85360a07509..02f6773b74b5c 100644 --- a/api_docs/kbn_ecs.mdx +++ b/api_docs/kbn_ecs.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ecs title: "@kbn/ecs" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ecs plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ecs'] --- import kbnEcsObj from './kbn_ecs.devdocs.json'; @@ -21,10 +21,16 @@ Contact Kibana Core for questions regarding this plugin. | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 5 | 0 | 4 | 37 | +| 35102 | 0 | 34695 | 0 | ## Common +### Objects + + +### Interfaces + + ### Consts, variables and types diff --git a/api_docs/kbn_es.mdx b/api_docs/kbn_es.mdx index 542f528a53230..e621d0a9aabb0 100644 --- a/api_docs/kbn_es.mdx +++ b/api_docs/kbn_es.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es title: "@kbn/es" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/es plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es'] --- import kbnEsObj from './kbn_es.devdocs.json'; diff --git a/api_docs/kbn_es_archiver.mdx b/api_docs/kbn_es_archiver.mdx index 190b8813a020e..760dd23ec446d 100644 --- a/api_docs/kbn_es_archiver.mdx +++ b/api_docs/kbn_es_archiver.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-archiver title: "@kbn/es-archiver" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/es-archiver plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-archiver'] --- import kbnEsArchiverObj from './kbn_es_archiver.devdocs.json'; diff --git a/api_docs/kbn_es_errors.mdx b/api_docs/kbn_es_errors.mdx index 32124a2f13116..549510cfa500c 100644 --- a/api_docs/kbn_es_errors.mdx +++ b/api_docs/kbn_es_errors.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-errors title: "@kbn/es-errors" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/es-errors plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-errors'] --- import kbnEsErrorsObj from './kbn_es_errors.devdocs.json'; diff --git a/api_docs/kbn_es_query.devdocs.json b/api_docs/kbn_es_query.devdocs.json index 73c14e298d98e..4804bbcd473dc 100644 --- a/api_docs/kbn_es_query.devdocs.json +++ b/api_docs/kbn_es_query.devdocs.json @@ -130,7 +130,7 @@ "section": "def-common.Filter", "text": "Filter" }, - "[], indexPattern: ", + "[], indexPattern: Pick<", { "pluginId": "@kbn/es-query", "scope": "common", @@ -138,7 +138,7 @@ "section": "def-common.DataViewBase", "text": "DataViewBase" }, - ", disabled: boolean | undefined, negate: boolean | undefined, alias: string | null | undefined, store: ", + ", \"id\">, disabled: boolean | undefined, negate: boolean | undefined, alias: string | null | undefined, store: ", { "pluginId": "@kbn/es-query", "scope": "common", @@ -214,13 +214,15 @@ "label": "indexPattern", "description": [], "signature": [ + "Pick<", { "pluginId": "@kbn/es-query", "scope": "common", "docId": "kibKbnEsQueryPluginApi", "section": "def-common.DataViewBase", "text": "DataViewBase" - } + }, + ", \"id\">" ], "path": "packages/kbn-es-query/src/filters/build_filters/combined_filter.ts", "deprecated": false, diff --git a/api_docs/kbn_es_query.mdx b/api_docs/kbn_es_query.mdx index af07f6922cfdd..7961299c1eeb4 100644 --- a/api_docs/kbn_es_query.mdx +++ b/api_docs/kbn_es_query.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-query title: "@kbn/es-query" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/es-query plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-query'] --- import kbnEsQueryObj from './kbn_es_query.devdocs.json'; diff --git a/api_docs/kbn_es_types.mdx b/api_docs/kbn_es_types.mdx index 0e677aa184ee9..e47a62a3b5120 100644 --- a/api_docs/kbn_es_types.mdx +++ b/api_docs/kbn_es_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-es-types title: "@kbn/es-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/es-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/es-types'] --- import kbnEsTypesObj from './kbn_es_types.devdocs.json'; diff --git a/api_docs/kbn_eslint_plugin_imports.mdx b/api_docs/kbn_eslint_plugin_imports.mdx index 63a54963656d9..38ce67c87ffe5 100644 --- a/api_docs/kbn_eslint_plugin_imports.mdx +++ b/api_docs/kbn_eslint_plugin_imports.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-eslint-plugin-imports title: "@kbn/eslint-plugin-imports" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/eslint-plugin-imports plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/eslint-plugin-imports'] --- import kbnEslintPluginImportsObj from './kbn_eslint_plugin_imports.devdocs.json'; diff --git a/api_docs/kbn_field_types.mdx b/api_docs/kbn_field_types.mdx index 1b2af2ce4b674..6f711ae409aaa 100644 --- a/api_docs/kbn_field_types.mdx +++ b/api_docs/kbn_field_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-field-types title: "@kbn/field-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/field-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/field-types'] --- import kbnFieldTypesObj from './kbn_field_types.devdocs.json'; diff --git a/api_docs/kbn_find_used_node_modules.mdx b/api_docs/kbn_find_used_node_modules.mdx index 1acead1d0bed9..669a8ce98c709 100644 --- a/api_docs/kbn_find_used_node_modules.mdx +++ b/api_docs/kbn_find_used_node_modules.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-find-used-node-modules title: "@kbn/find-used-node-modules" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/find-used-node-modules plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/find-used-node-modules'] --- import kbnFindUsedNodeModulesObj from './kbn_find_used_node_modules.devdocs.json'; diff --git a/api_docs/kbn_ftr_common_functional_services.mdx b/api_docs/kbn_ftr_common_functional_services.mdx index a098db47c7a5e..c7b01ea089b43 100644 --- a/api_docs/kbn_ftr_common_functional_services.mdx +++ b/api_docs/kbn_ftr_common_functional_services.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ftr-common-functional-services title: "@kbn/ftr-common-functional-services" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ftr-common-functional-services plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ftr-common-functional-services'] --- import kbnFtrCommonFunctionalServicesObj from './kbn_ftr_common_functional_services.devdocs.json'; diff --git a/api_docs/kbn_generate.mdx b/api_docs/kbn_generate.mdx index 9589093a62f46..cdf9dc8d1f0ae 100644 --- a/api_docs/kbn_generate.mdx +++ b/api_docs/kbn_generate.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-generate title: "@kbn/generate" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/generate plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/generate'] --- import kbnGenerateObj from './kbn_generate.devdocs.json'; diff --git a/api_docs/kbn_get_repo_files.mdx b/api_docs/kbn_get_repo_files.mdx index 26d4747e0858e..bad60deca80f3 100644 --- a/api_docs/kbn_get_repo_files.mdx +++ b/api_docs/kbn_get_repo_files.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-get-repo-files title: "@kbn/get-repo-files" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/get-repo-files plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/get-repo-files'] --- import kbnGetRepoFilesObj from './kbn_get_repo_files.devdocs.json'; diff --git a/api_docs/kbn_guided_onboarding.mdx b/api_docs/kbn_guided_onboarding.mdx index e65e2f4e5f693..e1af3bb3c213b 100644 --- a/api_docs/kbn_guided_onboarding.mdx +++ b/api_docs/kbn_guided_onboarding.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-guided-onboarding title: "@kbn/guided-onboarding" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/guided-onboarding plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/guided-onboarding'] --- import kbnGuidedOnboardingObj from './kbn_guided_onboarding.devdocs.json'; diff --git a/api_docs/kbn_handlebars.mdx b/api_docs/kbn_handlebars.mdx index 7456a0db34383..0375ba0a4fdb6 100644 --- a/api_docs/kbn_handlebars.mdx +++ b/api_docs/kbn_handlebars.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-handlebars title: "@kbn/handlebars" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/handlebars plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/handlebars'] --- import kbnHandlebarsObj from './kbn_handlebars.devdocs.json'; diff --git a/api_docs/kbn_hapi_mocks.mdx b/api_docs/kbn_hapi_mocks.mdx index 76968ee9d6cc3..7bea28ad597bd 100644 --- a/api_docs/kbn_hapi_mocks.mdx +++ b/api_docs/kbn_hapi_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-hapi-mocks title: "@kbn/hapi-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/hapi-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/hapi-mocks'] --- import kbnHapiMocksObj from './kbn_hapi_mocks.devdocs.json'; diff --git a/api_docs/kbn_health_gateway_server.mdx b/api_docs/kbn_health_gateway_server.mdx index 895abb37fcd6f..ab7c22f84a912 100644 --- a/api_docs/kbn_health_gateway_server.mdx +++ b/api_docs/kbn_health_gateway_server.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-health-gateway-server title: "@kbn/health-gateway-server" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/health-gateway-server plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/health-gateway-server'] --- import kbnHealthGatewayServerObj from './kbn_health_gateway_server.devdocs.json'; diff --git a/api_docs/kbn_home_sample_data_card.mdx b/api_docs/kbn_home_sample_data_card.mdx index 8cbb1bd05a1a1..060b716e8fbfc 100644 --- a/api_docs/kbn_home_sample_data_card.mdx +++ b/api_docs/kbn_home_sample_data_card.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-card title: "@kbn/home-sample-data-card" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/home-sample-data-card plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-card'] --- import kbnHomeSampleDataCardObj from './kbn_home_sample_data_card.devdocs.json'; diff --git a/api_docs/kbn_home_sample_data_tab.mdx b/api_docs/kbn_home_sample_data_tab.mdx index 9a1886dcacb91..74e3eb95ecf33 100644 --- a/api_docs/kbn_home_sample_data_tab.mdx +++ b/api_docs/kbn_home_sample_data_tab.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-home-sample-data-tab title: "@kbn/home-sample-data-tab" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/home-sample-data-tab plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/home-sample-data-tab'] --- import kbnHomeSampleDataTabObj from './kbn_home_sample_data_tab.devdocs.json'; diff --git a/api_docs/kbn_i18n.mdx b/api_docs/kbn_i18n.mdx index 792c3f0a66523..ce138de24a5ed 100644 --- a/api_docs/kbn_i18n.mdx +++ b/api_docs/kbn_i18n.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n title: "@kbn/i18n" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/i18n plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n'] --- import kbnI18nObj from './kbn_i18n.devdocs.json'; diff --git a/api_docs/kbn_i18n_react.mdx b/api_docs/kbn_i18n_react.mdx index 6989212d58b26..9931f64ac1eb8 100644 --- a/api_docs/kbn_i18n_react.mdx +++ b/api_docs/kbn_i18n_react.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-i18n-react title: "@kbn/i18n-react" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/i18n-react plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/i18n-react'] --- import kbnI18nReactObj from './kbn_i18n_react.devdocs.json'; diff --git a/api_docs/kbn_import_resolver.mdx b/api_docs/kbn_import_resolver.mdx index 2b1162e07c2fd..be7ecde1d6336 100644 --- a/api_docs/kbn_import_resolver.mdx +++ b/api_docs/kbn_import_resolver.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-import-resolver title: "@kbn/import-resolver" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/import-resolver plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/import-resolver'] --- import kbnImportResolverObj from './kbn_import_resolver.devdocs.json'; diff --git a/api_docs/kbn_interpreter.mdx b/api_docs/kbn_interpreter.mdx index 9ca750959b931..22ecf1de6e1c1 100644 --- a/api_docs/kbn_interpreter.mdx +++ b/api_docs/kbn_interpreter.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-interpreter title: "@kbn/interpreter" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/interpreter plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/interpreter'] --- import kbnInterpreterObj from './kbn_interpreter.devdocs.json'; diff --git a/api_docs/kbn_io_ts_utils.mdx b/api_docs/kbn_io_ts_utils.mdx index 4ae7018ec4280..08b761e7aa5dc 100644 --- a/api_docs/kbn_io_ts_utils.mdx +++ b/api_docs/kbn_io_ts_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-io-ts-utils title: "@kbn/io-ts-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/io-ts-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/io-ts-utils'] --- import kbnIoTsUtilsObj from './kbn_io_ts_utils.devdocs.json'; diff --git a/api_docs/kbn_jest_serializers.mdx b/api_docs/kbn_jest_serializers.mdx index 5a715cd188e76..2b5e7f7d208c4 100644 --- a/api_docs/kbn_jest_serializers.mdx +++ b/api_docs/kbn_jest_serializers.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-jest-serializers title: "@kbn/jest-serializers" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/jest-serializers plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/jest-serializers'] --- import kbnJestSerializersObj from './kbn_jest_serializers.devdocs.json'; diff --git a/api_docs/kbn_journeys.mdx b/api_docs/kbn_journeys.mdx index 26de7f7f4f750..9d107ff02d31d 100644 --- a/api_docs/kbn_journeys.mdx +++ b/api_docs/kbn_journeys.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-journeys title: "@kbn/journeys" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/journeys plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/journeys'] --- import kbnJourneysObj from './kbn_journeys.devdocs.json'; diff --git a/api_docs/kbn_json_ast.mdx b/api_docs/kbn_json_ast.mdx index fe2837ad2ed80..adf5e173eccb5 100644 --- a/api_docs/kbn_json_ast.mdx +++ b/api_docs/kbn_json_ast.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-json-ast title: "@kbn/json-ast" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/json-ast plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/json-ast'] --- import kbnJsonAstObj from './kbn_json_ast.devdocs.json'; diff --git a/api_docs/kbn_kibana_manifest_schema.mdx b/api_docs/kbn_kibana_manifest_schema.mdx index b9927c269d964..a786e4ce9706e 100644 --- a/api_docs/kbn_kibana_manifest_schema.mdx +++ b/api_docs/kbn_kibana_manifest_schema.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-kibana-manifest-schema title: "@kbn/kibana-manifest-schema" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/kibana-manifest-schema plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/kibana-manifest-schema'] --- import kbnKibanaManifestSchemaObj from './kbn_kibana_manifest_schema.devdocs.json'; diff --git a/api_docs/kbn_language_documentation_popover.mdx b/api_docs/kbn_language_documentation_popover.mdx index 7347d9af32135..b5c8f2642f8af 100644 --- a/api_docs/kbn_language_documentation_popover.mdx +++ b/api_docs/kbn_language_documentation_popover.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-language-documentation-popover title: "@kbn/language-documentation-popover" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/language-documentation-popover plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/language-documentation-popover'] --- import kbnLanguageDocumentationPopoverObj from './kbn_language_documentation_popover.devdocs.json'; diff --git a/api_docs/kbn_logging.devdocs.json b/api_docs/kbn_logging.devdocs.json index be9bd1e3e2960..14c85f50a07a6 100644 --- a/api_docs/kbn_logging.devdocs.json +++ b/api_docs/kbn_logging.devdocs.json @@ -602,71 +602,269 @@ ], "signature": [ "Omit<", - "EcsBase", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsBase", + "text": "EcsBase" + }, ", \"message\" | \"@timestamp\"> & ", - "EcsTracing", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTracing", + "text": "EcsTracing" + }, " & { agent?: ", - "EcsAgent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsAgent", + "text": "EcsAgent" + }, " | undefined; as?: ", - "EcsAutonomousSystem", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsAs", + "text": "EcsAs" + }, " | undefined; client?: ", - "EcsClient", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsClient", + "text": "EcsClient" + }, " | undefined; cloud?: ", - "EcsCloud", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsCloud", + "text": "EcsCloud" + }, " | undefined; container?: ", - "EcsContainer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsContainer", + "text": "EcsContainer" + }, " | undefined; destination?: ", - "EcsDestination", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDestination", + "text": "EcsDestination" + }, " | undefined; dns?: ", - "EcsDns", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsDns", + "text": "EcsDns" + }, " | undefined; error?: ", - "EcsError", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsError", + "text": "EcsError" + }, " | undefined; event?: ", - "EcsEvent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsEvent", + "text": "EcsEvent" + }, " | undefined; file?: ", - "EcsFile", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsFile", + "text": "EcsFile" + }, " | undefined; group?: ", - "EcsGroup", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsGroup", + "text": "EcsGroup" + }, " | undefined; host?: ", - "EcsHost", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHost", + "text": "EcsHost" + }, " | undefined; http?: ", - "EcsHttp", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHttp", + "text": "EcsHttp" + }, " | undefined; log?: Omit<", - "EcsLog", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsLog", + "text": "EcsLog" + }, ", \"logger\" | \"level\"> | undefined; network?: ", - "EcsNetwork", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsNetwork", + "text": "EcsNetwork" + }, " | undefined; observer?: ", - "EcsObserver", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsObserver", + "text": "EcsObserver" + }, " | undefined; organization?: ", - "EcsOrganization", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsOrganization", + "text": "EcsOrganization" + }, " | undefined; package?: ", - "EcsPackage", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsPackage", + "text": "EcsPackage" + }, " | undefined; process?: ", - "EcsProcess", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsProcess", + "text": "EcsProcess" + }, " | undefined; registry?: ", - "EcsRegistry", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRegistry", + "text": "EcsRegistry" + }, " | undefined; related?: ", - "EcsRelated", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRelated", + "text": "EcsRelated" + }, " | undefined; rule?: ", - "EcsRule", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsRule", + "text": "EcsRule" + }, " | undefined; server?: ", - "EcsServer", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsServer", + "text": "EcsServer" + }, " | undefined; service?: ", - "EcsService", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsService", + "text": "EcsService" + }, " | undefined; source?: ", - "EcsSource", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsSource", + "text": "EcsSource" + }, " | undefined; threat?: ", - "EcsThreat", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsThreat", + "text": "EcsThreat" + }, " | undefined; tls?: ", - "EcsTls", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsTls", + "text": "EcsTls" + }, " | undefined; url?: ", - "EcsUrl", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUrl", + "text": "EcsUrl" + }, " | undefined; user?: ", - "EcsUser", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUser", + "text": "EcsUser" + }, " | undefined; user_agent?: ", - "EcsUserAgent", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsUserAgent", + "text": "EcsUserAgent" + }, " | undefined; vulnerability?: ", - "EcsVulnerability", + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsVulnerability", + "text": "EcsVulnerability" + }, " | undefined; }" ], "path": "packages/kbn-logging/src/log_meta.ts", diff --git a/api_docs/kbn_logging.mdx b/api_docs/kbn_logging.mdx index 2355da9366676..a556687779802 100644 --- a/api_docs/kbn_logging.mdx +++ b/api_docs/kbn_logging.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging title: "@kbn/logging" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/logging plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging'] --- import kbnLoggingObj from './kbn_logging.devdocs.json'; diff --git a/api_docs/kbn_logging_mocks.mdx b/api_docs/kbn_logging_mocks.mdx index 70fe8fa26e766..a29d909443a6c 100644 --- a/api_docs/kbn_logging_mocks.mdx +++ b/api_docs/kbn_logging_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-logging-mocks title: "@kbn/logging-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/logging-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/logging-mocks'] --- import kbnLoggingMocksObj from './kbn_logging_mocks.devdocs.json'; diff --git a/api_docs/kbn_managed_vscode_config.mdx b/api_docs/kbn_managed_vscode_config.mdx index 149d817b26211..21de575699904 100644 --- a/api_docs/kbn_managed_vscode_config.mdx +++ b/api_docs/kbn_managed_vscode_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-managed-vscode-config title: "@kbn/managed-vscode-config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/managed-vscode-config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/managed-vscode-config'] --- import kbnManagedVscodeConfigObj from './kbn_managed_vscode_config.devdocs.json'; diff --git a/api_docs/kbn_mapbox_gl.mdx b/api_docs/kbn_mapbox_gl.mdx index 296a61a6da707..6540ad99343cf 100644 --- a/api_docs/kbn_mapbox_gl.mdx +++ b/api_docs/kbn_mapbox_gl.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-mapbox-gl title: "@kbn/mapbox-gl" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/mapbox-gl plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/mapbox-gl'] --- import kbnMapboxGlObj from './kbn_mapbox_gl.devdocs.json'; diff --git a/api_docs/kbn_ml_agg_utils.mdx b/api_docs/kbn_ml_agg_utils.mdx index 8951742444a08..0c69749c0b104 100644 --- a/api_docs/kbn_ml_agg_utils.mdx +++ b/api_docs/kbn_ml_agg_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-agg-utils title: "@kbn/ml-agg-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-agg-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-agg-utils'] --- import kbnMlAggUtilsObj from './kbn_ml_agg_utils.devdocs.json'; diff --git a/api_docs/kbn_ml_date_picker.mdx b/api_docs/kbn_ml_date_picker.mdx index f6a00f1901bc0..f40a9727bd5f3 100644 --- a/api_docs/kbn_ml_date_picker.mdx +++ b/api_docs/kbn_ml_date_picker.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-date-picker title: "@kbn/ml-date-picker" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-date-picker plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-date-picker'] --- import kbnMlDatePickerObj from './kbn_ml_date_picker.devdocs.json'; diff --git a/api_docs/kbn_ml_is_defined.mdx b/api_docs/kbn_ml_is_defined.mdx index 1923c9ad41140..f95143253bc47 100644 --- a/api_docs/kbn_ml_is_defined.mdx +++ b/api_docs/kbn_ml_is_defined.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-defined title: "@kbn/ml-is-defined" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-is-defined plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-defined'] --- import kbnMlIsDefinedObj from './kbn_ml_is_defined.devdocs.json'; diff --git a/api_docs/kbn_ml_is_populated_object.mdx b/api_docs/kbn_ml_is_populated_object.mdx index 4de14def9d2b6..d47a9c3f0044f 100644 --- a/api_docs/kbn_ml_is_populated_object.mdx +++ b/api_docs/kbn_ml_is_populated_object.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-is-populated-object title: "@kbn/ml-is-populated-object" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-is-populated-object plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-is-populated-object'] --- import kbnMlIsPopulatedObjectObj from './kbn_ml_is_populated_object.devdocs.json'; diff --git a/api_docs/kbn_ml_local_storage.mdx b/api_docs/kbn_ml_local_storage.mdx index b50aca3102461..20b060cf4026e 100644 --- a/api_docs/kbn_ml_local_storage.mdx +++ b/api_docs/kbn_ml_local_storage.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-local-storage title: "@kbn/ml-local-storage" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-local-storage plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-local-storage'] --- import kbnMlLocalStorageObj from './kbn_ml_local_storage.devdocs.json'; diff --git a/api_docs/kbn_ml_nested_property.mdx b/api_docs/kbn_ml_nested_property.mdx index 1d69c3f1900d9..799f3e1bcbf33 100644 --- a/api_docs/kbn_ml_nested_property.mdx +++ b/api_docs/kbn_ml_nested_property.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-nested-property title: "@kbn/ml-nested-property" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-nested-property plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-nested-property'] --- import kbnMlNestedPropertyObj from './kbn_ml_nested_property.devdocs.json'; diff --git a/api_docs/kbn_ml_query_utils.mdx b/api_docs/kbn_ml_query_utils.mdx index ca77d5dc51720..deb09538e85a7 100644 --- a/api_docs/kbn_ml_query_utils.mdx +++ b/api_docs/kbn_ml_query_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-query-utils title: "@kbn/ml-query-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-query-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-query-utils'] --- import kbnMlQueryUtilsObj from './kbn_ml_query_utils.devdocs.json'; diff --git a/api_docs/kbn_ml_string_hash.mdx b/api_docs/kbn_ml_string_hash.mdx index 5191d4d7b5150..9a81bdb1d9768 100644 --- a/api_docs/kbn_ml_string_hash.mdx +++ b/api_docs/kbn_ml_string_hash.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-string-hash title: "@kbn/ml-string-hash" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-string-hash plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-string-hash'] --- import kbnMlStringHashObj from './kbn_ml_string_hash.devdocs.json'; diff --git a/api_docs/kbn_ml_url_state.mdx b/api_docs/kbn_ml_url_state.mdx index a9afe8b59649b..9cdd150fd6071 100644 --- a/api_docs/kbn_ml_url_state.mdx +++ b/api_docs/kbn_ml_url_state.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ml-url-state title: "@kbn/ml-url-state" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ml-url-state plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ml-url-state'] --- import kbnMlUrlStateObj from './kbn_ml_url_state.devdocs.json'; diff --git a/api_docs/kbn_monaco.mdx b/api_docs/kbn_monaco.mdx index b8dbaae5df26e..212c3c79fd9b4 100644 --- a/api_docs/kbn_monaco.mdx +++ b/api_docs/kbn_monaco.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-monaco title: "@kbn/monaco" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/monaco plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/monaco'] --- import kbnMonacoObj from './kbn_monaco.devdocs.json'; diff --git a/api_docs/kbn_optimizer.mdx b/api_docs/kbn_optimizer.mdx index 90dbc29c587e2..6bf01bb5983cc 100644 --- a/api_docs/kbn_optimizer.mdx +++ b/api_docs/kbn_optimizer.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer title: "@kbn/optimizer" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/optimizer plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer'] --- import kbnOptimizerObj from './kbn_optimizer.devdocs.json'; diff --git a/api_docs/kbn_optimizer_webpack_helpers.mdx b/api_docs/kbn_optimizer_webpack_helpers.mdx index e6d4d69a71021..fa735002c9090 100644 --- a/api_docs/kbn_optimizer_webpack_helpers.mdx +++ b/api_docs/kbn_optimizer_webpack_helpers.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-optimizer-webpack-helpers title: "@kbn/optimizer-webpack-helpers" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/optimizer-webpack-helpers plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/optimizer-webpack-helpers'] --- import kbnOptimizerWebpackHelpersObj from './kbn_optimizer_webpack_helpers.devdocs.json'; diff --git a/api_docs/kbn_osquery_io_ts_types.mdx b/api_docs/kbn_osquery_io_ts_types.mdx index 23d7624d1f48a..5ffc00c18abf0 100644 --- a/api_docs/kbn_osquery_io_ts_types.mdx +++ b/api_docs/kbn_osquery_io_ts_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-osquery-io-ts-types title: "@kbn/osquery-io-ts-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/osquery-io-ts-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/osquery-io-ts-types'] --- import kbnOsqueryIoTsTypesObj from './kbn_osquery_io_ts_types.devdocs.json'; diff --git a/api_docs/kbn_performance_testing_dataset_extractor.mdx b/api_docs/kbn_performance_testing_dataset_extractor.mdx index 332e40a829133..0b241654fae68 100644 --- a/api_docs/kbn_performance_testing_dataset_extractor.mdx +++ b/api_docs/kbn_performance_testing_dataset_extractor.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-performance-testing-dataset-extractor title: "@kbn/performance-testing-dataset-extractor" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/performance-testing-dataset-extractor plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/performance-testing-dataset-extractor'] --- import kbnPerformanceTestingDatasetExtractorObj from './kbn_performance_testing_dataset_extractor.devdocs.json'; diff --git a/api_docs/kbn_plugin_generator.mdx b/api_docs/kbn_plugin_generator.mdx index 002aed65bfa35..dd934a8bce55a 100644 --- a/api_docs/kbn_plugin_generator.mdx +++ b/api_docs/kbn_plugin_generator.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-generator title: "@kbn/plugin-generator" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/plugin-generator plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-generator'] --- import kbnPluginGeneratorObj from './kbn_plugin_generator.devdocs.json'; diff --git a/api_docs/kbn_plugin_helpers.mdx b/api_docs/kbn_plugin_helpers.mdx index 5aed9e74a7398..3cf325cfcfa79 100644 --- a/api_docs/kbn_plugin_helpers.mdx +++ b/api_docs/kbn_plugin_helpers.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-plugin-helpers title: "@kbn/plugin-helpers" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/plugin-helpers plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/plugin-helpers'] --- import kbnPluginHelpersObj from './kbn_plugin_helpers.devdocs.json'; diff --git a/api_docs/kbn_react_field.mdx b/api_docs/kbn_react_field.mdx index 1c77865d1c656..fe8f9282ee0a2 100644 --- a/api_docs/kbn_react_field.mdx +++ b/api_docs/kbn_react_field.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-react-field title: "@kbn/react-field" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/react-field plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/react-field'] --- import kbnReactFieldObj from './kbn_react_field.devdocs.json'; diff --git a/api_docs/kbn_repo_file_maps.mdx b/api_docs/kbn_repo_file_maps.mdx index f9a9cbe4987e3..f7cd105405058 100644 --- a/api_docs/kbn_repo_file_maps.mdx +++ b/api_docs/kbn_repo_file_maps.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-file-maps title: "@kbn/repo-file-maps" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/repo-file-maps plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-file-maps'] --- import kbnRepoFileMapsObj from './kbn_repo_file_maps.devdocs.json'; diff --git a/api_docs/kbn_repo_linter.mdx b/api_docs/kbn_repo_linter.mdx index d5d1710941535..ba026999371e3 100644 --- a/api_docs/kbn_repo_linter.mdx +++ b/api_docs/kbn_repo_linter.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-linter title: "@kbn/repo-linter" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/repo-linter plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-linter'] --- import kbnRepoLinterObj from './kbn_repo_linter.devdocs.json'; diff --git a/api_docs/kbn_repo_path.mdx b/api_docs/kbn_repo_path.mdx index d199e4de53700..f4047c896451a 100644 --- a/api_docs/kbn_repo_path.mdx +++ b/api_docs/kbn_repo_path.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-path title: "@kbn/repo-path" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/repo-path plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-path'] --- import kbnRepoPathObj from './kbn_repo_path.devdocs.json'; diff --git a/api_docs/kbn_repo_source_classifier.mdx b/api_docs/kbn_repo_source_classifier.mdx index b85beabfbdbc4..41aaf835c01e3 100644 --- a/api_docs/kbn_repo_source_classifier.mdx +++ b/api_docs/kbn_repo_source_classifier.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-repo-source-classifier title: "@kbn/repo-source-classifier" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/repo-source-classifier plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/repo-source-classifier'] --- import kbnRepoSourceClassifierObj from './kbn_repo_source_classifier.devdocs.json'; diff --git a/api_docs/kbn_rison.mdx b/api_docs/kbn_rison.mdx index 4a63f6dd0ab83..481d1c0a8e624 100644 --- a/api_docs/kbn_rison.mdx +++ b/api_docs/kbn_rison.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rison title: "@kbn/rison" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/rison plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rison'] --- import kbnRisonObj from './kbn_rison.devdocs.json'; diff --git a/api_docs/kbn_rule_data_utils.mdx b/api_docs/kbn_rule_data_utils.mdx index 35eedd5ca226c..a7d1405f7a572 100644 --- a/api_docs/kbn_rule_data_utils.mdx +++ b/api_docs/kbn_rule_data_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-rule-data-utils title: "@kbn/rule-data-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/rule-data-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/rule-data-utils'] --- import kbnRuleDataUtilsObj from './kbn_rule_data_utils.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_autocomplete.devdocs.json b/api_docs/kbn_securitysolution_autocomplete.devdocs.json index 365830c784ff3..5f57ad28f5f73 100644 --- a/api_docs/kbn_securitysolution_autocomplete.devdocs.json +++ b/api_docs/kbn_securitysolution_autocomplete.devdocs.json @@ -842,7 +842,7 @@ "label": "smallLists", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]" ], "path": "packages/kbn-securitysolution-autocomplete/src/field_value_lists/index.tsx", "deprecated": false, @@ -856,7 +856,7 @@ "label": "largeLists", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]" ], "path": "packages/kbn-securitysolution-autocomplete/src/field_value_lists/index.tsx", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_autocomplete.mdx b/api_docs/kbn_securitysolution_autocomplete.mdx index 09d54bc51541a..211114ef2f047 100644 --- a/api_docs/kbn_securitysolution_autocomplete.mdx +++ b/api_docs/kbn_securitysolution_autocomplete.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-autocomplete title: "@kbn/securitysolution-autocomplete" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-autocomplete plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-autocomplete'] --- import kbnSecuritysolutionAutocompleteObj from './kbn_securitysolution_autocomplete.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_ecs.mdx b/api_docs/kbn_securitysolution_ecs.mdx index 60ef1c3351db5..c5eb5a10cd34e 100644 --- a/api_docs/kbn_securitysolution_ecs.mdx +++ b/api_docs/kbn_securitysolution_ecs.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-ecs title: "@kbn/securitysolution-ecs" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-ecs plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-ecs'] --- import kbnSecuritysolutionEcsObj from './kbn_securitysolution_ecs.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_es_utils.mdx b/api_docs/kbn_securitysolution_es_utils.mdx index 3477818b17c91..743f7bbfeefa3 100644 --- a/api_docs/kbn_securitysolution_es_utils.mdx +++ b/api_docs/kbn_securitysolution_es_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-es-utils title: "@kbn/securitysolution-es-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-es-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-es-utils'] --- import kbnSecuritysolutionEsUtilsObj from './kbn_securitysolution_es_utils.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_exception_list_components.devdocs.json b/api_docs/kbn_securitysolution_exception_list_components.devdocs.json index 3c97016f1c1c4..c798c33780ef8 100644 --- a/api_docs/kbn_securitysolution_exception_list_components.devdocs.json +++ b/api_docs/kbn_securitysolution_exception_list_components.devdocs.json @@ -721,7 +721,7 @@ "label": "item", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/header/index.tsx", "deprecated": false, @@ -788,7 +788,7 @@ "label": "item", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/meta/index.tsx", "deprecated": false, @@ -904,7 +904,7 @@ "label": "exceptionItem", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx", "deprecated": false, @@ -1095,7 +1095,7 @@ "label": "onEditException", "description": [], "signature": [ - "(item: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void" + "(item: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void" ], "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx", "deprecated": false, @@ -1109,7 +1109,7 @@ "label": "item", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-exception-list-components/src/exception_item_card/exception_item_card.tsx", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_exception_list_components.mdx b/api_docs/kbn_securitysolution_exception_list_components.mdx index c0c4dd5b9cd8c..ab0d69769b255 100644 --- a/api_docs/kbn_securitysolution_exception_list_components.mdx +++ b/api_docs/kbn_securitysolution_exception_list_components.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-exception-list-components title: "@kbn/securitysolution-exception-list-components" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-exception-list-components plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-exception-list-components'] --- import kbnSecuritysolutionExceptionListComponentsObj from './kbn_securitysolution_exception_list_components.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_hook_utils.mdx b/api_docs/kbn_securitysolution_hook_utils.mdx index 7606fb0f3c2e0..62625a84d4aba 100644 --- a/api_docs/kbn_securitysolution_hook_utils.mdx +++ b/api_docs/kbn_securitysolution_hook_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-hook-utils title: "@kbn/securitysolution-hook-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-hook-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-hook-utils'] --- import kbnSecuritysolutionHookUtilsObj from './kbn_securitysolution_hook_utils.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx index 1f6cb59abe6ab..b593be9ec63ce 100644 --- a/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx +++ b/api_docs/kbn_securitysolution_io_ts_alerting_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-alerting-types title: "@kbn/securitysolution-io-ts-alerting-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-io-ts-alerting-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-alerting-types'] --- import kbnSecuritysolutionIoTsAlertingTypesObj from './kbn_securitysolution_io_ts_alerting_types.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json b/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json index f54dfcd7e0da2..9bcbaf8108ab8 100644 --- a/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json +++ b/api_docs/kbn_securitysolution_io_ts_list_types.devdocs.json @@ -27,7 +27,7 @@ "label": "updateExceptionListItemValidate", "description": [], "signature": [ - "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" + "(schema: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -41,7 +41,7 @@ "label": "schema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -60,7 +60,7 @@ "label": "validateComments", "description": [], "signature": [ - "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" + "(item: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => string[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -74,7 +74,7 @@ "label": "item", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_validation/index.ts", "deprecated": false, @@ -162,7 +162,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false, @@ -718,7 +718,7 @@ "label": "exceptions", "description": [], "signature": [ - "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" + "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false, @@ -1589,7 +1589,7 @@ "label": "exceptions", "description": [], "signature": [ - "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" + "({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false, @@ -1847,7 +1847,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false, @@ -1945,7 +1945,7 @@ "label": "exceptions", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/typescript_types/index.ts", "deprecated": false, @@ -2617,7 +2617,7 @@ "label": "CreateEndpointListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"included\"; type: \"wildcard\"; value: string; } | { entries: ({ field: string; operator: \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"included\"; type: \"match_any\"; value: string[]; })[]; field: string; type: \"nested\"; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"os_types\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_endpoint_list_item_schema/index.ts", "deprecated": false, @@ -2647,7 +2647,7 @@ "label": "CreateExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts", "deprecated": false, @@ -2662,7 +2662,7 @@ "label": "CreateExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_exception_list_item_schema/index.ts", "deprecated": false, @@ -2737,7 +2737,7 @@ "label": "CreateListSchema", "description": [], "signature": [ - "{ description: string; name: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; } & { deserializer?: string | undefined; id?: string | undefined; meta?: object | undefined; serializer?: string | undefined; version?: number | undefined; }" + "{ description: string; name: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; } & { deserializer?: string | undefined; id?: string | undefined; meta?: object | undefined; serializer?: string | undefined; version?: number | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_list_schema/index.ts", "deprecated": false, @@ -2752,7 +2752,7 @@ "label": "CreateListSchemaDecoded", "description": [], "signature": [ - "{ name: string; description: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; id: string | undefined; meta: object | undefined; serializer: string | undefined; deserializer: string | undefined; } & { version: number; }" + "{ name: string; description: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; id: string | undefined; meta: object | undefined; serializer: string | undefined; deserializer: string | undefined; } & { version: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_list_schema/index.ts", "deprecated": false, @@ -2767,7 +2767,7 @@ "label": "CreateRuleExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts", "deprecated": false, @@ -2782,7 +2782,7 @@ "label": "CreateRuleExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; list_id: undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; comments: { comment: string; }[] | undefined; item_id: string | undefined; list_id: undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: { comment: string; }[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/create_rule_exception_item_schema/index.ts", "deprecated": false, @@ -3097,7 +3097,7 @@ "label": "EntriesArray", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts", "deprecated": false, @@ -3112,7 +3112,7 @@ "label": "EntriesArrayOrUndefined", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[] | undefined" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[] | undefined" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts", "deprecated": false, @@ -3127,7 +3127,7 @@ "label": "Entry", "description": [], "signature": [ - "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }" + "{ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries/index.ts", "deprecated": false, @@ -3157,7 +3157,7 @@ "label": "EntryList", "description": [], "signature": [ - "{ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }" + "{ field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/entries_list/index.ts", "deprecated": false, @@ -3247,7 +3247,7 @@ "label": "ExceptionListItemSchema", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/exception_list_item_schema/index.ts", "deprecated": false, @@ -3592,7 +3592,7 @@ "label": "FoundAllListItemsSchema", "description": [], "signature": [ - "{ data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; total: number; }" + "{ data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; total: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_all_list_items_schema/index.ts", "deprecated": false, @@ -3607,7 +3607,7 @@ "label": "FoundExceptionListItemSchema", "description": [], "signature": [ - "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }" + "{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_exception_list_item_schema/index.ts", "deprecated": false, @@ -3637,7 +3637,7 @@ "label": "FoundListItemSchema", "description": [], "signature": [ - "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; }" + "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_list_item_schema/index.ts", "deprecated": false, @@ -3652,7 +3652,7 @@ "label": "FoundListsBySizeSchema", "description": [], "signature": [ - "{ largeLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; smallLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; }" + "{ largeLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; smallLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_lists_by_size_schema/index.ts", "deprecated": false, @@ -3667,7 +3667,7 @@ "label": "FoundListSchema", "description": [], "signature": [ - "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }" + "{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/found_list_schema/index.ts", "deprecated": false, @@ -3682,7 +3682,7 @@ "label": "GetExceptionFilterSchema", "description": [], "signature": [ - "({ exception_list_ids: { exception_list_id: string; namespace_type: \"single\" | \"agnostic\"; }[]; type: \"exception_list_ids\"; } | { exceptions: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; type: \"exception_items\"; }) & { alias?: string | undefined; chunk_size?: number | undefined; exclude_exceptions?: boolean | undefined; }" + "({ exception_list_ids: { exception_list_id: string; namespace_type: \"single\" | \"agnostic\"; }[]; type: \"exception_list_ids\"; } | { exceptions: ({ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }))[]; type: \"exception_items\"; }) & { alias?: string | undefined; chunk_size?: number | undefined; exclude_exceptions?: boolean | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/get_exception_filter_schema/index.ts", "deprecated": false, @@ -3802,7 +3802,7 @@ "label": "ImportExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts", "deprecated": false, @@ -3817,7 +3817,7 @@ "label": "ImportExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; item_id: string; list_id: string; name: string; type: \"simple\"; } & { id?: string | undefined; comments?: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[] | undefined; created_at?: string | undefined; updated_at?: string | undefined; created_by?: string | undefined; updated_by?: string | undefined; _version?: string | undefined; tie_breaker_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"item_id\" | \"namespace_type\"> & { comments: (({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; }) | { comment: string; })[]; tags: string[]; item_id: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_exception_item_schema/index.ts", "deprecated": false, @@ -3877,7 +3877,7 @@ "label": "ImportListItemQuerySchema", "description": [], "signature": [ - "{ deserializer: string | undefined; list_id: string | undefined; serializer: string | undefined; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined; }" + "{ deserializer: string | undefined; list_id: string | undefined; serializer: string | undefined; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_list_item_query_schema/index.ts", "deprecated": false, @@ -3892,7 +3892,7 @@ "label": "ImportListItemQuerySchemaEncoded", "description": [], "signature": [ - "{ deserializer?: string | undefined; list_id?: string | undefined; serializer?: string | undefined; type?: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined; }" + "{ deserializer?: string | undefined; list_id?: string | undefined; serializer?: string | undefined; type?: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/import_list_item_query_schema/index.ts", "deprecated": false, @@ -4042,7 +4042,7 @@ "label": "ListArraySchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_schema/index.ts", "deprecated": false, @@ -4087,7 +4087,7 @@ "label": "ListItemArraySchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]" + "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_item_schema/index.ts", "deprecated": false, @@ -4117,7 +4117,7 @@ "label": "ListItemSchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }" + "{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_item_schema/index.ts", "deprecated": false, @@ -4147,7 +4147,7 @@ "label": "ListSchema", "description": [], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/list_schema/index.ts", "deprecated": false, @@ -4372,7 +4372,7 @@ "label": "NonEmptyEntriesArray", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts", "deprecated": false, @@ -4387,7 +4387,7 @@ "label": "NonEmptyEntriesArrayDecoded", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts", "deprecated": false, @@ -4822,7 +4822,7 @@ "label": "SearchListItemArraySchema", "description": [], "signature": [ - "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]" + "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/search_list_item_schema/index.ts", "deprecated": false, @@ -4837,7 +4837,7 @@ "label": "SearchListItemSchema", "description": [], "signature": [ - "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }" + "{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/response/search_list_item_schema/index.ts", "deprecated": false, @@ -5002,7 +5002,7 @@ "label": "Type", "description": [], "signature": [ - "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"" + "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/type/index.ts", "deprecated": false, @@ -5017,7 +5017,7 @@ "label": "TypeOrUndefined", "description": [], "signature": [ - "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined" + "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/type/index.ts", "deprecated": false, @@ -5077,7 +5077,7 @@ "label": "UpdateEndpointListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts", "deprecated": false, @@ -5092,7 +5092,7 @@ "label": "UpdateEndpointListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_endpoint_list_item_schema/index.ts", "deprecated": false, @@ -5107,7 +5107,7 @@ "label": "UpdateExceptionListItemSchema", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts", "deprecated": false, @@ -5122,7 +5122,7 @@ "label": "UpdateExceptionListItemSchemaDecoded", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"namespace_type\" | \"os_types\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; _version: string | undefined; comments: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id: string | undefined; item_id: string | undefined; meta: object | undefined; namespace_type: \"single\" | \"agnostic\" | undefined; os_types: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags: string[] | undefined; }, \"tags\" | \"entries\" | \"comments\" | \"namespace_type\" | \"os_types\"> & { comments: ({ comment: string; } & { id?: string | undefined; })[]; tags: string[]; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; }" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/request/update_exception_list_item_schema/index.ts", "deprecated": false, @@ -5677,7 +5677,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; list_id: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; list_id: ", "Type", "; name: ", "StringC", @@ -5845,7 +5845,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; name: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; name: ", "StringC", "; type: ", "KeyofC", @@ -7252,7 +7252,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; list_id: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; list_id: ", "Type", "; name: ", "StringC", @@ -8521,7 +8521,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; list_id: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; list_id: ", "Type", "; name: ", "StringC", @@ -8808,7 +8808,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; item_id: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; item_id: ", "Type", "; list_id: ", "Type", @@ -9848,7 +9848,7 @@ ], "signature": [ "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>" + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>" ], "path": "packages/kbn-securitysolution-io-ts-list-types/src/common/non_empty_entries_array/index.ts", "deprecated": false, @@ -10858,7 +10858,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; name: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; name: ", "StringC", "; type: ", "KeyofC", @@ -10912,7 +10912,7 @@ "StringC", "; entries: ", "Type", - "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; name: ", + "<({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[], unknown>; name: ", "StringC", "; type: ", "KeyofC", diff --git a/api_docs/kbn_securitysolution_io_ts_list_types.mdx b/api_docs/kbn_securitysolution_io_ts_list_types.mdx index 471bb7daf7382..4bb4f771143a1 100644 --- a/api_docs/kbn_securitysolution_io_ts_list_types.mdx +++ b/api_docs/kbn_securitysolution_io_ts_list_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-list-types title: "@kbn/securitysolution-io-ts-list-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-io-ts-list-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-list-types'] --- import kbnSecuritysolutionIoTsListTypesObj from './kbn_securitysolution_io_ts_list_types.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_io_ts_types.mdx b/api_docs/kbn_securitysolution_io_ts_types.mdx index bfbed76e3e700..eea716f61c6b1 100644 --- a/api_docs/kbn_securitysolution_io_ts_types.mdx +++ b/api_docs/kbn_securitysolution_io_ts_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-types title: "@kbn/securitysolution-io-ts-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-io-ts-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-types'] --- import kbnSecuritysolutionIoTsTypesObj from './kbn_securitysolution_io_ts_types.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_io_ts_utils.mdx b/api_docs/kbn_securitysolution_io_ts_utils.mdx index 726137c40d6e3..8f9b39ec47738 100644 --- a/api_docs/kbn_securitysolution_io_ts_utils.mdx +++ b/api_docs/kbn_securitysolution_io_ts_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-io-ts-utils title: "@kbn/securitysolution-io-ts-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-io-ts-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-io-ts-utils'] --- import kbnSecuritysolutionIoTsUtilsObj from './kbn_securitysolution_io_ts_utils.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_list_api.devdocs.json b/api_docs/kbn_securitysolution_list_api.devdocs.json index 44699631fbffc..cd8334e742dda 100644 --- a/api_docs/kbn_securitysolution_list_api.devdocs.json +++ b/api_docs/kbn_securitysolution_list_api.devdocs.json @@ -82,7 +82,7 @@ "section": "def-common.AddExceptionListItemProps", "text": "AddExceptionListItemProps" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -270,7 +270,7 @@ "section": "def-common.ApiCallByIdProps", "text": "ApiCallByIdProps" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -317,7 +317,7 @@ "section": "def-common.DeleteListParams", "text": "DeleteListParams" }, - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -509,7 +509,7 @@ "section": "def-common.ApiCallByIdProps", "text": "ApiCallByIdProps" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -556,7 +556,7 @@ "section": "def-common.ApiCallByListIdProps", "text": "ApiCallByListIdProps" }, - ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }>" + ") => Promise<{ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -650,7 +650,7 @@ "section": "def-common.FindListsParams", "text": "FindListsParams" }, - ") => Promise<{ largeLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; smallLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; }>" + ") => Promise<{ largeLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; smallLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -697,7 +697,7 @@ "section": "def-common.FindListsParams", "text": "FindListsParams" }, - ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" + ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -862,7 +862,7 @@ "section": "def-common.ImportListParams", "text": "ImportListParams" }, - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/index.ts", "deprecated": false, @@ -1072,7 +1072,7 @@ "section": "def-common.UpdateExceptionListItemProps", "text": "UpdateExceptionListItemProps" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-api/src/api/index.ts", "deprecated": false, @@ -1471,7 +1471,7 @@ "label": "type", "description": [], "signature": [ - "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined" + "\"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\" | undefined" ], "path": "packages/kbn-securitysolution-list-api/src/list_api/types.ts", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_list_api.mdx b/api_docs/kbn_securitysolution_list_api.mdx index b682cf1dcda62..041fe4b180d0e 100644 --- a/api_docs/kbn_securitysolution_list_api.mdx +++ b/api_docs/kbn_securitysolution_list_api.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-api title: "@kbn/securitysolution-list-api" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-list-api plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-api'] --- import kbnSecuritysolutionListApiObj from './kbn_securitysolution_list_api.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_list_constants.mdx b/api_docs/kbn_securitysolution_list_constants.mdx index fd5f8553b7698..d910793217bd4 100644 --- a/api_docs/kbn_securitysolution_list_constants.mdx +++ b/api_docs/kbn_securitysolution_list_constants.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-constants title: "@kbn/securitysolution-list-constants" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-list-constants plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-constants'] --- import kbnSecuritysolutionListConstantsObj from './kbn_securitysolution_list_constants.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_list_hooks.devdocs.json b/api_docs/kbn_securitysolution_list_hooks.devdocs.json index a9290e1b6ed6b..befcfaaecfb13 100644 --- a/api_docs/kbn_securitysolution_list_hooks.devdocs.json +++ b/api_docs/kbn_securitysolution_list_hooks.devdocs.json @@ -29,7 +29,7 @@ "\nThis adds an id to the incoming exception item entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n\nThis does break the type system slightly as we are lying a bit to the type system as we return\nthe same exceptionItem as we have previously but are augmenting the arrays with an id which TypeScript\ndoesn't mind us doing here. However, downstream you will notice that you have an id when the type\ndoes not indicate it. In that case use (ExceptionItem & { id: string }) temporarily if you're using the id. If you're not,\nyou can ignore the id and just use the normal TypeScript with ReactJS.\n" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -45,7 +45,7 @@ "The exceptionItem to add an id to the threat matches." ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -68,7 +68,7 @@ "\nThis removes createdAt, createdBy from the exceptionItem if a comment was added to\nthe Exception item, and return the comment message with id to prevent creating the commet\ntwice" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -84,7 +84,7 @@ "The exceptionItem to remove createdAt, createdBy from the comments array." ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -107,7 +107,7 @@ "\nThis removes an id from the exceptionItem entries as ReactJS prefers to have\nan id added to them for use as a stable id. Later if we decide to change the data\nmodel to have id's within the array then this code should be removed. If not, then\nthis code should stay as an adapter for ReactJS.\n" ], "signature": [ - "(exceptionItem: T) => T" + "(exceptionItem: T) => T" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -146,7 +146,7 @@ "\nTransforms the output of rules to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the input called \"myNewTransform\" do it\nin the form of:\nflow(addIdToExceptionItemEntries, myNewTransform)(exceptionItem)\n" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -162,7 +162,7 @@ "The exceptionItem to transform the output of" ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -183,7 +183,7 @@ "label": "transformNewItemOutput", "description": [], "signature": [ - "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "(exceptionItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) => { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -197,7 +197,7 @@ "label": "exceptionItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -218,7 +218,7 @@ "\nTransforms the output of exception items to compensate for technical debt or UI concerns such as\nReactJS preferences for having ids within arrays if the data is not modeled that way.\n\nIf you add a new transform of the output called \"myNewTransform\" do it\nin the form of:\nflow(removeIdFromExceptionItemsEntries, myNewTransform)(exceptionItem)\n" ], "signature": [ - "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" + "(exceptionItem: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })) => { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -234,7 +234,7 @@ "The exceptionItem to transform the output of" ], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" ], "path": "packages/kbn-securitysolution-list-hooks/src/transforms/index.ts", "deprecated": false, @@ -407,7 +407,7 @@ "section": "def-common.DeleteListParams", "text": "DeleteListParams" }, - ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" + ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_delete_list/index.ts", "deprecated": false, @@ -545,7 +545,7 @@ "section": "def-common.FindListsParams", "text": "FindListsParams" }, - ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" + ">], { cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_find_lists/index.ts", "deprecated": false, @@ -586,7 +586,7 @@ "section": "def-common.FindListsParams", "text": "FindListsParams" }, - ">], { largeLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; smallLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; }>" + ">], { largeLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; smallLists: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_find_lists_by_size/index.ts", "deprecated": false, @@ -627,7 +627,7 @@ "section": "def-common.ImportListParams", "text": "ImportListParams" }, - ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" + ">], { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_import_list/index.ts", "deprecated": false, @@ -851,7 +851,7 @@ "label": "addExceptionListItem", "description": [], "signature": [ - "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -876,7 +876,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -895,7 +895,7 @@ "label": "updateExceptionListItem", "description": [], "signature": [ - "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + "(arg: { listItem: { description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }; }) => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -920,7 +920,7 @@ "label": "listItem", "description": [], "signature": [ - "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" + "{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -1039,7 +1039,7 @@ "section": "def-common.ApiCallMemoProps", "text": "ApiCallMemoProps" }, - " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise" + " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }) => Promise" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -1060,7 +1060,7 @@ "section": "def-common.ApiCallMemoProps", "text": "ApiCallMemoProps" }, - " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }" + " & { onSuccess: (arg: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }) => void; }" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_api/index.ts", "deprecated": false, @@ -1423,7 +1423,7 @@ "label": "ReturnPersistExceptionItem", "description": [], "signature": [ - "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]" + "[PersistReturnExceptionItem, React.Dispatch<({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { _version?: string | undefined; comments?: ({ comment: string; } & { id?: string | undefined; })[] | undefined; id?: string | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | null>]" ], "path": "packages/kbn-securitysolution-list-hooks/src/use_persist_exception_item/index.ts", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_list_hooks.mdx b/api_docs/kbn_securitysolution_list_hooks.mdx index a889a36d1dec1..b32106a65f98c 100644 --- a/api_docs/kbn_securitysolution_list_hooks.mdx +++ b/api_docs/kbn_securitysolution_list_hooks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-hooks title: "@kbn/securitysolution-list-hooks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-list-hooks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-hooks'] --- import kbnSecuritysolutionListHooksObj from './kbn_securitysolution_list_hooks.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_list_utils.devdocs.json b/api_docs/kbn_securitysolution_list_utils.devdocs.json index 4fe323489c217..e874763d9e630 100644 --- a/api_docs/kbn_securitysolution_list_utils.devdocs.json +++ b/api_docs/kbn_securitysolution_list_utils.devdocs.json @@ -27,7 +27,7 @@ "label": "addIdToEntries", "description": [], "signature": [ - "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -41,7 +41,7 @@ "label": "entries", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -314,7 +314,7 @@ "section": "def-common.FormattedBuilderEntry", "text": "FormattedBuilderEntry" }, - ") => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }" + ") => ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -474,7 +474,7 @@ "section": "def-common.FormattedBuilderEntry", "text": "FormattedBuilderEntry" }, - ", newField: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }) => { index: number; updatedEntry: ", + ", newField: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }) => { index: number; updatedEntry: ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -521,7 +521,7 @@ "- newly selected list" ], "signature": [ - "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }" + "{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }" ], "path": "packages/kbn-securitysolution-list-utils/src/helpers/index.ts", "deprecated": false, @@ -2108,7 +2108,7 @@ "label": "hasLargeValueList", "description": [], "signature": [ - "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => boolean" + "(entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]) => boolean" ], "path": "packages/kbn-securitysolution-list-utils/src/has_large_value_list/index.ts", "deprecated": false, @@ -2122,7 +2122,7 @@ "label": "entries", "description": [], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "packages/kbn-securitysolution-list-utils/src/has_large_value_list/index.ts", "deprecated": false, @@ -2779,7 +2779,7 @@ "label": "BuilderEntry", "description": [], "signature": [ - "(({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }) | ", + "(({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; }) & { id?: string | undefined; }) | ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -2840,7 +2840,7 @@ "label": "CreateExceptionListItemBuilderSchema", "description": [], "signature": [ - "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"entries\" | \"meta\" | \"list_id\" | \"namespace_type\"> & { meta: { temporaryUuid: string; }; entries: ", + "Omit<{ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }, \"entries\" | \"meta\" | \"list_id\" | \"namespace_type\"> & { meta: { temporaryUuid: string; }; entries: ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -2966,7 +2966,7 @@ "label": "ExceptionListItemBuilderSchema", "description": [], "signature": [ - "Omit<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"entries\"> & { entries: ", + "Omit<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }, \"entries\"> & { entries: ", { "pluginId": "@kbn/securitysolution-list-utils", "scope": "common", @@ -3033,7 +3033,7 @@ "label": "ExceptionsBuilderReturnExceptionItem", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; list_id: string; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; }) | ({ description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; name: string; type: \"simple\"; } & { comments?: { comment: string; }[] | undefined; item_id?: string | undefined; list_id?: undefined; meta?: object | undefined; namespace_type?: \"single\" | \"agnostic\" | undefined; os_types?: (\"windows\" | \"linux\" | \"macos\")[] | undefined; tags?: string[] | undefined; })" ], "path": "packages/kbn-securitysolution-list-utils/src/types/index.ts", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_list_utils.mdx b/api_docs/kbn_securitysolution_list_utils.mdx index c1de7b28e108e..ae1ce091979d9 100644 --- a/api_docs/kbn_securitysolution_list_utils.mdx +++ b/api_docs/kbn_securitysolution_list_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-list-utils title: "@kbn/securitysolution-list-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-list-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-list-utils'] --- import kbnSecuritysolutionListUtilsObj from './kbn_securitysolution_list_utils.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_rules.mdx b/api_docs/kbn_securitysolution_rules.mdx index d6947e192818c..9a0c5c86d3040 100644 --- a/api_docs/kbn_securitysolution_rules.mdx +++ b/api_docs/kbn_securitysolution_rules.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-rules title: "@kbn/securitysolution-rules" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-rules plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-rules'] --- import kbnSecuritysolutionRulesObj from './kbn_securitysolution_rules.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_t_grid.mdx b/api_docs/kbn_securitysolution_t_grid.mdx index 47aee2c288d13..738f7b0daedfa 100644 --- a/api_docs/kbn_securitysolution_t_grid.mdx +++ b/api_docs/kbn_securitysolution_t_grid.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-t-grid title: "@kbn/securitysolution-t-grid" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-t-grid plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-t-grid'] --- import kbnSecuritysolutionTGridObj from './kbn_securitysolution_t_grid.devdocs.json'; diff --git a/api_docs/kbn_securitysolution_utils.devdocs.json b/api_docs/kbn_securitysolution_utils.devdocs.json index 2e011adcd1bcf..bef378738fe82 100644 --- a/api_docs/kbn_securitysolution_utils.devdocs.json +++ b/api_docs/kbn_securitysolution_utils.devdocs.json @@ -221,6 +221,7 @@ "label": "field", "description": [], "signature": [ + "\"file.path.text\" | ", { "pluginId": "@kbn/securitysolution-utils", "scope": "common", @@ -235,8 +236,7 @@ "docId": "kibKbnSecuritysolutionUtilsPluginApi", "section": "def-common.BlocklistConditionEntryField", "text": "BlocklistConditionEntryField" - }, - " | \"file.path.text\"" + } ], "path": "packages/kbn-securitysolution-utils/src/path_validations/index.ts", "deprecated": false, @@ -465,6 +465,7 @@ "label": "AllConditionEntryFields", "description": [], "signature": [ + "\"file.path.text\" | ", { "pluginId": "@kbn/securitysolution-utils", "scope": "common", @@ -479,8 +480,7 @@ "docId": "kibKbnSecuritysolutionUtilsPluginApi", "section": "def-common.BlocklistConditionEntryField", "text": "BlocklistConditionEntryField" - }, - " | \"file.path.text\"" + } ], "path": "packages/kbn-securitysolution-utils/src/path_validations/index.ts", "deprecated": false, diff --git a/api_docs/kbn_securitysolution_utils.mdx b/api_docs/kbn_securitysolution_utils.mdx index 71c950c282de1..c286a7e04adc2 100644 --- a/api_docs/kbn_securitysolution_utils.mdx +++ b/api_docs/kbn_securitysolution_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-securitysolution-utils title: "@kbn/securitysolution-utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/securitysolution-utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/securitysolution-utils'] --- import kbnSecuritysolutionUtilsObj from './kbn_securitysolution_utils.devdocs.json'; diff --git a/api_docs/kbn_server_http_tools.mdx b/api_docs/kbn_server_http_tools.mdx index 1a32fe5a8417e..1b6a993401cc8 100644 --- a/api_docs/kbn_server_http_tools.mdx +++ b/api_docs/kbn_server_http_tools.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-http-tools title: "@kbn/server-http-tools" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/server-http-tools plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-http-tools'] --- import kbnServerHttpToolsObj from './kbn_server_http_tools.devdocs.json'; diff --git a/api_docs/kbn_server_route_repository.mdx b/api_docs/kbn_server_route_repository.mdx index be05dc840c063..f43c43b463da2 100644 --- a/api_docs/kbn_server_route_repository.mdx +++ b/api_docs/kbn_server_route_repository.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-server-route-repository title: "@kbn/server-route-repository" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/server-route-repository plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/server-route-repository'] --- import kbnServerRouteRepositoryObj from './kbn_server_route_repository.devdocs.json'; diff --git a/api_docs/kbn_shared_svg.mdx b/api_docs/kbn_shared_svg.mdx index 5c56dd64ae767..7f7c543e4b8e8 100644 --- a/api_docs/kbn_shared_svg.mdx +++ b/api_docs/kbn_shared_svg.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-svg title: "@kbn/shared-svg" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-svg plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-svg'] --- import kbnSharedSvgObj from './kbn_shared_svg.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_avatar_solution.mdx b/api_docs/kbn_shared_ux_avatar_solution.mdx index 429249106c5b4..c7bcc549506cb 100644 --- a/api_docs/kbn_shared_ux_avatar_solution.mdx +++ b/api_docs/kbn_shared_ux_avatar_solution.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-solution title: "@kbn/shared-ux-avatar-solution" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-avatar-solution plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-solution'] --- import kbnSharedUxAvatarSolutionObj from './kbn_shared_ux_avatar_solution.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx index 6aa4d356dc643..f075dc418224f 100644 --- a/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx +++ b/api_docs/kbn_shared_ux_avatar_user_profile_components.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-avatar-user-profile-components title: "@kbn/shared-ux-avatar-user-profile-components" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-avatar-user-profile-components plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-avatar-user-profile-components'] --- import kbnSharedUxAvatarUserProfileComponentsObj from './kbn_shared_ux_avatar_user_profile_components.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx index d01d88b65e245..a3437f34305af 100644 --- a/api_docs/kbn_shared_ux_button_exit_full_screen.mdx +++ b/api_docs/kbn_shared_ux_button_exit_full_screen.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen title: "@kbn/shared-ux-button-exit-full-screen" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-button-exit-full-screen plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen'] --- import kbnSharedUxButtonExitFullScreenObj from './kbn_shared_ux_button_exit_full_screen.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx index 9255d66b184b7..2c65b84ea8db4 100644 --- a/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx +++ b/api_docs/kbn_shared_ux_button_exit_full_screen_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-exit-full-screen-mocks title: "@kbn/shared-ux-button-exit-full-screen-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-button-exit-full-screen-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-exit-full-screen-mocks'] --- import kbnSharedUxButtonExitFullScreenMocksObj from './kbn_shared_ux_button_exit_full_screen_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_button_toolbar.mdx b/api_docs/kbn_shared_ux_button_toolbar.mdx index 83757a898e606..a598a9c2a83a5 100644 --- a/api_docs/kbn_shared_ux_button_toolbar.mdx +++ b/api_docs/kbn_shared_ux_button_toolbar.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-button-toolbar title: "@kbn/shared-ux-button-toolbar" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-button-toolbar plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-button-toolbar'] --- import kbnSharedUxButtonToolbarObj from './kbn_shared_ux_button_toolbar.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_card_no_data.mdx b/api_docs/kbn_shared_ux_card_no_data.mdx index 85491e50f5464..ee0d6ef94fcb8 100644 --- a/api_docs/kbn_shared_ux_card_no_data.mdx +++ b/api_docs/kbn_shared_ux_card_no_data.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data title: "@kbn/shared-ux-card-no-data" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-card-no-data plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data'] --- import kbnSharedUxCardNoDataObj from './kbn_shared_ux_card_no_data.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx index 71689235c968e..8148f8b42aaca 100644 --- a/api_docs/kbn_shared_ux_card_no_data_mocks.mdx +++ b/api_docs/kbn_shared_ux_card_no_data_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-card-no-data-mocks title: "@kbn/shared-ux-card-no-data-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-card-no-data-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-card-no-data-mocks'] --- import kbnSharedUxCardNoDataMocksObj from './kbn_shared_ux_card_no_data_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_context.mdx b/api_docs/kbn_shared_ux_file_context.mdx index c5e3ad90cb628..8a798fbf22345 100644 --- a/api_docs/kbn_shared_ux_file_context.mdx +++ b/api_docs/kbn_shared_ux_file_context.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-context title: "@kbn/shared-ux-file-context" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-context plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-context'] --- import kbnSharedUxFileContextObj from './kbn_shared_ux_file_context.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_image.mdx b/api_docs/kbn_shared_ux_file_image.mdx index 6fe406e5be943..ad0c70e000c61 100644 --- a/api_docs/kbn_shared_ux_file_image.mdx +++ b/api_docs/kbn_shared_ux_file_image.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image title: "@kbn/shared-ux-file-image" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-image plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image'] --- import kbnSharedUxFileImageObj from './kbn_shared_ux_file_image.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_image_mocks.mdx b/api_docs/kbn_shared_ux_file_image_mocks.mdx index ee718b45c2453..d10d85abeca16 100644 --- a/api_docs/kbn_shared_ux_file_image_mocks.mdx +++ b/api_docs/kbn_shared_ux_file_image_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-image-mocks title: "@kbn/shared-ux-file-image-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-image-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-image-mocks'] --- import kbnSharedUxFileImageMocksObj from './kbn_shared_ux_file_image_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_mocks.mdx b/api_docs/kbn_shared_ux_file_mocks.mdx index a647b412c0b23..0fb0da680189f 100644 --- a/api_docs/kbn_shared_ux_file_mocks.mdx +++ b/api_docs/kbn_shared_ux_file_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-mocks title: "@kbn/shared-ux-file-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-mocks'] --- import kbnSharedUxFileMocksObj from './kbn_shared_ux_file_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_picker.mdx b/api_docs/kbn_shared_ux_file_picker.mdx index bf13d02131cd9..7b085fabd9da8 100644 --- a/api_docs/kbn_shared_ux_file_picker.mdx +++ b/api_docs/kbn_shared_ux_file_picker.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-picker title: "@kbn/shared-ux-file-picker" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-picker plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-picker'] --- import kbnSharedUxFilePickerObj from './kbn_shared_ux_file_picker.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_upload.mdx b/api_docs/kbn_shared_ux_file_upload.mdx index 95e7585d3c1ea..5dc990124de6d 100644 --- a/api_docs/kbn_shared_ux_file_upload.mdx +++ b/api_docs/kbn_shared_ux_file_upload.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-upload title: "@kbn/shared-ux-file-upload" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-upload plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-upload'] --- import kbnSharedUxFileUploadObj from './kbn_shared_ux_file_upload.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_file_util.mdx b/api_docs/kbn_shared_ux_file_util.mdx index 150cb8d79acd2..7b654a2895b5b 100644 --- a/api_docs/kbn_shared_ux_file_util.mdx +++ b/api_docs/kbn_shared_ux_file_util.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-file-util title: "@kbn/shared-ux-file-util" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-file-util plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-file-util'] --- import kbnSharedUxFileUtilObj from './kbn_shared_ux_file_util.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_link_redirect_app.mdx b/api_docs/kbn_shared_ux_link_redirect_app.mdx index 58086c15f6dee..4ee02a23d431c 100644 --- a/api_docs/kbn_shared_ux_link_redirect_app.mdx +++ b/api_docs/kbn_shared_ux_link_redirect_app.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app title: "@kbn/shared-ux-link-redirect-app" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-link-redirect-app plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app'] --- import kbnSharedUxLinkRedirectAppObj from './kbn_shared_ux_link_redirect_app.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx index 3ef6616bc223e..e153b97ad1da4 100644 --- a/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx +++ b/api_docs/kbn_shared_ux_link_redirect_app_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-link-redirect-app-mocks title: "@kbn/shared-ux-link-redirect-app-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-link-redirect-app-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-link-redirect-app-mocks'] --- import kbnSharedUxLinkRedirectAppMocksObj from './kbn_shared_ux_link_redirect_app_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_markdown.mdx b/api_docs/kbn_shared_ux_markdown.mdx index 6a9ad55aa3f60..c407b1da22cf4 100644 --- a/api_docs/kbn_shared_ux_markdown.mdx +++ b/api_docs/kbn_shared_ux_markdown.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown title: "@kbn/shared-ux-markdown" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-markdown plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown'] --- import kbnSharedUxMarkdownObj from './kbn_shared_ux_markdown.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_markdown_mocks.mdx b/api_docs/kbn_shared_ux_markdown_mocks.mdx index 13a0e261d4761..1b30878c96e29 100644 --- a/api_docs/kbn_shared_ux_markdown_mocks.mdx +++ b/api_docs/kbn_shared_ux_markdown_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-markdown-mocks title: "@kbn/shared-ux-markdown-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-markdown-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-markdown-mocks'] --- import kbnSharedUxMarkdownMocksObj from './kbn_shared_ux_markdown_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx index 66a35b0e905de..56eb2a8328af9 100644 --- a/api_docs/kbn_shared_ux_page_analytics_no_data.mdx +++ b/api_docs/kbn_shared_ux_page_analytics_no_data.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data title: "@kbn/shared-ux-page-analytics-no-data" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-analytics-no-data plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data'] --- import kbnSharedUxPageAnalyticsNoDataObj from './kbn_shared_ux_page_analytics_no_data.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx index 1e9847e735485..929c71213fdcb 100644 --- a/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx +++ b/api_docs/kbn_shared_ux_page_analytics_no_data_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-analytics-no-data-mocks title: "@kbn/shared-ux-page-analytics-no-data-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-analytics-no-data-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-analytics-no-data-mocks'] --- import kbnSharedUxPageAnalyticsNoDataMocksObj from './kbn_shared_ux_page_analytics_no_data_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx index 99797bffe6315..eddf6a3afa916 100644 --- a/api_docs/kbn_shared_ux_page_kibana_no_data.mdx +++ b/api_docs/kbn_shared_ux_page_kibana_no_data.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data title: "@kbn/shared-ux-page-kibana-no-data" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-kibana-no-data plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data'] --- import kbnSharedUxPageKibanaNoDataObj from './kbn_shared_ux_page_kibana_no_data.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx index d9156da1b2715..176634a6498fb 100644 --- a/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx +++ b/api_docs/kbn_shared_ux_page_kibana_no_data_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-no-data-mocks title: "@kbn/shared-ux-page-kibana-no-data-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-kibana-no-data-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-no-data-mocks'] --- import kbnSharedUxPageKibanaNoDataMocksObj from './kbn_shared_ux_page_kibana_no_data_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_kibana_template.mdx b/api_docs/kbn_shared_ux_page_kibana_template.mdx index 8902ad56a11be..e1aa8aa42deb6 100644 --- a/api_docs/kbn_shared_ux_page_kibana_template.mdx +++ b/api_docs/kbn_shared_ux_page_kibana_template.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template title: "@kbn/shared-ux-page-kibana-template" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-kibana-template plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template'] --- import kbnSharedUxPageKibanaTemplateObj from './kbn_shared_ux_page_kibana_template.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx index 012450ce5ccef..a7253671d6679 100644 --- a/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx +++ b/api_docs/kbn_shared_ux_page_kibana_template_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-kibana-template-mocks title: "@kbn/shared-ux-page-kibana-template-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-kibana-template-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-kibana-template-mocks'] --- import kbnSharedUxPageKibanaTemplateMocksObj from './kbn_shared_ux_page_kibana_template_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_no_data.mdx b/api_docs/kbn_shared_ux_page_no_data.mdx index e8f230cbbd148..37755c75976fd 100644 --- a/api_docs/kbn_shared_ux_page_no_data.mdx +++ b/api_docs/kbn_shared_ux_page_no_data.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data title: "@kbn/shared-ux-page-no-data" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-no-data plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data'] --- import kbnSharedUxPageNoDataObj from './kbn_shared_ux_page_no_data.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_no_data_config.mdx b/api_docs/kbn_shared_ux_page_no_data_config.mdx index 2107ab6b25785..e896f3353286e 100644 --- a/api_docs/kbn_shared_ux_page_no_data_config.mdx +++ b/api_docs/kbn_shared_ux_page_no_data_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config title: "@kbn/shared-ux-page-no-data-config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-no-data-config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config'] --- import kbnSharedUxPageNoDataConfigObj from './kbn_shared_ux_page_no_data_config.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx index f0ebf8d108c9d..3aca1990f632c 100644 --- a/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx +++ b/api_docs/kbn_shared_ux_page_no_data_config_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-config-mocks title: "@kbn/shared-ux-page-no-data-config-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-no-data-config-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-config-mocks'] --- import kbnSharedUxPageNoDataConfigMocksObj from './kbn_shared_ux_page_no_data_config_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx index fb29394c43986..1f3574fa945f9 100644 --- a/api_docs/kbn_shared_ux_page_no_data_mocks.mdx +++ b/api_docs/kbn_shared_ux_page_no_data_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-no-data-mocks title: "@kbn/shared-ux-page-no-data-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-no-data-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-no-data-mocks'] --- import kbnSharedUxPageNoDataMocksObj from './kbn_shared_ux_page_no_data_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_page_solution_nav.mdx b/api_docs/kbn_shared_ux_page_solution_nav.mdx index bf195a21030c5..42cf6a1a72a04 100644 --- a/api_docs/kbn_shared_ux_page_solution_nav.mdx +++ b/api_docs/kbn_shared_ux_page_solution_nav.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-page-solution-nav title: "@kbn/shared-ux-page-solution-nav" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-page-solution-nav plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-page-solution-nav'] --- import kbnSharedUxPageSolutionNavObj from './kbn_shared_ux_page_solution_nav.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx index b6829a713dc5b..2bfa5b8e4cd8b 100644 --- a/api_docs/kbn_shared_ux_prompt_no_data_views.mdx +++ b/api_docs/kbn_shared_ux_prompt_no_data_views.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views title: "@kbn/shared-ux-prompt-no-data-views" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-prompt-no-data-views plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views'] --- import kbnSharedUxPromptNoDataViewsObj from './kbn_shared_ux_prompt_no_data_views.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx index 100b3d0ff0fe4..a72be70c7c20f 100644 --- a/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx +++ b/api_docs/kbn_shared_ux_prompt_no_data_views_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-no-data-views-mocks title: "@kbn/shared-ux-prompt-no-data-views-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-prompt-no-data-views-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-no-data-views-mocks'] --- import kbnSharedUxPromptNoDataViewsMocksObj from './kbn_shared_ux_prompt_no_data_views_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_prompt_not_found.mdx b/api_docs/kbn_shared_ux_prompt_not_found.mdx index 8aa5b0eeec9bd..6e94b0a09bb8f 100644 --- a/api_docs/kbn_shared_ux_prompt_not_found.mdx +++ b/api_docs/kbn_shared_ux_prompt_not_found.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-prompt-not-found title: "@kbn/shared-ux-prompt-not-found" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-prompt-not-found plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-prompt-not-found'] --- import kbnSharedUxPromptNotFoundObj from './kbn_shared_ux_prompt_not_found.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_router.mdx b/api_docs/kbn_shared_ux_router.mdx index 5023c0435753b..6d7275be8d4d1 100644 --- a/api_docs/kbn_shared_ux_router.mdx +++ b/api_docs/kbn_shared_ux_router.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router title: "@kbn/shared-ux-router" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-router plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router'] --- import kbnSharedUxRouterObj from './kbn_shared_ux_router.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_router_mocks.mdx b/api_docs/kbn_shared_ux_router_mocks.mdx index 57916cc232c8c..e9e3613bfe9cf 100644 --- a/api_docs/kbn_shared_ux_router_mocks.mdx +++ b/api_docs/kbn_shared_ux_router_mocks.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-router-mocks title: "@kbn/shared-ux-router-mocks" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-router-mocks plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-router-mocks'] --- import kbnSharedUxRouterMocksObj from './kbn_shared_ux_router_mocks.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_storybook_config.mdx b/api_docs/kbn_shared_ux_storybook_config.mdx index 60ce18487be4f..53fcbfa49e891 100644 --- a/api_docs/kbn_shared_ux_storybook_config.mdx +++ b/api_docs/kbn_shared_ux_storybook_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-config title: "@kbn/shared-ux-storybook-config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-storybook-config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-config'] --- import kbnSharedUxStorybookConfigObj from './kbn_shared_ux_storybook_config.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_storybook_mock.mdx b/api_docs/kbn_shared_ux_storybook_mock.mdx index bbf16bbbdcf02..f67894508febf 100644 --- a/api_docs/kbn_shared_ux_storybook_mock.mdx +++ b/api_docs/kbn_shared_ux_storybook_mock.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-storybook-mock title: "@kbn/shared-ux-storybook-mock" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-storybook-mock plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-storybook-mock'] --- import kbnSharedUxStorybookMockObj from './kbn_shared_ux_storybook_mock.devdocs.json'; diff --git a/api_docs/kbn_shared_ux_utility.mdx b/api_docs/kbn_shared_ux_utility.mdx index 741cc149bba5c..1ac1d8b1646d7 100644 --- a/api_docs/kbn_shared_ux_utility.mdx +++ b/api_docs/kbn_shared_ux_utility.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-shared-ux-utility title: "@kbn/shared-ux-utility" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/shared-ux-utility plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/shared-ux-utility'] --- import kbnSharedUxUtilityObj from './kbn_shared_ux_utility.devdocs.json'; diff --git a/api_docs/kbn_slo_schema.devdocs.json b/api_docs/kbn_slo_schema.devdocs.json index 1b706b4d3d789..e0241d83dc24d 100644 --- a/api_docs/kbn_slo_schema.devdocs.json +++ b/api_docs/kbn_slo_schema.devdocs.json @@ -490,7 +490,7 @@ "label": "FetchHistoricalSummaryResponse", "description": [], "signature": [ - "{ [x: string]: { date: string; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; sliValue: number; status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; }[]; }" + "{ [x: string]: ({ date: string; } & { status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; })[]; }" ], "path": "packages/kbn-slo-schema/src/rest_specs/slo.ts", "deprecated": false, @@ -542,6 +542,21 @@ "trackAdoption": false, "initialIsOpen": false }, + { + "parentPluginId": "@kbn/slo-schema", + "id": "def-common.HistoricalSummaryResponse", + "type": "Type", + "tags": [], + "label": "HistoricalSummaryResponse", + "description": [], + "signature": [ + "{ date: string; } & { status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; }" + ], + "path": "packages/kbn-slo-schema/src/rest_specs/slo.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, { "parentPluginId": "@kbn/slo-schema", "id": "def-common.SLOResponse", @@ -1225,22 +1240,14 @@ ", ", "ArrayC", "<", + "IntersectionC", + "<[", "TypeC", "<{ date: ", "Type", - "; errorBudget: ", + "; }>, ", "TypeC", - "<{ initial: ", - "NumberC", - "; consumed: ", - "NumberC", - "; remaining: ", - "NumberC", - "; isEstimated: ", - "BooleanC", - "; }>; sliValue: ", - "NumberC", - "; status: ", + "<{ status: ", "UnionC", "<[", "LiteralC", @@ -1250,7 +1257,19 @@ "LiteralC", "<\"DEGRADING\">, ", "LiteralC", - "<\"VIOLATED\">]>; }>>>" + "<\"VIOLATED\">]>; sliValue: ", + "NumberC", + "; errorBudget: ", + "TypeC", + "<{ initial: ", + "NumberC", + "; consumed: ", + "NumberC", + "; remaining: ", + "NumberC", + "; isEstimated: ", + "BooleanC", + "; }>; }>]>>>" ], "path": "packages/kbn-slo-schema/src/rest_specs/slo.ts", "deprecated": false, @@ -1813,22 +1832,14 @@ "label": "historicalSummarySchema", "description": [], "signature": [ + "IntersectionC", + "<[", "TypeC", "<{ date: ", "Type", - "; errorBudget: ", + "; }>, ", "TypeC", - "<{ initial: ", - "NumberC", - "; consumed: ", - "NumberC", - "; remaining: ", - "NumberC", - "; isEstimated: ", - "BooleanC", - "; }>; sliValue: ", - "NumberC", - "; status: ", + "<{ status: ", "UnionC", "<[", "LiteralC", @@ -1838,9 +1849,21 @@ "LiteralC", "<\"DEGRADING\">, ", "LiteralC", - "<\"VIOLATED\">]>; }>" + "<\"VIOLATED\">]>; sliValue: ", + "NumberC", + "; errorBudget: ", + "TypeC", + "<{ initial: ", + "NumberC", + "; consumed: ", + "NumberC", + "; remaining: ", + "NumberC", + "; isEstimated: ", + "BooleanC", + "; }>; }>]>" ], - "path": "packages/kbn-slo-schema/src/schema/indicators.ts", + "path": "packages/kbn-slo-schema/src/schema/common.ts", "deprecated": false, "trackAdoption": false, "initialIsOpen": false diff --git a/api_docs/kbn_slo_schema.mdx b/api_docs/kbn_slo_schema.mdx index b9d892401025d..78cd5635213ea 100644 --- a/api_docs/kbn_slo_schema.mdx +++ b/api_docs/kbn_slo_schema.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-slo-schema title: "@kbn/slo-schema" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/slo-schema plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/slo-schema'] --- import kbnSloSchemaObj from './kbn_slo_schema.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin. | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 72 | 0 | 72 | 0 | +| 73 | 0 | 73 | 0 | ## Common diff --git a/api_docs/kbn_some_dev_log.mdx b/api_docs/kbn_some_dev_log.mdx index d92ecbce88570..9e9fd0416a8d0 100644 --- a/api_docs/kbn_some_dev_log.mdx +++ b/api_docs/kbn_some_dev_log.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-some-dev-log title: "@kbn/some-dev-log" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/some-dev-log plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/some-dev-log'] --- import kbnSomeDevLogObj from './kbn_some_dev_log.devdocs.json'; diff --git a/api_docs/kbn_std.mdx b/api_docs/kbn_std.mdx index fa797c9f29bf9..39c508c78ce98 100644 --- a/api_docs/kbn_std.mdx +++ b/api_docs/kbn_std.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-std title: "@kbn/std" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/std plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/std'] --- import kbnStdObj from './kbn_std.devdocs.json'; diff --git a/api_docs/kbn_stdio_dev_helpers.mdx b/api_docs/kbn_stdio_dev_helpers.mdx index b915affd484f7..dc04e13ba6857 100644 --- a/api_docs/kbn_stdio_dev_helpers.mdx +++ b/api_docs/kbn_stdio_dev_helpers.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-stdio-dev-helpers title: "@kbn/stdio-dev-helpers" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/stdio-dev-helpers plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/stdio-dev-helpers'] --- import kbnStdioDevHelpersObj from './kbn_stdio_dev_helpers.devdocs.json'; diff --git a/api_docs/kbn_storybook.mdx b/api_docs/kbn_storybook.mdx index f1906c594e7e0..1b54d37b50718 100644 --- a/api_docs/kbn_storybook.mdx +++ b/api_docs/kbn_storybook.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-storybook title: "@kbn/storybook" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/storybook plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/storybook'] --- import kbnStorybookObj from './kbn_storybook.devdocs.json'; diff --git a/api_docs/kbn_telemetry_tools.mdx b/api_docs/kbn_telemetry_tools.mdx index 60b366c31383f..229bc3a628817 100644 --- a/api_docs/kbn_telemetry_tools.mdx +++ b/api_docs/kbn_telemetry_tools.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-telemetry-tools title: "@kbn/telemetry-tools" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/telemetry-tools plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/telemetry-tools'] --- import kbnTelemetryToolsObj from './kbn_telemetry_tools.devdocs.json'; diff --git a/api_docs/kbn_test.mdx b/api_docs/kbn_test.mdx index 3ac047b60e78a..33884d0d91752 100644 --- a/api_docs/kbn_test.mdx +++ b/api_docs/kbn_test.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test title: "@kbn/test" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/test plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test'] --- import kbnTestObj from './kbn_test.devdocs.json'; diff --git a/api_docs/kbn_test_jest_helpers.mdx b/api_docs/kbn_test_jest_helpers.mdx index 3901597fb9e91..9d51ae4733361 100644 --- a/api_docs/kbn_test_jest_helpers.mdx +++ b/api_docs/kbn_test_jest_helpers.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-jest-helpers title: "@kbn/test-jest-helpers" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/test-jest-helpers plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-jest-helpers'] --- import kbnTestJestHelpersObj from './kbn_test_jest_helpers.devdocs.json'; diff --git a/api_docs/kbn_test_subj_selector.mdx b/api_docs/kbn_test_subj_selector.mdx index 462366995a653..affca734c68ee 100644 --- a/api_docs/kbn_test_subj_selector.mdx +++ b/api_docs/kbn_test_subj_selector.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-test-subj-selector title: "@kbn/test-subj-selector" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/test-subj-selector plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/test-subj-selector'] --- import kbnTestSubjSelectorObj from './kbn_test_subj_selector.devdocs.json'; diff --git a/api_docs/kbn_tooling_log.mdx b/api_docs/kbn_tooling_log.mdx index ce4e776280213..33d9c7877e22a 100644 --- a/api_docs/kbn_tooling_log.mdx +++ b/api_docs/kbn_tooling_log.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-tooling-log title: "@kbn/tooling-log" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/tooling-log plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/tooling-log'] --- import kbnToolingLogObj from './kbn_tooling_log.devdocs.json'; diff --git a/api_docs/kbn_ts_projects.mdx b/api_docs/kbn_ts_projects.mdx index a7cf269ee38bd..2ab99d1226ad9 100644 --- a/api_docs/kbn_ts_projects.mdx +++ b/api_docs/kbn_ts_projects.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ts-projects title: "@kbn/ts-projects" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ts-projects plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ts-projects'] --- import kbnTsProjectsObj from './kbn_ts_projects.devdocs.json'; diff --git a/api_docs/kbn_typed_react_router_config.mdx b/api_docs/kbn_typed_react_router_config.mdx index a8ac08a315a7a..6997a184d080b 100644 --- a/api_docs/kbn_typed_react_router_config.mdx +++ b/api_docs/kbn_typed_react_router_config.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-typed-react-router-config title: "@kbn/typed-react-router-config" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/typed-react-router-config plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/typed-react-router-config'] --- import kbnTypedReactRouterConfigObj from './kbn_typed_react_router_config.devdocs.json'; diff --git a/api_docs/kbn_ui_actions_browser.mdx b/api_docs/kbn_ui_actions_browser.mdx index ae8670f5dec70..fde6f410a8cae 100644 --- a/api_docs/kbn_ui_actions_browser.mdx +++ b/api_docs/kbn_ui_actions_browser.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-actions-browser title: "@kbn/ui-actions-browser" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ui-actions-browser plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-actions-browser'] --- import kbnUiActionsBrowserObj from './kbn_ui_actions_browser.devdocs.json'; diff --git a/api_docs/kbn_ui_shared_deps_src.mdx b/api_docs/kbn_ui_shared_deps_src.mdx index 347fe000515e3..0c2e8dd760256 100644 --- a/api_docs/kbn_ui_shared_deps_src.mdx +++ b/api_docs/kbn_ui_shared_deps_src.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-shared-deps-src title: "@kbn/ui-shared-deps-src" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ui-shared-deps-src plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-shared-deps-src'] --- import kbnUiSharedDepsSrcObj from './kbn_ui_shared_deps_src.devdocs.json'; diff --git a/api_docs/kbn_ui_theme.mdx b/api_docs/kbn_ui_theme.mdx index 01eeecc58b93e..b4f303ea88abb 100644 --- a/api_docs/kbn_ui_theme.mdx +++ b/api_docs/kbn_ui_theme.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-ui-theme title: "@kbn/ui-theme" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/ui-theme plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/ui-theme'] --- import kbnUiThemeObj from './kbn_ui_theme.devdocs.json'; diff --git a/api_docs/kbn_user_profile_components.mdx b/api_docs/kbn_user_profile_components.mdx index befdb1cc8734d..6d2530ee72ddd 100644 --- a/api_docs/kbn_user_profile_components.mdx +++ b/api_docs/kbn_user_profile_components.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-user-profile-components title: "@kbn/user-profile-components" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/user-profile-components plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/user-profile-components'] --- import kbnUserProfileComponentsObj from './kbn_user_profile_components.devdocs.json'; diff --git a/api_docs/kbn_utility_types.devdocs.json b/api_docs/kbn_utility_types.devdocs.json index e76a2b33aaff8..6b15b19ce87c3 100644 --- a/api_docs/kbn_utility_types.devdocs.json +++ b/api_docs/kbn_utility_types.devdocs.json @@ -260,6 +260,21 @@ "trackAdoption": false, "initialIsOpen": false }, + { + "parentPluginId": "@kbn/utility-types", + "id": "def-common.ArrayElement", + "type": "Type", + "tags": [], + "label": "ArrayElement", + "description": [], + "signature": [ + "A extends readonly (infer T)[] ? T : never" + ], + "path": "packages/kbn-utility-types/index.ts", + "deprecated": false, + "trackAdoption": false, + "initialIsOpen": false + }, { "parentPluginId": "@kbn/utility-types", "id": "def-common.Assign", diff --git a/api_docs/kbn_utility_types.mdx b/api_docs/kbn_utility_types.mdx index 2dc76eb947af5..60f1f87d96104 100644 --- a/api_docs/kbn_utility_types.mdx +++ b/api_docs/kbn_utility_types.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types title: "@kbn/utility-types" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/utility-types plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types'] --- import kbnUtilityTypesObj from './kbn_utility_types.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Owner missing] for questions regarding this plugin. | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 34 | 0 | 14 | 1 | +| 35 | 0 | 15 | 1 | ## Common diff --git a/api_docs/kbn_utility_types_jest.mdx b/api_docs/kbn_utility_types_jest.mdx index b64cc7cc08705..d7a6cb35fb71d 100644 --- a/api_docs/kbn_utility_types_jest.mdx +++ b/api_docs/kbn_utility_types_jest.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utility-types-jest title: "@kbn/utility-types-jest" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/utility-types-jest plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utility-types-jest'] --- import kbnUtilityTypesJestObj from './kbn_utility_types_jest.devdocs.json'; diff --git a/api_docs/kbn_utils.mdx b/api_docs/kbn_utils.mdx index 1980b063ac49a..b2f87f0c23c88 100644 --- a/api_docs/kbn_utils.mdx +++ b/api_docs/kbn_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-utils title: "@kbn/utils" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/utils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/utils'] --- import kbnUtilsObj from './kbn_utils.devdocs.json'; diff --git a/api_docs/kbn_yarn_lock_validator.mdx b/api_docs/kbn_yarn_lock_validator.mdx index 49dafb3c3f91f..1074c62a28833 100644 --- a/api_docs/kbn_yarn_lock_validator.mdx +++ b/api_docs/kbn_yarn_lock_validator.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kbn-yarn-lock-validator title: "@kbn/yarn-lock-validator" image: https://source.unsplash.com/400x175/?github description: API docs for the @kbn/yarn-lock-validator plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', '@kbn/yarn-lock-validator'] --- import kbnYarnLockValidatorObj from './kbn_yarn_lock_validator.devdocs.json'; diff --git a/api_docs/kibana_overview.mdx b/api_docs/kibana_overview.mdx index 562a637256b05..c21e1801eda44 100644 --- a/api_docs/kibana_overview.mdx +++ b/api_docs/kibana_overview.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaOverview title: "kibanaOverview" image: https://source.unsplash.com/400x175/?github description: API docs for the kibanaOverview plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaOverview'] --- import kibanaOverviewObj from './kibana_overview.devdocs.json'; diff --git a/api_docs/kibana_react.mdx b/api_docs/kibana_react.mdx index 0c054048d3ead..3e3ad734d0153 100644 --- a/api_docs/kibana_react.mdx +++ b/api_docs/kibana_react.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaReact title: "kibanaReact" image: https://source.unsplash.com/400x175/?github description: API docs for the kibanaReact plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaReact'] --- import kibanaReactObj from './kibana_react.devdocs.json'; diff --git a/api_docs/kibana_utils.mdx b/api_docs/kibana_utils.mdx index 685863468e1c2..6928ee053a89f 100644 --- a/api_docs/kibana_utils.mdx +++ b/api_docs/kibana_utils.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kibanaUtils title: "kibanaUtils" image: https://source.unsplash.com/400x175/?github description: API docs for the kibanaUtils plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kibanaUtils'] --- import kibanaUtilsObj from './kibana_utils.devdocs.json'; diff --git a/api_docs/kubernetes_security.mdx b/api_docs/kubernetes_security.mdx index 4a56ad41fc1f9..2ba52344c1657 100644 --- a/api_docs/kubernetes_security.mdx +++ b/api_docs/kubernetes_security.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/kubernetesSecurity title: "kubernetesSecurity" image: https://source.unsplash.com/400x175/?github description: API docs for the kubernetesSecurity plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'kubernetesSecurity'] --- import kubernetesSecurityObj from './kubernetes_security.devdocs.json'; diff --git a/api_docs/lens.mdx b/api_docs/lens.mdx index ee1860d9a2d5a..f62d4efd460c3 100644 --- a/api_docs/lens.mdx +++ b/api_docs/lens.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lens title: "lens" image: https://source.unsplash.com/400x175/?github description: API docs for the lens plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lens'] --- import lensObj from './lens.devdocs.json'; diff --git a/api_docs/license_api_guard.mdx b/api_docs/license_api_guard.mdx index b58751f65148c..ff6d0d160e712 100644 --- a/api_docs/license_api_guard.mdx +++ b/api_docs/license_api_guard.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseApiGuard title: "licenseApiGuard" image: https://source.unsplash.com/400x175/?github description: API docs for the licenseApiGuard plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseApiGuard'] --- import licenseApiGuardObj from './license_api_guard.devdocs.json'; diff --git a/api_docs/license_management.mdx b/api_docs/license_management.mdx index a2cd4c1c2cc38..dca9df6fc2cd3 100644 --- a/api_docs/license_management.mdx +++ b/api_docs/license_management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licenseManagement title: "licenseManagement" image: https://source.unsplash.com/400x175/?github description: API docs for the licenseManagement plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licenseManagement'] --- import licenseManagementObj from './license_management.devdocs.json'; diff --git a/api_docs/licensing.mdx b/api_docs/licensing.mdx index 4bbcdac001647..8ef5d5aa60d4e 100644 --- a/api_docs/licensing.mdx +++ b/api_docs/licensing.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/licensing title: "licensing" image: https://source.unsplash.com/400x175/?github description: API docs for the licensing plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'licensing'] --- import licensingObj from './licensing.devdocs.json'; diff --git a/api_docs/lists.devdocs.json b/api_docs/lists.devdocs.json index 94c4877eb4a3a..b8681cc8d97db 100644 --- a/api_docs/lists.devdocs.json +++ b/api_docs/lists.devdocs.json @@ -345,7 +345,7 @@ "label": "exceptionsToDelete", "description": [], "signature": [ - "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" + "{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]" ], "path": "x-pack/plugins/lists/public/exceptions/components/builder/exception_items_renderer.tsx", "deprecated": false, @@ -622,7 +622,7 @@ "signature": [ "({ itemId, id, namespaceType, }: ", "GetExceptionListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -700,7 +700,7 @@ "signature": [ "({ comments, description, entries, itemId, meta, name, osTypes, tags, type, }: ", "CreateEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -776,7 +776,7 @@ "signature": [ "({ _version, comments, description, entries, id, itemId, meta, name, osTypes, tags, type, }: ", "UpdateEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -814,7 +814,7 @@ "signature": [ "({ itemId, id, }: ", "GetEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -972,7 +972,7 @@ "section": "def-server.CreateExceptionListItemOptions", "text": "CreateExceptionListItemOptions" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1022,7 +1022,7 @@ "section": "def-server.UpdateExceptionListItemOptions", "text": "UpdateExceptionListItemOptions" }, - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1066,7 +1066,7 @@ "signature": [ "({ id, itemId, namespaceType, }: ", "DeleteExceptionListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1140,7 +1140,7 @@ "signature": [ "({ id, itemId, }: ", "DeleteEndpointListItemOptions", - ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" + ") => Promise<{ _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1176,7 +1176,7 @@ "signature": [ "({ listId, filter, perPage, pit, page, search, searchAfter, sortField, sortOrder, namespaceType, }: ", "FindExceptionListItemOptions", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1214,7 +1214,7 @@ "signature": [ "({ listId, filter, perPage, pit, page, search, searchAfter, sortField, sortOrder, namespaceType, }: ", "FindExceptionListsItemOptions", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1252,7 +1252,7 @@ "signature": [ "({ perPage, pit, page, searchAfter, sortField, sortOrder, valueListId, }: ", "FindValueListExceptionListsItems", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1328,7 +1328,7 @@ "signature": [ "({ filter, perPage, page, pit, search, searchAfter, sortField, sortOrder, }: ", "FindEndpointListItemOptions", - ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" + ") => Promise<({ data: { _version: string | undefined; comments: ({ comment: string; created_at: string; created_by: string; id: string; } & { updated_at?: string | undefined; updated_by?: string | undefined; })[]; created_at: string; created_by: string; description: string; entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]; id: string; item_id: string; list_id: string; meta: object | undefined; name: string; namespace_type: \"single\" | \"agnostic\"; os_types: (\"windows\" | \"linux\" | \"macos\")[]; tags: string[]; tie_breaker_id: string; type: \"simple\"; updated_at: string; updated_by: string; }[]; page: number; per_page: number; total: number; } & { pit?: string | undefined; }) | null>" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts", "deprecated": false, @@ -1814,7 +1814,7 @@ "signature": [ "({ id }: ", "GetListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -1852,7 +1852,7 @@ "signature": [ "({ id, deserializer, immutable, serializer, name, description, type, meta, version, }: ", "CreateListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -1890,7 +1890,7 @@ "signature": [ "({ id, deserializer, serializer, name, description, immutable, type, meta, version, }: ", "CreateListIfItDoesNotExistOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2408,7 +2408,7 @@ "signature": [ "({ id }: ", "DeleteListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2446,7 +2446,7 @@ "signature": [ "({ listId, value, type, }: ", "DeleteListItemByValueOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2484,7 +2484,7 @@ "signature": [ "({ id }: ", "DeleteListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2558,7 +2558,7 @@ "signature": [ "({ deserializer, serializer, type, listId, stream, meta, version, }: ", "ImportListItemsToStreamOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2594,7 +2594,7 @@ "signature": [ "({ listId, value, type, }: ", "GetListItemByValueOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2632,7 +2632,7 @@ "signature": [ "({ id, deserializer, serializer, listId, value, type, meta, }: ", "CreateListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2668,7 +2668,7 @@ "signature": [ "({ _version, id, value, meta, }: ", "UpdateListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2704,7 +2704,7 @@ "signature": [ "({ _version, id, name, description, meta, version, }: ", "UpdateListOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2740,7 +2740,7 @@ "signature": [ "({ id }: ", "GetListItemOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2778,7 +2778,7 @@ "signature": [ "({ type, listId, value, }: ", "GetListItemsByValueOptions", - ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]>" + ") => Promise<{ _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2816,7 +2816,7 @@ "signature": [ "({ type, listId, value, }: ", "SearchListItemByValuesOptions", - ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>" + ") => Promise<{ items: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; value: unknown; }[]>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2854,7 +2854,7 @@ "signature": [ "({ filter, currentIndexPosition, perPage, page, sortField, sortOrder, searchAfter, runtimeMappings, }: ", "FindListOptions", - ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" + ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; description: string; deserializer: string | undefined; id: string; immutable: boolean; meta: object | undefined; name: string; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; version: number; }[]; page: number; per_page: number; total: number; }>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2892,7 +2892,7 @@ "signature": [ "({ listId, filter, currentIndexPosition, perPage, page, runtimeMappings, sortField, sortOrder, searchAfter, }: ", "FindListItemOptions", - ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>" + ") => Promise<{ cursor: string; data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; page: number; per_page: number; total: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2928,7 +2928,7 @@ "signature": [ "({ listId, filter, sortField, sortOrder, }: ", "FindAllListItemsOptions", - ") => Promise<{ data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; total: number; } | null>" + ") => Promise<{ data: { _version: string | undefined; created_at: string; created_by: string; deserializer: string | undefined; id: string; list_id: string; meta: object | undefined; serializer: string | undefined; tie_breaker_id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; updated_at: string; updated_by: string; value: string; }[]; total: number; } | null>" ], "path": "x-pack/plugins/lists/server/services/lists/list_client.ts", "deprecated": false, @@ -2997,7 +2997,7 @@ "an array with the exception list item entries" ], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts", "deprecated": false, @@ -3309,7 +3309,7 @@ "item exception entries logic" ], "signature": [ - "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"binary\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" + "({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; list: { id: string; type: \"boolean\" | \"date\" | \"keyword\" | \"ip\" | \"text\" | \"geo_point\" | \"geo_shape\" | \"date_nanos\" | \"long\" | \"double\" | \"date_range\" | \"ip_range\" | \"shape\" | \"short\" | \"binary\" | \"byte\" | \"float\" | \"half_float\" | \"integer\" | \"double_range\" | \"float_range\" | \"integer_range\" | \"long_range\"; }; operator: \"excluded\" | \"included\"; type: \"list\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; } | { entries: ({ field: string; operator: \"excluded\" | \"included\"; type: \"match\"; value: string; } | { field: string; operator: \"excluded\" | \"included\"; type: \"match_any\"; value: string[]; } | { field: string; operator: \"excluded\" | \"included\"; type: \"exists\"; })[]; field: string; type: \"nested\"; } | { field: string; operator: \"excluded\" | \"included\"; type: \"wildcard\"; value: string; })[]" ], "path": "x-pack/plugins/lists/server/services/exception_lists/exception_list_client_types.ts", "deprecated": false, diff --git a/api_docs/lists.mdx b/api_docs/lists.mdx index 8558d457d3899..6e2602b36b0b3 100644 --- a/api_docs/lists.mdx +++ b/api_docs/lists.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/lists title: "lists" image: https://source.unsplash.com/400x175/?github description: API docs for the lists plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'lists'] --- import listsObj from './lists.devdocs.json'; diff --git a/api_docs/management.mdx b/api_docs/management.mdx index 1c99a88f8d66e..219c0c70a135d 100644 --- a/api_docs/management.mdx +++ b/api_docs/management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/management title: "management" image: https://source.unsplash.com/400x175/?github description: API docs for the management plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'management'] --- import managementObj from './management.devdocs.json'; diff --git a/api_docs/maps.mdx b/api_docs/maps.mdx index dad6f9bb1e201..a70897574527c 100644 --- a/api_docs/maps.mdx +++ b/api_docs/maps.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/maps title: "maps" image: https://source.unsplash.com/400x175/?github description: API docs for the maps plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'maps'] --- import mapsObj from './maps.devdocs.json'; diff --git a/api_docs/maps_ems.mdx b/api_docs/maps_ems.mdx index 42822cab39150..5c3ab21ff8e34 100644 --- a/api_docs/maps_ems.mdx +++ b/api_docs/maps_ems.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/mapsEms title: "mapsEms" image: https://source.unsplash.com/400x175/?github description: API docs for the mapsEms plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'mapsEms'] --- import mapsEmsObj from './maps_ems.devdocs.json'; diff --git a/api_docs/ml.mdx b/api_docs/ml.mdx index e12ad6fdfc9d1..289f3dcf04fbc 100644 --- a/api_docs/ml.mdx +++ b/api_docs/ml.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ml title: "ml" image: https://source.unsplash.com/400x175/?github description: API docs for the ml plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ml'] --- import mlObj from './ml.devdocs.json'; diff --git a/api_docs/monitoring.mdx b/api_docs/monitoring.mdx index bf922479b7922..df7fa9b02b744 100644 --- a/api_docs/monitoring.mdx +++ b/api_docs/monitoring.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoring title: "monitoring" image: https://source.unsplash.com/400x175/?github description: API docs for the monitoring plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoring'] --- import monitoringObj from './monitoring.devdocs.json'; diff --git a/api_docs/monitoring_collection.mdx b/api_docs/monitoring_collection.mdx index 38b487c4e9bdc..ce8e36c660d17 100644 --- a/api_docs/monitoring_collection.mdx +++ b/api_docs/monitoring_collection.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/monitoringCollection title: "monitoringCollection" image: https://source.unsplash.com/400x175/?github description: API docs for the monitoringCollection plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'monitoringCollection'] --- import monitoringCollectionObj from './monitoring_collection.devdocs.json'; diff --git a/api_docs/navigation.mdx b/api_docs/navigation.mdx index 6548e4fc8a019..f1221d55512d1 100644 --- a/api_docs/navigation.mdx +++ b/api_docs/navigation.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/navigation title: "navigation" image: https://source.unsplash.com/400x175/?github description: API docs for the navigation plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'navigation'] --- import navigationObj from './navigation.devdocs.json'; diff --git a/api_docs/newsfeed.mdx b/api_docs/newsfeed.mdx index 7c256c099085e..249b6c8820495 100644 --- a/api_docs/newsfeed.mdx +++ b/api_docs/newsfeed.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/newsfeed title: "newsfeed" image: https://source.unsplash.com/400x175/?github description: API docs for the newsfeed plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'newsfeed'] --- import newsfeedObj from './newsfeed.devdocs.json'; diff --git a/api_docs/notifications.mdx b/api_docs/notifications.mdx index 12abfa38e8c20..71fdd3015e6e9 100644 --- a/api_docs/notifications.mdx +++ b/api_docs/notifications.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/notifications title: "notifications" image: https://source.unsplash.com/400x175/?github description: API docs for the notifications plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'notifications'] --- import notificationsObj from './notifications.devdocs.json'; diff --git a/api_docs/observability.devdocs.json b/api_docs/observability.devdocs.json index 1758977b7e0ca..a505038da41ca 100644 --- a/api_docs/observability.devdocs.json +++ b/api_docs/observability.devdocs.json @@ -10020,7 +10020,7 @@ "section": "def-server.ObservabilityRouteHandlerResources", "text": "ObservabilityRouteHandlerResources" }, - ", { [x: string]: { date: string; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; sliValue: number; status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; }[]; }, ", + ", { [x: string]: ({ date: string; } & { status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; })[]; }, ", { "pluginId": "observability", "scope": "server", @@ -10674,7 +10674,7 @@ "section": "def-server.ObservabilityRouteHandlerResources", "text": "ObservabilityRouteHandlerResources" }, - ", { [x: string]: { date: string; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; sliValue: number; status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; }[]; }, ", + ", { [x: string]: ({ date: string; } & { status: \"NO_DATA\" | \"HEALTHY\" | \"DEGRADING\" | \"VIOLATED\"; sliValue: number; errorBudget: { initial: number; consumed: number; remaining: number; isEstimated: boolean; }; })[]; }, ", { "pluginId": "observability", "scope": "server", diff --git a/api_docs/observability.mdx b/api_docs/observability.mdx index b468090720c89..60bcc71cc45e9 100644 --- a/api_docs/observability.mdx +++ b/api_docs/observability.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/observability title: "observability" image: https://source.unsplash.com/400x175/?github description: API docs for the observability plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'observability'] --- import observabilityObj from './observability.devdocs.json'; diff --git a/api_docs/osquery.mdx b/api_docs/osquery.mdx index 44e4929143370..bebe48584711d 100644 --- a/api_docs/osquery.mdx +++ b/api_docs/osquery.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/osquery title: "osquery" image: https://source.unsplash.com/400x175/?github description: API docs for the osquery plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'osquery'] --- import osqueryObj from './osquery.devdocs.json'; diff --git a/api_docs/plugin_directory.mdx b/api_docs/plugin_directory.mdx index bdfb5f0c1f844..85bfa61954c3b 100644 --- a/api_docs/plugin_directory.mdx +++ b/api_docs/plugin_directory.mdx @@ -7,7 +7,7 @@ id: kibDevDocsPluginDirectory slug: /kibana-dev-docs/api-meta/plugin-api-directory title: Directory description: Directory of public APIs available through plugins or packages. -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana'] --- @@ -15,13 +15,13 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | Count | Plugins or Packages with a
public API | Number of teams | |--------------|----------|------------------------| -| 562 | 464 | 42 | +| 564 | 464 | 43 | ### Public API health stats | API Count | Any Count | Missing comments | Missing exports | |--------------|----------|-----------------|--------| -| 34891 | 527 | 24529 | 1244 | +| 70019 | 527 | 59225 | 1207 | ## Plugin Directory @@ -36,7 +36,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Considering using bfetch capabilities when fetching large amounts of data. This services supports batching HTTP requests and streaming responses back. | 89 | 1 | 74 | 2 | | | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | Adds Canvas application to Kibana | 9 | 0 | 8 | 3 | | | [ResponseOps](https://github.com/orgs/elastic/teams/response-ops) | The Case management system in Kibana | 87 | 0 | 71 | 28 | -| | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 267 | 16 | 252 | 9 | +| | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | - | 270 | 16 | 255 | 9 | | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 41 | 0 | 11 | 0 | | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | Chat available on Elastic Cloud deployments for quicker assistance. | 1 | 0 | 0 | 0 | | | [Platform Onboarding](https://github.com/orgs/elastic/teams/platform-onboarding) | Static migration page where self-managed users can see text/copy about migrating to Elastic Cloud | 8 | 1 | 8 | 1 | @@ -48,7 +48,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Cloud Security Posture](https://github.com/orgs/elastic/teams/cloud-posture-security) | The cloud security posture plugin | 17 | 0 | 2 | 2 | | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 13 | 0 | 13 | 1 | | | [Kibana Presentation](https://github.com/orgs/elastic/teams/kibana-presentation) | The Controls Plugin contains embeddable components intended to create a simple query interface for end users, and a powerful editing suite that allows dashboard authors to build controls | 268 | 0 | 264 | 9 | -| | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2810 | 17 | 1018 | 0 | +| | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 2833 | 17 | 1015 | 0 | | crossClusterReplication | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 | | customBranding | [global-experience](https://github.com/orgs/elastic/teams/kibana-global-experience) | Enables customization of Kibana | 0 | 0 | 0 | 0 | | | [Fleet](https://github.com/orgs/elastic/teams/fleet) | Add custom data integrations so they can be displayed in the Fleet integrations app | 107 | 0 | 88 | 1 | @@ -63,7 +63,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 10 | 0 | 8 | 2 | | | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | This plugin contains the Discover application and the saved search embeddable. | 107 | 0 | 88 | 7 | | | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | - | 37 | 0 | 35 | 2 | -| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds embeddables service to Kibana | 522 | 8 | 421 | 4 | +| | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds embeddables service to Kibana | 528 | 8 | 427 | 4 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends embeddable plugin with more functionality | 14 | 0 | 14 | 0 | | | [Platform Security](https://github.com/orgs/elastic/teams/kibana-security) | This plugin provides encryption and decryption utilities for saved objects containing sensitive information. | 51 | 0 | 44 | 0 | | | [Enterprise Search](https://github.com/orgs/elastic/teams/enterprise-search-frontend) | Adds dashboards for discovering and managing Enterprise Search products. | 9 | 0 | 9 | 0 | @@ -90,6 +90,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [@elastic/kibana-app-services](https://github.com/orgs/elastic/teams/team:AppServicesUx) | File upload, download, sharing, and serving over HTTP implementation in Kibana. | 254 | 1 | 45 | 5 | | | [@elastic/appex-sharedux](https://github.com/orgs/elastic/teams/@elastic/appex-sharedux) | Simple UI for managing files in Kibana | 2 | 1 | 2 | 0 | | | [Fleet](https://github.com/orgs/elastic/teams/fleet) | - | 1040 | 3 | 935 | 25 | +| ftrApis | [Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 | | | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 68 | 0 | 14 | 5 | | globalSearchBar | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 | | globalSearchProviders | [Kibana Core](https://github.com/orgs/elastic/teams/kibana-core) | - | 0 | 0 | 0 | 0 | @@ -165,7 +166,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Response Ops](https://github.com/orgs/elastic/teams/response-ops) | - | 586 | 11 | 557 | 53 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Adds UI Actions service to Kibana | 144 | 2 | 99 | 11 | | | [App Services](https://github.com/orgs/elastic/teams/kibana-app-services) | Extends UI Actions plugin with more functionality | 206 | 0 | 140 | 9 | -| | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Contains functionality for the field list which can be integrated into apps | 270 | 0 | 245 | 7 | +| | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | Contains functionality for the field list which can be integrated into apps | 267 | 0 | 242 | 7 | | | [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-discovery) | The `unifiedHistogram` plugin provides UI components to create a layout including a resizable histogram and a main display. | 63 | 0 | 16 | 1 | | | [Visualizations](https://github.com/orgs/elastic/teams/kibana-visualizations) | Contains all the key functionality of Kibana's unified search experience.Contains all the key functionality of Kibana's unified search experience. | 134 | 2 | 99 | 20 | | upgradeAssistant | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 | @@ -186,7 +187,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Registers the vega visualization. Is the elastic version of vega and vega-lite libraries. | 2 | 0 | 2 | 0 | | | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Contains the vislib visualizations. These are the classical area/line/bar, gauge/goal and heatmap charts. We want to replace them with elastic-charts. | 26 | 0 | 25 | 1 | | | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Contains the new xy-axis chart using the elastic-charts library, which will eventually replace the vislib xy-axis charts including bar, area, and line. | 53 | 0 | 50 | 5 | -| | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Contains the shared architecture among all the legacy visualizations, e.g. the visualization type registry or the visualization embeddable. | 800 | 12 | 770 | 18 | +| | [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualizations) | Contains the shared architecture among all the legacy visualizations, e.g. the visualization type registry or the visualization embeddable. | 801 | 12 | 771 | 18 | | watcher | [Stack Management](https://github.com/orgs/elastic/teams/kibana-stack-management) | - | 0 | 0 | 0 | 0 | ## Package Directory @@ -384,11 +385,11 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Owner missing] | - | 9 | 1 | 9 | 0 | | | [Owner missing] | - | 101 | 0 | 85 | 0 | | | [Owner missing] | - | 15 | 0 | 9 | 0 | -| | [Owner missing] | - | 28 | 2 | 25 | 0 | +| | [Owner missing] | - | 27 | 2 | 24 | 0 | | | [Owner missing] | - | 68 | 0 | 68 | 2 | | | [Owner missing] | - | 1 | 0 | 1 | 0 | | | [Owner missing] | - | 19 | 0 | 11 | 0 | -| | Kibana Core | - | 5 | 0 | 4 | 37 | +| | Kibana Core | - | 35102 | 0 | 34695 | 0 | | | [Owner missing] | - | 4 | 0 | 4 | 0 | | | [Owner missing] | - | 27 | 0 | 14 | 1 | | | Kibana Core | - | 7 | 0 | 3 | 0 | @@ -499,7 +500,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Owner missing] | - | 2 | 0 | 0 | 0 | | | [Owner missing] | - | 15 | 0 | 4 | 0 | | | [Owner missing] | - | 9 | 0 | 3 | 0 | -| | [Owner missing] | SLO io-ts schema definition and common models shared between public and server. | 72 | 0 | 72 | 0 | +| | [Owner missing] | SLO io-ts schema definition and common models shared between public and server. | 73 | 0 | 73 | 0 | | | [Owner missing] | - | 20 | 0 | 12 | 0 | | | Kibana Core | - | 97 | 1 | 64 | 1 | | | [Owner missing] | - | 4 | 0 | 2 | 0 | @@ -515,7 +516,7 @@ tags: ['contributor', 'dev', 'apidocs', 'kibana'] | | [Owner missing] | - | 45 | 0 | 36 | 0 | | | [Owner missing] | - | 7 | 0 | 6 | 0 | | | [Owner missing] | - | 58 | 0 | 5 | 0 | -| | [Owner missing] | - | 34 | 0 | 14 | 1 | +| | [Owner missing] | - | 35 | 0 | 15 | 1 | | | [Owner missing] | - | 2 | 0 | 2 | 0 | | | [Owner missing] | - | 24 | 0 | 14 | 0 | | | [Owner missing] | - | 6 | 0 | 2 | 0 | diff --git a/api_docs/presentation_util.mdx b/api_docs/presentation_util.mdx index f7cee4742e313..75c9039f8979b 100644 --- a/api_docs/presentation_util.mdx +++ b/api_docs/presentation_util.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/presentationUtil title: "presentationUtil" image: https://source.unsplash.com/400x175/?github description: API docs for the presentationUtil plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'presentationUtil'] --- import presentationUtilObj from './presentation_util.devdocs.json'; diff --git a/api_docs/profiling.mdx b/api_docs/profiling.mdx index 5fdf09635d65c..f65eeeb91a62b 100644 --- a/api_docs/profiling.mdx +++ b/api_docs/profiling.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/profiling title: "profiling" image: https://source.unsplash.com/400x175/?github description: API docs for the profiling plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'profiling'] --- import profilingObj from './profiling.devdocs.json'; diff --git a/api_docs/remote_clusters.mdx b/api_docs/remote_clusters.mdx index 84df35fc21a9b..399a0908d0f5a 100644 --- a/api_docs/remote_clusters.mdx +++ b/api_docs/remote_clusters.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/remoteClusters title: "remoteClusters" image: https://source.unsplash.com/400x175/?github description: API docs for the remoteClusters plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'remoteClusters'] --- import remoteClustersObj from './remote_clusters.devdocs.json'; diff --git a/api_docs/reporting.mdx b/api_docs/reporting.mdx index 98fe9b447f2e1..b83d6d3af0b51 100644 --- a/api_docs/reporting.mdx +++ b/api_docs/reporting.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/reporting title: "reporting" image: https://source.unsplash.com/400x175/?github description: API docs for the reporting plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'reporting'] --- import reportingObj from './reporting.devdocs.json'; diff --git a/api_docs/rollup.mdx b/api_docs/rollup.mdx index cf348b76faa70..401c8ce0d0389 100644 --- a/api_docs/rollup.mdx +++ b/api_docs/rollup.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/rollup title: "rollup" image: https://source.unsplash.com/400x175/?github description: API docs for the rollup plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'rollup'] --- import rollupObj from './rollup.devdocs.json'; diff --git a/api_docs/rule_registry.devdocs.json b/api_docs/rule_registry.devdocs.json index 7ccd61d57cad5..34a50ca6688ef 100644 --- a/api_docs/rule_registry.devdocs.json +++ b/api_docs/rule_registry.devdocs.json @@ -1938,19 +1938,12 @@ { "parentPluginId": "ruleRegistry", "id": "def-server.AlertAuditEventParams.outcome", - "type": "CompoundType", + "type": "string", "tags": [], "label": "outcome", "description": [], "signature": [ - { - "pluginId": "@kbn/ecs", - "scope": "common", - "docId": "kibKbnEcsPluginApi", - "section": "def-common.EcsEventOutcome", - "text": "EcsEventOutcome" - }, - " | undefined" + "string | undefined" ], "path": "x-pack/plugins/rule_registry/server/alert_data_client/audit_events.ts", "deprecated": false, diff --git a/api_docs/rule_registry.mdx b/api_docs/rule_registry.mdx index ee10961989f17..2942701883e5f 100644 --- a/api_docs/rule_registry.mdx +++ b/api_docs/rule_registry.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ruleRegistry title: "ruleRegistry" image: https://source.unsplash.com/400x175/?github description: API docs for the ruleRegistry plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ruleRegistry'] --- import ruleRegistryObj from './rule_registry.devdocs.json'; diff --git a/api_docs/runtime_fields.mdx b/api_docs/runtime_fields.mdx index 127230c60b313..9059f132d4e71 100644 --- a/api_docs/runtime_fields.mdx +++ b/api_docs/runtime_fields.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/runtimeFields title: "runtimeFields" image: https://source.unsplash.com/400x175/?github description: API docs for the runtimeFields plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'runtimeFields'] --- import runtimeFieldsObj from './runtime_fields.devdocs.json'; diff --git a/api_docs/saved_objects.mdx b/api_docs/saved_objects.mdx index d1ae0cdd44378..8fbd6569c1624 100644 --- a/api_docs/saved_objects.mdx +++ b/api_docs/saved_objects.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjects title: "savedObjects" image: https://source.unsplash.com/400x175/?github description: API docs for the savedObjects plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjects'] --- import savedObjectsObj from './saved_objects.devdocs.json'; diff --git a/api_docs/saved_objects_finder.mdx b/api_docs/saved_objects_finder.mdx index 420fb21472668..6e04c37c030c6 100644 --- a/api_docs/saved_objects_finder.mdx +++ b/api_docs/saved_objects_finder.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsFinder title: "savedObjectsFinder" image: https://source.unsplash.com/400x175/?github description: API docs for the savedObjectsFinder plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsFinder'] --- import savedObjectsFinderObj from './saved_objects_finder.devdocs.json'; diff --git a/api_docs/saved_objects_management.mdx b/api_docs/saved_objects_management.mdx index 6af81c24bb803..7a053a176c0bf 100644 --- a/api_docs/saved_objects_management.mdx +++ b/api_docs/saved_objects_management.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsManagement title: "savedObjectsManagement" image: https://source.unsplash.com/400x175/?github description: API docs for the savedObjectsManagement plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsManagement'] --- import savedObjectsManagementObj from './saved_objects_management.devdocs.json'; diff --git a/api_docs/saved_objects_tagging.mdx b/api_docs/saved_objects_tagging.mdx index 55a6c8381c241..35bdd65315d57 100644 --- a/api_docs/saved_objects_tagging.mdx +++ b/api_docs/saved_objects_tagging.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTagging title: "savedObjectsTagging" image: https://source.unsplash.com/400x175/?github description: API docs for the savedObjectsTagging plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTagging'] --- import savedObjectsTaggingObj from './saved_objects_tagging.devdocs.json'; diff --git a/api_docs/saved_objects_tagging_oss.mdx b/api_docs/saved_objects_tagging_oss.mdx index 2204398d32a32..0466d68c94f90 100644 --- a/api_docs/saved_objects_tagging_oss.mdx +++ b/api_docs/saved_objects_tagging_oss.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedObjectsTaggingOss title: "savedObjectsTaggingOss" image: https://source.unsplash.com/400x175/?github description: API docs for the savedObjectsTaggingOss plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedObjectsTaggingOss'] --- import savedObjectsTaggingOssObj from './saved_objects_tagging_oss.devdocs.json'; diff --git a/api_docs/saved_search.mdx b/api_docs/saved_search.mdx index c8dc58ae28ac7..b58a7a01895cd 100644 --- a/api_docs/saved_search.mdx +++ b/api_docs/saved_search.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/savedSearch title: "savedSearch" image: https://source.unsplash.com/400x175/?github description: API docs for the savedSearch plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'savedSearch'] --- import savedSearchObj from './saved_search.devdocs.json'; diff --git a/api_docs/screenshot_mode.mdx b/api_docs/screenshot_mode.mdx index c68d9d43b87ae..f590e8554b1b9 100644 --- a/api_docs/screenshot_mode.mdx +++ b/api_docs/screenshot_mode.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotMode title: "screenshotMode" image: https://source.unsplash.com/400x175/?github description: API docs for the screenshotMode plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotMode'] --- import screenshotModeObj from './screenshot_mode.devdocs.json'; diff --git a/api_docs/screenshotting.mdx b/api_docs/screenshotting.mdx index 9e251ec2872cf..594f696fb3c50 100644 --- a/api_docs/screenshotting.mdx +++ b/api_docs/screenshotting.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/screenshotting title: "screenshotting" image: https://source.unsplash.com/400x175/?github description: API docs for the screenshotting plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'screenshotting'] --- import screenshottingObj from './screenshotting.devdocs.json'; diff --git a/api_docs/security.devdocs.json b/api_docs/security.devdocs.json index 6f77c2eda08bc..8ead0fb04ff88 100644 --- a/api_docs/security.devdocs.json +++ b/api_docs/security.devdocs.json @@ -1319,7 +1319,13 @@ "text": "AuditHttp" }, " extends ", - "EcsHttp" + { + "pluginId": "@kbn/ecs", + "scope": "common", + "docId": "kibKbnEcsPluginApi", + "section": "def-common.EcsHttp", + "text": "EcsHttp" + } ], "path": "x-pack/plugins/security/server/audit/audit_events.ts", "deprecated": false, @@ -1604,7 +1610,7 @@ "section": "def-server.AuditRequest", "text": "AuditRequest" }, - " extends Request" + " extends { body?: { bytes?: number | undefined; content?: string | undefined; } | undefined; bytes?: number | undefined; id?: string | undefined; method?: string | undefined; mime_type?: string | undefined; referrer?: string | undefined; }" ], "path": "x-pack/plugins/security/server/audit/audit_events.ts", "deprecated": false, diff --git a/api_docs/security.mdx b/api_docs/security.mdx index 5af06b37a16da..b8f3377d5e089 100644 --- a/api_docs/security.mdx +++ b/api_docs/security.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/security title: "security" image: https://source.unsplash.com/400x175/?github description: API docs for the security plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'security'] --- import securityObj from './security.devdocs.json'; diff --git a/api_docs/security_solution.mdx b/api_docs/security_solution.mdx index ad96e67593dba..ae0bd48a7df15 100644 --- a/api_docs/security_solution.mdx +++ b/api_docs/security_solution.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/securitySolution title: "securitySolution" image: https://source.unsplash.com/400x175/?github description: API docs for the securitySolution plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'securitySolution'] --- import securitySolutionObj from './security_solution.devdocs.json'; diff --git a/api_docs/session_view.mdx b/api_docs/session_view.mdx index 7f8a39b95aaaa..c4b6317addbc8 100644 --- a/api_docs/session_view.mdx +++ b/api_docs/session_view.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/sessionView title: "sessionView" image: https://source.unsplash.com/400x175/?github description: API docs for the sessionView plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'sessionView'] --- import sessionViewObj from './session_view.devdocs.json'; diff --git a/api_docs/share.mdx b/api_docs/share.mdx index 68f9f742ee5a8..d166b11049324 100644 --- a/api_docs/share.mdx +++ b/api_docs/share.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/share title: "share" image: https://source.unsplash.com/400x175/?github description: API docs for the share plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'share'] --- import shareObj from './share.devdocs.json'; diff --git a/api_docs/snapshot_restore.mdx b/api_docs/snapshot_restore.mdx index 65b064a72d6ea..1b8122c3eea79 100644 --- a/api_docs/snapshot_restore.mdx +++ b/api_docs/snapshot_restore.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/snapshotRestore title: "snapshotRestore" image: https://source.unsplash.com/400x175/?github description: API docs for the snapshotRestore plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'snapshotRestore'] --- import snapshotRestoreObj from './snapshot_restore.devdocs.json'; diff --git a/api_docs/spaces.mdx b/api_docs/spaces.mdx index 751b42cdb3595..604915b4c7096 100644 --- a/api_docs/spaces.mdx +++ b/api_docs/spaces.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/spaces title: "spaces" image: https://source.unsplash.com/400x175/?github description: API docs for the spaces plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'spaces'] --- import spacesObj from './spaces.devdocs.json'; diff --git a/api_docs/stack_alerts.mdx b/api_docs/stack_alerts.mdx index 9e42911806d78..c7a0868c703af 100644 --- a/api_docs/stack_alerts.mdx +++ b/api_docs/stack_alerts.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackAlerts title: "stackAlerts" image: https://source.unsplash.com/400x175/?github description: API docs for the stackAlerts plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackAlerts'] --- import stackAlertsObj from './stack_alerts.devdocs.json'; diff --git a/api_docs/stack_connectors.mdx b/api_docs/stack_connectors.mdx index 4d45e69fb3ac0..3351d739ab3c1 100644 --- a/api_docs/stack_connectors.mdx +++ b/api_docs/stack_connectors.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/stackConnectors title: "stackConnectors" image: https://source.unsplash.com/400x175/?github description: API docs for the stackConnectors plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'stackConnectors'] --- import stackConnectorsObj from './stack_connectors.devdocs.json'; diff --git a/api_docs/task_manager.devdocs.json b/api_docs/task_manager.devdocs.json index d907d2ef1abfd..915e316b089ae 100644 --- a/api_docs/task_manager.devdocs.json +++ b/api_docs/task_manager.devdocs.json @@ -473,15 +473,15 @@ "\nlist of failed tasks and errors caused failure" ], "signature": [ - "{ task: ", + "{ type: string; id: string; error: ", { - "pluginId": "taskManager", - "scope": "server", - "docId": "kibTaskManagerPluginApi", - "section": "def-server.ConcreteTaskInstance", - "text": "ConcreteTaskInstance" + "pluginId": "@kbn/core-saved-objects-common", + "scope": "common", + "docId": "kibKbnCoreSavedObjectsCommonPluginApi", + "section": "def-common.SavedObjectError", + "text": "SavedObjectError" }, - "; error: Error; }[]" + "; }[]" ], "path": "x-pack/plugins/task_manager/server/task_scheduling.ts", "deprecated": false, diff --git a/api_docs/task_manager.mdx b/api_docs/task_manager.mdx index c9de28875b1e5..9728f3d296803 100644 --- a/api_docs/task_manager.mdx +++ b/api_docs/task_manager.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/taskManager title: "taskManager" image: https://source.unsplash.com/400x175/?github description: API docs for the taskManager plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'taskManager'] --- import taskManagerObj from './task_manager.devdocs.json'; diff --git a/api_docs/telemetry.mdx b/api_docs/telemetry.mdx index 0cf2a73a4529d..d6066c5a8f19c 100644 --- a/api_docs/telemetry.mdx +++ b/api_docs/telemetry.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetry title: "telemetry" image: https://source.unsplash.com/400x175/?github description: API docs for the telemetry plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetry'] --- import telemetryObj from './telemetry.devdocs.json'; diff --git a/api_docs/telemetry_collection_manager.mdx b/api_docs/telemetry_collection_manager.mdx index 22579d69d8ced..81c2a0a5c224f 100644 --- a/api_docs/telemetry_collection_manager.mdx +++ b/api_docs/telemetry_collection_manager.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionManager title: "telemetryCollectionManager" image: https://source.unsplash.com/400x175/?github description: API docs for the telemetryCollectionManager plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionManager'] --- import telemetryCollectionManagerObj from './telemetry_collection_manager.devdocs.json'; diff --git a/api_docs/telemetry_collection_xpack.mdx b/api_docs/telemetry_collection_xpack.mdx index def0dc23b8477..72b3b2981113d 100644 --- a/api_docs/telemetry_collection_xpack.mdx +++ b/api_docs/telemetry_collection_xpack.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryCollectionXpack title: "telemetryCollectionXpack" image: https://source.unsplash.com/400x175/?github description: API docs for the telemetryCollectionXpack plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryCollectionXpack'] --- import telemetryCollectionXpackObj from './telemetry_collection_xpack.devdocs.json'; diff --git a/api_docs/telemetry_management_section.mdx b/api_docs/telemetry_management_section.mdx index 3c6462dd3109b..e887c4a616747 100644 --- a/api_docs/telemetry_management_section.mdx +++ b/api_docs/telemetry_management_section.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/telemetryManagementSection title: "telemetryManagementSection" image: https://source.unsplash.com/400x175/?github description: API docs for the telemetryManagementSection plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'telemetryManagementSection'] --- import telemetryManagementSectionObj from './telemetry_management_section.devdocs.json'; diff --git a/api_docs/threat_intelligence.mdx b/api_docs/threat_intelligence.mdx index ba49c3b608b1f..647cf38b44234 100644 --- a/api_docs/threat_intelligence.mdx +++ b/api_docs/threat_intelligence.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/threatIntelligence title: "threatIntelligence" image: https://source.unsplash.com/400x175/?github description: API docs for the threatIntelligence plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'threatIntelligence'] --- import threatIntelligenceObj from './threat_intelligence.devdocs.json'; diff --git a/api_docs/timelines.mdx b/api_docs/timelines.mdx index a88d0a629b86b..82542f7863a55 100644 --- a/api_docs/timelines.mdx +++ b/api_docs/timelines.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/timelines title: "timelines" image: https://source.unsplash.com/400x175/?github description: API docs for the timelines plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'timelines'] --- import timelinesObj from './timelines.devdocs.json'; diff --git a/api_docs/transform.mdx b/api_docs/transform.mdx index 2d9bb58ccabac..30c01b5809ee0 100644 --- a/api_docs/transform.mdx +++ b/api_docs/transform.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/transform title: "transform" image: https://source.unsplash.com/400x175/?github description: API docs for the transform plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'transform'] --- import transformObj from './transform.devdocs.json'; diff --git a/api_docs/triggers_actions_ui.mdx b/api_docs/triggers_actions_ui.mdx index e9c9f30000f13..a5b827d84c928 100644 --- a/api_docs/triggers_actions_ui.mdx +++ b/api_docs/triggers_actions_ui.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/triggersActionsUi title: "triggersActionsUi" image: https://source.unsplash.com/400x175/?github description: API docs for the triggersActionsUi plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'triggersActionsUi'] --- import triggersActionsUiObj from './triggers_actions_ui.devdocs.json'; diff --git a/api_docs/ui_actions.mdx b/api_docs/ui_actions.mdx index 516218e9fb091..0a9c9e3a840ce 100644 --- a/api_docs/ui_actions.mdx +++ b/api_docs/ui_actions.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActions title: "uiActions" image: https://source.unsplash.com/400x175/?github description: API docs for the uiActions plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActions'] --- import uiActionsObj from './ui_actions.devdocs.json'; diff --git a/api_docs/ui_actions_enhanced.mdx b/api_docs/ui_actions_enhanced.mdx index 2ef3040290b0d..fde9d9379e62e 100644 --- a/api_docs/ui_actions_enhanced.mdx +++ b/api_docs/ui_actions_enhanced.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/uiActionsEnhanced title: "uiActionsEnhanced" image: https://source.unsplash.com/400x175/?github description: API docs for the uiActionsEnhanced plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'uiActionsEnhanced'] --- import uiActionsEnhancedObj from './ui_actions_enhanced.devdocs.json'; diff --git a/api_docs/unified_field_list.devdocs.json b/api_docs/unified_field_list.devdocs.json index cd858391eca56..a12ef194b88f5 100644 --- a/api_docs/unified_field_list.devdocs.json +++ b/api_docs/unified_field_list.devdocs.json @@ -1484,7 +1484,7 @@ "label": "useGroupedFields", "description": [], "signature": [ - "({\n dataViewId,\n allFields,\n services,\n isAffectedByGlobalFilter = false,\n popularFieldsLimit,\n sortedSelectedFields,\n getCustomFieldType,\n onOverrideFieldGroupDetails,\n onSupportedFieldFilter,\n onSelectedFieldFilter,\n onFilterField,\n}: ", + "({\n dataViewId,\n allFields,\n services,\n isAffectedByGlobalFilter = false,\n popularFieldsLimit,\n sortedSelectedFields,\n getCustomFieldType,\n onOverrideFieldGroupDetails,\n onSupportedFieldFilter,\n onSelectedFieldFilter,\n}: ", { "pluginId": "unifiedFieldList", "scope": "public", @@ -1511,7 +1511,7 @@ "id": "def-public.useGroupedFields.$1", "type": "Object", "tags": [], - "label": "{\n dataViewId,\n allFields,\n services,\n isAffectedByGlobalFilter = false,\n popularFieldsLimit,\n sortedSelectedFields,\n getCustomFieldType,\n onOverrideFieldGroupDetails,\n onSupportedFieldFilter,\n onSelectedFieldFilter,\n onFilterField,\n}", + "label": "{\n dataViewId,\n allFields,\n services,\n isAffectedByGlobalFilter = false,\n popularFieldsLimit,\n sortedSelectedFields,\n getCustomFieldType,\n onOverrideFieldGroupDetails,\n onSupportedFieldFilter,\n onSelectedFieldFilter,\n}", "description": [], "signature": [ { @@ -4266,38 +4266,6 @@ } ], "returnComment": [] - }, - { - "parentPluginId": "unifiedFieldList", - "id": "def-public.GroupedFieldsParams.onFilterField", - "type": "Function", - "tags": [], - "label": "onFilterField", - "description": [], - "signature": [ - "((field: T) => boolean) | undefined" - ], - "path": "src/plugins/unified_field_list/public/hooks/use_grouped_fields.ts", - "deprecated": false, - "trackAdoption": false, - "children": [ - { - "parentPluginId": "unifiedFieldList", - "id": "def-public.GroupedFieldsParams.onFilterField.$1", - "type": "Uncategorized", - "tags": [], - "label": "field", - "description": [], - "signature": [ - "T" - ], - "path": "src/plugins/unified_field_list/public/hooks/use_grouped_fields.ts", - "deprecated": false, - "trackAdoption": false, - "isRequired": true - } - ], - "returnComment": [] } ], "initialIsOpen": false @@ -5042,21 +5010,6 @@ "interfaces": [], "enums": [], "misc": [ - { - "parentPluginId": "unifiedFieldList", - "id": "def-common.FIELD_EXISTENCE_SETTING", - "type": "string", - "tags": [], - "label": "FIELD_EXISTENCE_SETTING", - "description": [], - "signature": [ - "\"lens:useFieldExistenceSampling\"" - ], - "path": "src/plugins/unified_field_list/common/index.ts", - "deprecated": false, - "trackAdoption": false, - "initialIsOpen": false - }, { "parentPluginId": "unifiedFieldList", "id": "def-common.PLUGIN_ID", diff --git a/api_docs/unified_field_list.mdx b/api_docs/unified_field_list.mdx index 00b6cab4773c8..fdd949f24e910 100644 --- a/api_docs/unified_field_list.mdx +++ b/api_docs/unified_field_list.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedFieldList title: "unifiedFieldList" image: https://source.unsplash.com/400x175/?github description: API docs for the unifiedFieldList plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedFieldList'] --- import unifiedFieldListObj from './unified_field_list.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Data Discovery](https://github.com/orgs/elastic/teams/kibana-data-disco | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 270 | 0 | 245 | 7 | +| 267 | 0 | 242 | 7 | ## Client diff --git a/api_docs/unified_histogram.devdocs.json b/api_docs/unified_histogram.devdocs.json index aca1afdb564fa..a5555275c7b58 100644 --- a/api_docs/unified_histogram.devdocs.json +++ b/api_docs/unified_histogram.devdocs.json @@ -1038,7 +1038,15 @@ "section": "def-common.Datatable", "text": "Datatable" }, - ", \"rows\" | \"columns\">; column: number; row: number; value: any; }[]; timeFieldName?: string | undefined; negate?: boolean | undefined; }) => void) | undefined" + ", \"rows\" | \"columns\">; column: number; row: number; value: any; }[]; timeFieldName?: string | undefined; negate?: boolean | undefined; } | { data: { table: Pick<", + { + "pluginId": "expressions", + "scope": "common", + "docId": "kibExpressionsPluginApi", + "section": "def-common.Datatable", + "text": "Datatable" + }, + ", \"rows\" | \"columns\">; column: number; value: any[]; }; timeFieldName?: string | undefined; negate?: boolean | undefined; }) => void) | undefined" ], "path": "src/plugins/unified_histogram/public/layout/layout.tsx", "deprecated": false, diff --git a/api_docs/unified_histogram.mdx b/api_docs/unified_histogram.mdx index 6b9c6903546d4..157993dc6b492 100644 --- a/api_docs/unified_histogram.mdx +++ b/api_docs/unified_histogram.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedHistogram title: "unifiedHistogram" image: https://source.unsplash.com/400x175/?github description: API docs for the unifiedHistogram plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedHistogram'] --- import unifiedHistogramObj from './unified_histogram.devdocs.json'; diff --git a/api_docs/unified_search.mdx b/api_docs/unified_search.mdx index f272c481dd11f..078a9bec19057 100644 --- a/api_docs/unified_search.mdx +++ b/api_docs/unified_search.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch title: "unifiedSearch" image: https://source.unsplash.com/400x175/?github description: API docs for the unifiedSearch plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch'] --- import unifiedSearchObj from './unified_search.devdocs.json'; diff --git a/api_docs/unified_search_autocomplete.mdx b/api_docs/unified_search_autocomplete.mdx index 77d73b78e172e..fa4f8ef736387 100644 --- a/api_docs/unified_search_autocomplete.mdx +++ b/api_docs/unified_search_autocomplete.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/unifiedSearch-autocomplete title: "unifiedSearch.autocomplete" image: https://source.unsplash.com/400x175/?github description: API docs for the unifiedSearch.autocomplete plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'unifiedSearch.autocomplete'] --- import unifiedSearchAutocompleteObj from './unified_search_autocomplete.devdocs.json'; diff --git a/api_docs/url_forwarding.mdx b/api_docs/url_forwarding.mdx index f17065e04542f..15705935dd12f 100644 --- a/api_docs/url_forwarding.mdx +++ b/api_docs/url_forwarding.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/urlForwarding title: "urlForwarding" image: https://source.unsplash.com/400x175/?github description: API docs for the urlForwarding plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'urlForwarding'] --- import urlForwardingObj from './url_forwarding.devdocs.json'; diff --git a/api_docs/usage_collection.mdx b/api_docs/usage_collection.mdx index 5b48442ddb42a..9f7bf50bc8e7e 100644 --- a/api_docs/usage_collection.mdx +++ b/api_docs/usage_collection.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/usageCollection title: "usageCollection" image: https://source.unsplash.com/400x175/?github description: API docs for the usageCollection plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'usageCollection'] --- import usageCollectionObj from './usage_collection.devdocs.json'; diff --git a/api_docs/ux.mdx b/api_docs/ux.mdx index 5c7349a555015..7622db863ceff 100644 --- a/api_docs/ux.mdx +++ b/api_docs/ux.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/ux title: "ux" image: https://source.unsplash.com/400x175/?github description: API docs for the ux plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'ux'] --- import uxObj from './ux.devdocs.json'; diff --git a/api_docs/vis_default_editor.mdx b/api_docs/vis_default_editor.mdx index 2f54b387f6615..a9d88ccd62f34 100644 --- a/api_docs/vis_default_editor.mdx +++ b/api_docs/vis_default_editor.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visDefaultEditor title: "visDefaultEditor" image: https://source.unsplash.com/400x175/?github description: API docs for the visDefaultEditor plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visDefaultEditor'] --- import visDefaultEditorObj from './vis_default_editor.devdocs.json'; diff --git a/api_docs/vis_type_gauge.mdx b/api_docs/vis_type_gauge.mdx index 65c6f0898acd3..0be59ed3e499d 100644 --- a/api_docs/vis_type_gauge.mdx +++ b/api_docs/vis_type_gauge.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeGauge title: "visTypeGauge" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeGauge plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeGauge'] --- import visTypeGaugeObj from './vis_type_gauge.devdocs.json'; diff --git a/api_docs/vis_type_heatmap.mdx b/api_docs/vis_type_heatmap.mdx index 5d4c295dc0c78..3f5f190ac56fd 100644 --- a/api_docs/vis_type_heatmap.mdx +++ b/api_docs/vis_type_heatmap.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeHeatmap title: "visTypeHeatmap" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeHeatmap plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeHeatmap'] --- import visTypeHeatmapObj from './vis_type_heatmap.devdocs.json'; diff --git a/api_docs/vis_type_pie.mdx b/api_docs/vis_type_pie.mdx index 83d3f2beca7a8..286055d453f6c 100644 --- a/api_docs/vis_type_pie.mdx +++ b/api_docs/vis_type_pie.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypePie title: "visTypePie" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypePie plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypePie'] --- import visTypePieObj from './vis_type_pie.devdocs.json'; diff --git a/api_docs/vis_type_table.mdx b/api_docs/vis_type_table.mdx index 2359b557affc9..d6765bd753118 100644 --- a/api_docs/vis_type_table.mdx +++ b/api_docs/vis_type_table.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTable title: "visTypeTable" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeTable plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTable'] --- import visTypeTableObj from './vis_type_table.devdocs.json'; diff --git a/api_docs/vis_type_timelion.mdx b/api_docs/vis_type_timelion.mdx index f1dd8fa7504d8..eff3d6cf88b06 100644 --- a/api_docs/vis_type_timelion.mdx +++ b/api_docs/vis_type_timelion.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimelion title: "visTypeTimelion" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeTimelion plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimelion'] --- import visTypeTimelionObj from './vis_type_timelion.devdocs.json'; diff --git a/api_docs/vis_type_timeseries.mdx b/api_docs/vis_type_timeseries.mdx index a71e01a107d27..b26a441c96a01 100644 --- a/api_docs/vis_type_timeseries.mdx +++ b/api_docs/vis_type_timeseries.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeTimeseries title: "visTypeTimeseries" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeTimeseries plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeTimeseries'] --- import visTypeTimeseriesObj from './vis_type_timeseries.devdocs.json'; diff --git a/api_docs/vis_type_vega.mdx b/api_docs/vis_type_vega.mdx index 8699c001f12ff..0c894e6f937ec 100644 --- a/api_docs/vis_type_vega.mdx +++ b/api_docs/vis_type_vega.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVega title: "visTypeVega" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeVega plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVega'] --- import visTypeVegaObj from './vis_type_vega.devdocs.json'; diff --git a/api_docs/vis_type_vislib.mdx b/api_docs/vis_type_vislib.mdx index fb348433b9a43..a215e3d822935 100644 --- a/api_docs/vis_type_vislib.mdx +++ b/api_docs/vis_type_vislib.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeVislib title: "visTypeVislib" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeVislib plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeVislib'] --- import visTypeVislibObj from './vis_type_vislib.devdocs.json'; diff --git a/api_docs/vis_type_xy.mdx b/api_docs/vis_type_xy.mdx index c487f4833f3d3..3d6ab852d5891 100644 --- a/api_docs/vis_type_xy.mdx +++ b/api_docs/vis_type_xy.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visTypeXy title: "visTypeXy" image: https://source.unsplash.com/400x175/?github description: API docs for the visTypeXy plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visTypeXy'] --- import visTypeXyObj from './vis_type_xy.devdocs.json'; diff --git a/api_docs/visualizations.devdocs.json b/api_docs/visualizations.devdocs.json index 2d07aa3db8e21..f78ad0845954c 100644 --- a/api_docs/visualizations.devdocs.json +++ b/api_docs/visualizations.devdocs.json @@ -6855,6 +6855,20 @@ "deprecated": false, "trackAdoption": false }, + { + "parentPluginId": "visualizations", + "id": "def-public.VIS_EVENT_TO_TRIGGER.multiFilter", + "type": "string", + "tags": [], + "label": "multiFilter", + "description": [], + "signature": [ + "\"MULTI_VALUE_CLICK_TRIGGER\"" + ], + "path": "src/plugins/visualizations/public/embeddable/events.ts", + "deprecated": false, + "trackAdoption": false + }, { "parentPluginId": "visualizations", "id": "def-public.VIS_EVENT_TO_TRIGGER.tableRowContextMenuClick", diff --git a/api_docs/visualizations.mdx b/api_docs/visualizations.mdx index ad5edb9b89fa3..c2ad8825fb20a 100644 --- a/api_docs/visualizations.mdx +++ b/api_docs/visualizations.mdx @@ -8,7 +8,7 @@ slug: /kibana-dev-docs/api/visualizations title: "visualizations" image: https://source.unsplash.com/400x175/?github description: API docs for the visualizations plugin -date: 2023-01-25 +date: 2023-01-27 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'visualizations'] --- import visualizationsObj from './visualizations.devdocs.json'; @@ -21,7 +21,7 @@ Contact [Vis Editors](https://github.com/orgs/elastic/teams/kibana-visualization | Public API count | Any count | Items lacking comments | Missing exports | |-------------------|-----------|------------------------|-----------------| -| 800 | 12 | 770 | 18 | +| 801 | 12 | 771 | 18 | ## Client diff --git a/docs/api-generated/connectors/connector-apis-passthru.asciidoc b/docs/api-generated/connectors/connector-apis-passthru.asciidoc index ac2c18b4f2c29..98ef93db6e820 100644 --- a/docs/api-generated/connectors/connector-apis-passthru.asciidoc +++ b/docs/api-generated/connectors/connector-apis-passthru.asciidoc @@ -23,6 +23,7 @@ Any modifications made to this file will be overwritten.

  • get /s/{spaceId}/api/actions/connector/{connectorId}
  • get /s/{spaceId}/api/actions/connector_types
  • get /s/{spaceId}/api/actions/connectors
    • +
  • post /s/{spaceId}/api/actions/connector/{connectorId}/_execute
  • put /s/{spaceId}/api/actions/connector/{connectorId}
    • @@ -90,7 +91,7 @@ Any modifications made to this file will be overwritten. connector_response_properties

    401

    Authorization information is missing or invalid. - createConnector_401_response + 401_response
    @@ -138,7 +139,7 @@ Any modifications made to this file will be overwritten.

    401

    Authorization information is missing or invalid. - createConnector_401_response + 401_response

    404

    Object is not found. getConnector_404_response @@ -190,7 +191,7 @@ Any modifications made to this file will be overwritten. connector_response_properties

    401

    Authorization information is missing or invalid. - createConnector_401_response + 401_response

    404

    Object is not found. getConnector_404_response @@ -254,7 +255,7 @@ Any modifications made to this file will be overwritten.

    401

    Authorization information is missing or invalid. - createConnector_401_response + 401_response
    @@ -312,7 +313,78 @@ Any modifications made to this file will be overwritten.

    401

    Authorization information is missing or invalid. -     createConnector_401_response + 401_response +
    +
    +
    +
    + Up + 
    post /s/{spaceId}/api/actions/connector/{connectorId}/_execute
    +
    Runs a connector. (runConnector)
    +
    You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have read privileges for the Actions and Connectors feature in the Management section of the Kibana feature privileges. If you use an index connector, you must also have all, create, index, or write indices privileges.
    + +

    Path parameters

    +
    +
    connectorId (required)
    + +
    Path Parameter — An identifier for the connector. default: null
    spaceId (required)
    + +
    Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
    +
    + +

    Consumes

    + This API call consumes the following media types via the Content-Type request header: +
      +
    • application/json
      • +
    + +

    Request body

    +
    +
    Run_connector_request_body_properties Run_connector_request_body_properties (required)
    + +
    Body Parameter —
    + +
    + +

    Request headers

    +
    +
    kbn-xsrf (required)
    + +
    Header Parameter — default: null
    + +
    + + + +

    Return type

    +
    + runConnector_200_response + +
    + + + +

    Example data

    +
    Content-Type: application/json
    + 
    {
+  "connector_id" : "connector_id",
+  "status" : "error"
+}
    + +

    Produces

    + This API call produces the following media types according to the Accept request header; + the media type will be conveyed by the Content-Type response header. +
      +
    • application/json
      • +
    + +

    Responses

    +

    200

    + Indicates a successful call. + runConnector_200_response +

    401

    + Authorization information is missing or invalid. + 401_response
    @@ -383,10 +455,10 @@ Any modifications made to this file will be overwritten. updateConnector_400_response

    401

    Authorization information is missing or invalid. - createConnector_401_response + 401_response

    404

    Object is not found. - getConnector_404_response + 404_response
    @@ -395,6 +467,8 @@ Any modifications made to this file will be overwritten.

    Table of Contents

      +
    1. 401_response - Unsuccessful rule API response
      2. +
    2. 404_response -
    3. Alert_identifier_mapping - Alert identifier mapping
    4. Case_comment_mapping - Case comment mapping
    5. Case_description_mapping - Case description mapping
      6. @@ -405,7 +479,10 @@ Any modifications made to this file will be overwritten.
    6. Get_connector_types_response_body_properties_inner -
    7. Get_connectors_response_body_properties - Get connectors response body properties
    8. Rule_name_mapping - Rule name mapping
      9. +
    9. Run_connector_request_body_properties - Run connector request body properties
      10. +
    10. Run_connector_request_body_properties_params -
    11. Severity_mapping - Severity mapping
      12. +
    12. Subaction_parameters - Subaction parameters
    13. Update_connector_request_body_properties - Update connector request body properties
    14. config_properties_cases_webhook - Connector request properties for Webhook - Case Management connector
    15. config_properties_index - Connector request properties for an index connector
      16. @@ -434,7 +511,6 @@ Any modifications made to this file will be overwritten.
    16. connector_response_properties_webhook - Connector response properties for a Webhook connector
    17. connector_response_properties_xmatters - Connector response properties for an xMatters connector
    18. connector_types - Connector types
      19. -
    19. createConnector_401_response -
    20. create_connector_request_cases_webhook - Create Webhook - Case Managment connector request
    21. create_connector_request_email - Create email connector request
    22. create_connector_request_index - Create index connector request
      23. @@ -454,6 +530,38 @@ Any modifications made to this file will be overwritten.
    23. create_connector_request_xmatters - Create xMatters connector request
    24. features -
    25. getConnector_404_response -
      26. +
    26. runConnector_200_response -
      27. +
    27. runConnector_200_response_data -
      28. +
    28. run_connector_params_documents - Index connector parameters
      29. +
    29. run_connector_params_level_message - Server log connector parameters
      30. +
    30. run_connector_subaction_addevent - The addEvent subaction
      31. +
    31. run_connector_subaction_addevent_subActionParams -
      32. +
    32. run_connector_subaction_closealert - The closeAlert subaction
      33. +
    33. run_connector_subaction_closealert_subActionParams -
      34. +
    34. run_connector_subaction_createalert - The createAlert subaction
      35. +
    35. run_connector_subaction_createalert_subActionParams -
      36. +
    36. run_connector_subaction_createalert_subActionParams_responders_inner -
      37. +
    37. run_connector_subaction_createalert_subActionParams_visibleTo_inner -
      38. +
    38. run_connector_subaction_fieldsbyissuetype - The fieldsByIssueType subaction
      39. +
    39. run_connector_subaction_fieldsbyissuetype_subActionParams -
      40. +
    40. run_connector_subaction_getchoices - The getChoices subaction
      41. +
    41. run_connector_subaction_getchoices_subActionParams -
      42. +
    42. run_connector_subaction_getfields - The getFields subaction
      43. +
    43. run_connector_subaction_getincident - The getIncident subaction
      44. +
    44. run_connector_subaction_getincident_subActionParams -
      45. +
    45. run_connector_subaction_issue - The issue subaction
      46. +
    46. run_connector_subaction_issue_subActionParams -
      47. +
    47. run_connector_subaction_issues - The issues subaction
      48. +
    48. run_connector_subaction_issues_subActionParams -
      49. +
    49. run_connector_subaction_issuetypes - The issueTypes subaction
      50. +
    50. run_connector_subaction_pushtoservice - The pushToService subaction
      51. +
    51. run_connector_subaction_pushtoservice_subActionParams -
      52. +
    52. run_connector_subaction_pushtoservice_subActionParams_comments_inner -
      53. +
    53. run_connector_subaction_pushtoservice_subActionParams_incident -
      54. +
    54. run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip -
      55. +
    55. run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash -
      56. +
    56. run_connector_subaction_pushtoservice_subActionParams_incident_malware_url -
      57. +
    57. run_connector_subaction_pushtoservice_subActionParams_incident_source_ip -
    58. secrets_properties_cases_webhook - Connector secrets properties for Webhook - Case Management connector
    59. secrets_properties_jira - Connector secrets properties for a Jira connector
    60. secrets_properties_opsgenie - Connector secrets properties for an Opsgenie connector
      61. @@ -472,6 +580,32 @@ Any modifications made to this file will be overwritten.
    61. update_connector_request_swimlane - Update Swimlane connector request
    +
    +

    401_response - Unsuccessful rule API response Up

    +
    +
    +
    error (optional)
    String
    +
    Enum:
    +
    Unauthorized
    +
    message (optional)
    String
    +
    statusCode (optional)
    Integer
    +
    Enum:
    +
    401
    +
    +
    +
    +

    404_response - Up

    +
    +
    +
    error (optional)
    String
    +
    Enum:
    +
    Not Found
    +
    message (optional)
    String
    +
    statusCode (optional)
    Integer
    +
    Enum:
    +
    404
    +
    +

    Alert_identifier_mapping - Alert identifier mapping Up

    Mapping for the alert ID.
    @@ -584,6 +718,28 @@ Any modifications made to this file will be overwritten.
    name
    String The name of the field in Swimlane.
    +
    +

    Run_connector_request_body_properties - Run connector request body properties Up

    +
    The properties vary depending on the connector type.
    +
    +
    params
    Run_connector_request_body_properties_params
    +
    +
    +
    +

    Run_connector_request_body_properties_params - Up

    +
    +
    +
    documents
    array[map[String, oas_any_type_not_mapped]] The documents in JSON format for index connectors.
    +
    level (optional)
    String The log level of the message for server log connectors.
    +
    Enum:
    +
    debug
    error
    fatal
    info
    trace
    warn
    +
    message
    String The message for server log connectors.
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    pushToService
    +
    subActionParams
    run_connector_subaction_pushtoservice_subActionParams
    +
    +

    Severity_mapping - Severity mapping Up

    Mapping for the severity.
    @@ -594,6 +750,16 @@ Any modifications made to this file will be overwritten.
    name
    String The name of the field in Swimlane.
    +
    +

    Subaction_parameters - Subaction parameters Up

    +
    Test an action that involves a subaction.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    pushToService
    +
    subActionParams
    run_connector_subaction_pushtoservice_subActionParams
    +
    +

    Update_connector_request_body_properties - Update connector request body properties Up

    The properties vary depending on the connector type.
    @@ -971,15 +1137,6 @@ Any modifications made to this file will be overwritten.
    -
    -

    createConnector_401_response - Up

    -
    -
    -
    error (optional)
    String
    -
    message (optional)
    String
    -
    statusCode (optional)
    Integer
    -
    -

    create_connector_request_cases_webhook - Create Webhook - Case Managment connector request Up

    The Webhook - Case Management connector uses axios to send POST, PUT, and GET requests to a case management RESTful API web service.
    @@ -1194,6 +1351,325 @@ Any modifications made to this file will be overwritten.
    statusCode (optional)
    Integer
    +
    +

    runConnector_200_response - Up

    +
    +
    +
    connector_id
    String The identifier for the connector.
    +
    data (optional)
    runConnector_200_response_data
    +
    status
    String The status of the action.
    +
    Enum:
    +
    error
    ok
    +
    +
    +
    +

    runConnector_200_response_data - Up

    +
    +
    +
    +
    +
    +

    run_connector_params_documents - Index connector parameters Up

    +
    Test an action that indexes a document into Elasticsearch.
    +
    +
    documents
    array[map[String, oas_any_type_not_mapped]] The documents in JSON format for index connectors.
    +
    +
    +
    +

    run_connector_params_level_message - Server log connector parameters Up

    +
    Test an action that writes an entry to the Kibana server log.
    +
    +
    level (optional)
    String The log level of the message for server log connectors.
    +
    Enum:
    +
    debug
    error
    fatal
    info
    trace
    warn
    +
    message
    String The message for server log connectors.
    +
    +
    +
    +

    run_connector_subaction_addevent - The addEvent subaction Up

    +
    The addEvent subaction for ServiceNow ITOM connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    addEvent
    +
    subActionParams (optional)
    run_connector_subaction_addevent_subActionParams
    +
    +
    +
    +

    run_connector_subaction_addevent_subActionParams - Up

    +
    The set of configuration properties for the action.
    +
    +
    additional_info (optional)
    String Additional information about the event.
    +
    description (optional)
    String The details about the event.
    +
    event_class (optional)
    String A specific instance of the source.
    +
    message_key (optional)
    String All actions sharing this key are associated with the same ServiceNow alert. The default value is <rule ID>:<alert instance ID>.
    +
    metric_name (optional)
    String The name of the metric.
    +
    node (optional)
    String The host that the event was triggered for.
    +
    resource (optional)
    String The name of the resource.
    +
    severity (optional)
    String The severity of the event.
    +
    source (optional)
    String The name of the event source type.
    +
    time_of_event (optional)
    String The time of the event.
    +
    type (optional)
    String The type of event.
    +
    +
    +
    +

    run_connector_subaction_closealert - The closeAlert subaction Up

    +
    The closeAlert subaction for Opsgenie connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    closeAlert
    +
    subActionParams
    run_connector_subaction_closealert_subActionParams
    +
    +
    +
    +

    run_connector_subaction_closealert_subActionParams - Up

    +
    +
    +
    alias
    String The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
    +
    note (optional)
    String Additional information for the alert.
    +
    source (optional)
    String The display name for the source of the alert.
    +
    user (optional)
    String The display name for the owner.
    +
    +
    +
    +

    run_connector_subaction_createalert - The createAlert subaction Up

    +
    The createAlert subaction for Opsgenie connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    createAlert
    +
    subActionParams
    run_connector_subaction_createalert_subActionParams
    +
    +
    +
    +

    run_connector_subaction_createalert_subActionParams - Up

    +
    +
    +
    actions (optional)
    array[String] The custom actions available to the alert.
    +
    alias (optional)
    String The unique identifier used for alert deduplication in Opsgenie.
    +
    description (optional)
    String A description that provides detailed information about the alert.
    +
    details (optional)
    map[String, oas_any_type_not_mapped] The custom properties of the alert.
    +
    entity (optional)
    String The domain of the alert. For example, the application or server name.
    +
    message
    String The alert message.
    +
    note (optional)
    String Additional information for the alert.
    +
    priority (optional)
    String The priority level for the alert.
    +
    Enum:
    +
    P1
    P2
    P3
    P4
    P5
    +
    responders (optional)
    array[run_connector_subaction_createalert_subActionParams_responders_inner] The entities to receive notifications about the alert. If type is user, either id or username is required. If type is team, either id or name is required.
    +
    source (optional)
    String The display name for the source of the alert.
    +
    tags (optional)
    array[String] The tags for the alert.
    +
    user (optional)
    String The display name for the owner.
    +
    visibleTo (optional)
    array[run_connector_subaction_createalert_subActionParams_visibleTo_inner] The teams and users that the alert will be visible to without sending a notification. Only one of id, name, or username is required.
    +
    +
    +
    +

    run_connector_subaction_createalert_subActionParams_responders_inner - Up

    +
    +
    +
    id (optional)
    String The identifier for the entity.
    +
    name (optional)
    String The name of the entity.
    +
    type (optional)
    String The type of responders, in this case escalation.
    +
    Enum:
    +
    escalation
    schedule
    team
    user
    +
    username (optional)
    String A valid email address for the user.
    +
    +
    +
    +

    run_connector_subaction_createalert_subActionParams_visibleTo_inner - Up

    +
    +
    +
    id (optional)
    String The identifier for the entity.
    +
    name (optional)
    String The name of the entity.
    +
    type
    String Valid values are team and user.
    +
    Enum:
    +
    team
    user
    +
    username (optional)
    String The user name. This property is required only when the type is user.
    +
    +
    +
    +

    run_connector_subaction_fieldsbyissuetype - The fieldsByIssueType subaction Up

    +
    The fieldsByIssueType subaction for Jira connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    fieldsByIssueType
    +
    subActionParams
    run_connector_subaction_fieldsbyissuetype_subActionParams
    +
    +
    +
    +

    run_connector_subaction_fieldsbyissuetype_subActionParams - Up

    +
    +
    +
    id
    String The Jira issue type identifier.
    +
    +
    +
    +

    run_connector_subaction_getchoices - The getChoices subaction Up

    +
    The getChoices subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    getChoices
    +
    subActionParams
    run_connector_subaction_getchoices_subActionParams
    +
    +
    +
    +

    run_connector_subaction_getchoices_subActionParams - Up

    +
    The set of configuration properties for the action.
    +
    +
    fields
    array[String] An array of fields.
    +
    +
    +
    +

    run_connector_subaction_getfields - The getFields subaction Up

    +
    The getFields subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    getFields
    +
    +
    +
    +

    run_connector_subaction_getincident - The getIncident subaction Up

    +
    The getIncident subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    getIncident
    +
    subActionParams
    run_connector_subaction_getincident_subActionParams
    +
    +
    +
    +

    run_connector_subaction_getincident_subActionParams - Up

    +
    +
    +
    externalId
    String The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.
    +
    +
    +
    +

    run_connector_subaction_issue - The issue subaction Up

    +
    The issue subaction for Jira connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    issue
    +
    subActionParams (optional)
    run_connector_subaction_issue_subActionParams
    +
    +
    +
    +

    run_connector_subaction_issue_subActionParams - Up

    +
    +
    +
    id
    String The Jira issue identifier.
    +
    +
    +
    +

    run_connector_subaction_issues - The issues subaction Up

    +
    The issues subaction for Jira connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    issues
    +
    subActionParams
    run_connector_subaction_issues_subActionParams
    +
    +
    +
    +

    run_connector_subaction_issues_subActionParams - Up

    +
    +
    +
    title
    String The title of the Jira issue.
    +
    +
    +
    +

    run_connector_subaction_issuetypes - The issueTypes subaction Up

    +
    The issueTypes subaction for Jira connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    issueTypes
    +
    +
    +
    +

    run_connector_subaction_pushtoservice - The pushToService subaction Up

    +
    The pushToService subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
    +
    +
    subAction
    String The action to test.
    +
    Enum:
    +
    pushToService
    +
    subActionParams
    run_connector_subaction_pushtoservice_subActionParams
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams - Up

    +
    The set of configuration properties for the action.
    +
    +
    comments (optional)
    array[run_connector_subaction_pushtoservice_subActionParams_comments_inner] Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane.
    +
    incident (optional)
    run_connector_subaction_pushtoservice_subActionParams_incident
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams_comments_inner - Up

    +
    +
    +
    comment (optional)
    String A comment related to the incident. For example, describe how to troubleshoot the issue.
    +
    commentId (optional)
    Integer A unique identifier for the comment.
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams_incident - Up

    +
    Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.
    +
    +
    alertId (optional)
    String The alert identifier for Swimlane connectors.
    +
    caseId (optional)
    String The case identifier for the incident for Swimlane connectors.
    +
    caseName (optional)
    String The case name for the incident for Swimlane connectors.
    +
    category (optional)
    String The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
    +
    correlation_display (optional)
    String A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
    +
    correlation_id (optional)
    String The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as {{ruleID}}:{{alert ID}} to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of {{ruleID}}:{{alert ID}} ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.
    +
    description (optional)
    String The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.
    +
    dest_ip (optional)
    run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip
    +
    externalId (optional)
    String The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.
    +
    impact (optional)
    String The impact of the incident for ServiceNow ITSM connectors.
    +
    issueType (optional)
    Integer The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set subAction to issueTypes.
    +
    labels (optional)
    array[String] The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.
    +
    malware_hash (optional)
    run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash
    +
    malware_url (optional)
    run_connector_subaction_pushtoservice_subActionParams_incident_malware_url
    +
    parent (optional)
    String The ID or key of the parent issue for Jira connectors. Applies only to Sub-task types of issues.
    +
    priority (optional)
    String The priority of the incident in Jira and ServiceNow SecOps connectors.
    +
    ruleName (optional)
    String The rule name for Swimlane connectors.
    +
    severity (optional)
    String The severity of the incident for ServiceNow ITSM and Swimlane connectors.
    +
    short_description (optional)
    String A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.
    +
    source_ip (optional)
    run_connector_subaction_pushtoservice_subActionParams_incident_source_ip
    +
    subcategory (optional)
    String The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
    +
    summary (optional)
    String A summary of the incident for Jira connectors.
    +
    title (optional)
    String A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base.
    +
    urgency (optional)
    String The urgency of the incident for ServiceNow ITSM connectors.
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams_incident_dest_ip - Up

    +
    A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
    +
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams_incident_malware_hash - Up

    +
    A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
    +
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams_incident_malware_url - Up

    +
    A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
    +
    +
    +
    +
    +

    run_connector_subaction_pushtoservice_subActionParams_incident_source_ip - Up

    +
    A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
    +
    +
    +

    secrets_properties_cases_webhook - Connector secrets properties for Webhook - Case Management connector Up

    diff --git a/docs/api-generated/rules/rule-apis-passthru.asciidoc b/docs/api-generated/rules/rule-apis-passthru.asciidoc index 8ef9fdfacf560..d92712adeb107 100644 --- a/docs/api-generated/rules/rule-apis-passthru.asciidoc +++ b/docs/api-generated/rules/rule-apis-passthru.asciidoc @@ -18,6 +18,7 @@ Any modifications made to this file will be overwritten.

    Alerting

    Alerting

    +
    +
    + Up + 
    post /s/{spaceId}/api/alerting/rule/{ruleId}
    +
    Creates a rule. (createRule)
    +
    You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. NOTE: This API supports only token-based authentication. When you create a rule, it identifies which roles you have at that point in time. Thereafter, when the rule performs queries, it uses those security privileges. If a user with different privileges updates the rule, its behavior might change.
    + +

    Path parameters

    +
    +
    spaceId (required)
    + +
    Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
    ruleId (required)
    + +
    Path Parameter — An UUID v1 or v4 identifier for the rule. If you omit this parameter, an identifier is randomly generated. default: null
    +
    + +

    Consumes

    + This API call consumes the following media types via the Content-Type request header: +
      +
    • application/json
      • +
    + +

    Request body

    +
    +
    create_rule_request create_rule_request (required)
    + +
    Body Parameter —
    + +
    + +

    Request headers

    +
    +
    kbn-xsrf (required)
    + +
    Header Parameter — Cross-site request forgery protection default: null
    + +
    + + + +

    Return type

    +
    + rule_response_properties + +
    + + + +

    Example data

    +
    Content-Type: application/json
    + 
    {
+  "throttle" : "10m",
+  "created_at" : "2022-12-05T23:36:58.284Z",
+  "last_run" : {
+    "alerts_count" : {
+      "ignored" : 6,
+      "new" : 1,
+      "recovered" : 5,
+      "active" : 0
+    },
+    "outcome_msg" : "outcome_msg",
+    "warning" : "warning",
+    "outcome" : "succeeded"
+  },
+  "params" : {
+    "key" : ""
+  },
+  "created_by" : "elastic",
+  "enabled" : true,
+  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
+  "rule_type_id" : "monitoring_alert_cluster_health",
+  "tags" : [ "tags", "tags" ],
+  "api_key_owner" : "elastic",
+  "schedule" : {
+    "interval" : "1m"
+  },
+  "notify_when" : "onActiveAlert",
+  "next_run" : "2022-12-06T00:14:43.818Z",
+  "updated_at" : "2022-12-05T23:36:58.284Z",
+  "execution_status" : {
+    "last_execution_date" : "2022-12-06T00:13:43.89Z",
+    "last_duration" : 55,
+    "status" : "ok"
+  },
+  "name" : "cluster_health_rule",
+  "updated_by" : "elastic",
+  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
+  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
+  "mute_all" : false,
+  "actions" : [ {
+    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
+    "params" : {
+      "key" : ""
+    },
+    "group" : "default"
+  }, {
+    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
+    "params" : {
+      "key" : ""
+    },
+    "group" : "default"
+  } ],
+  "consumer" : "alerts"
+}
    + +

    Produces

    + This API call produces the following media types according to the Accept request header; + the media type will be conveyed by the Content-Type response header. +
      +
    • application/json
      • +
    + +

    Responses

    +

    200

    + Indicates a successful call. + rule_response_properties +

    401

    + Authorization information is missing or invalid. + 401_response +

    404

    + Object is not found. + 404_response +
    +
    Up @@ -55,7 +180,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -106,7 +231,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -157,7 +282,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -711,7 +836,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -759,7 +884,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -809,7 +934,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -857,7 +982,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -917,7 +1042,7 @@ Any modifications made to this file will be overwritten.
    kbn-xsrf (required)
    -
    Header Parameter — default: null
    +
    Header Parameter — Cross-site request forgery protection default: null
    @@ -1016,6 +1141,7 @@ Any modifications made to this file will be overwritten.
  • 401_response - Unsuccessful rule API response
  • 404_response -
  • actions_inner -
    • +
  • create_rule_request - Create rule request
  • findRules_200_response -
  • findRules_has_reference_parameter -
  • findRules_search_fields_parameter -
    • @@ -1078,6 +1204,22 @@ Any modifications made to this file will be overwritten.
    params (optional)
    map[String, oas_any_type_not_mapped] The parameters for the action, which are sent to the connector. The params are handled as Mustache templates and passed a default set of context.
    +
    +

    create_rule_request - Create rule request Up

    +
    The create rule API request body varies depending on the type of rule and actions.
    +
    +
    actions (optional)
    array[actions_inner]
    +
    consumer
    String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
    +
    enabled (optional)
    Boolean Indicates whether you want to run the rule on an interval basis after it is created.
    +
    name
    String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    +
    notify_when
    notify_when
    +
    params
    map[String, oas_any_type_not_mapped] The parameters for the rule.
    +
    rule_type_id
    String The ID of the rule type that you want to call when the rule is scheduled to run. For example, .es-query, .index-threshold, logs.alert.document.count, monitoring_alert_cluster_health, siem.thresholdRule, or xpack.ml.anomaly_detection_alert.
    +
    schedule
    schedule
    +
    tags (optional)
    array[String] The tags for the rule.
    +
    throttle (optional)
    String The throttle interval, which defines how often an alert generates repeated actions. It is applicable only if notify_when is set to onThrottleInterval. It is specified in seconds, minutes, hours, or days.
    +
    +

    findRules_200_response - Up

    diff --git a/docs/api/actions-and-connectors/execute.asciidoc b/docs/api/actions-and-connectors/execute.asciidoc index 7fbaae439094e..6d94c61f6232b 100644 --- a/docs/api/actions-and-connectors/execute.asciidoc +++ b/docs/api/actions-and-connectors/execute.asciidoc @@ -6,6 +6,12 @@ Runs a connector by ID. +[NOTE] +==== +For the most up-to-date API details, refer to the +{kib-repo}/tree/{branch}/x-pack/plugins/actions/docs/openapi[open API specification]. For a preview, check out <>. +==== + [[execute-connector-api-request]] === {api-request-title} @@ -362,7 +368,7 @@ on the `subAction` value. This object is not required when `subAction` is [%collapsible%open] ====== `comments`::: -(Optional, array of objects) Additional information that is sent to {sn-sir}. +(Optional, array of objects) Additional information that is sent to {sn-itsm}. + .Properties of `comments` [%collapsible%open] @@ -381,7 +387,7 @@ version:::: ======= `incident`::: -(Required, object) Information necessary to create or update a {sn-sir} incident. +(Required, object) Information necessary to create or update a {sn-itsm} incident. + .Properties of `incident` [%collapsible%open] @@ -520,6 +526,10 @@ to the security incident. The IPs are added as observables to the security incid updated. Otherwise, a new incident is created. `malware_hash`:::: +(Optional, string or array of strings) A list of malware hashes related to the +security incident. The hashes are added as observables to the security incident. + +`malware_url`:::: (Optional, string or array of strings) A list of malware URLs related to the security incident. The URLs are added as observables to the security incident. diff --git a/docs/api/alerting/create_rule.asciidoc b/docs/api/alerting/create_rule.asciidoc index b7c27b75c1801..a6eb25f1365fe 100644 --- a/docs/api/alerting/create_rule.asciidoc +++ b/docs/api/alerting/create_rule.asciidoc @@ -6,6 +6,12 @@ Create {kib} rules. +[NOTE] +==== +For the most up-to-date API details, refer to the +{kib-repo}/tree/{branch}/x-pack/plugins/alerting/docs/openapi[open API specification]. For a preview, check out <>. +==== + [[create-rule-api-request]] === {api-request-title} diff --git a/docs/developer/advanced/upgrading-nodejs.asciidoc b/docs/developer/advanced/upgrading-nodejs.asciidoc index 16e8502450c17..03701997a7560 100644 --- a/docs/developer/advanced/upgrading-nodejs.asciidoc +++ b/docs/developer/advanced/upgrading-nodejs.asciidoc @@ -17,7 +17,7 @@ These files must be updated when upgrading Node.js: - {kib-repo}blob/{branch}/WORKSPACE.bazel[`WORKSPACE.bazel`] - The version is specified in the `node_version` property. Besides this property, the list of files under `node_repositories` must be updated along with their respective SHA256 hashes. These can be found on the https://nodejs.org[nodejs.org] website. - Example for Node.js v18.13.0: https://nodejs.org/dist/v18.13.0/SHASUMS256.txt.asc + Example for Node.js v16.19.0: https://nodejs.org/dist/v16.19.0/SHASUMS256.txt.asc See PR {kib-repo}pull/128123[#128123] for an example of how the Node.js version has been upgraded previously. diff --git a/docs/developer/plugin-list.asciidoc b/docs/developer/plugin-list.asciidoc index 06666957c9ee4..4d0e8e1999749 100644 --- a/docs/developer/plugin-list.asciidoc +++ b/docs/developer/plugin-list.asciidoc @@ -184,6 +184,10 @@ for use in their own application. |Minimal interface for admins to manage files in Kibana. +|{kib-repo}blob/{branch}/src/plugins/ftr_apis/README.md[ftrApis] +|This plugin exposes a set of APIs used internally during functional tests by the FTR. + + |{kib-repo}blob/{branch}/src/plugins/guided_onboarding/README.md[guidedOnboarding] |This plugin contains the code for the Guided Onboarding project. Guided onboarding consists of guides for Solutions (Enterprise Search, Observability, Security) that can be completed as a checklist of steps. The guides help users to ingest their data and to navigate to the correct Solutions pages. diff --git a/docs/management/advanced-options.asciidoc b/docs/management/advanced-options.asciidoc index 11e9b1f450462..6b51685eefc6e 100644 --- a/docs/management/advanced-options.asciidoc +++ b/docs/management/advanced-options.asciidoc @@ -546,10 +546,6 @@ Disable this option if you prefer to use the new heatmap charts with improved pe Enables users to create, view, and edit experimental visualizations. When disabled, only production-ready visualizations are available to users. -[[lens-sampling]]`lens:useFieldExistenceSampling`:: -**This setting is deprecated and will not be supported as of 8.6.** -If enabled, document sampling is used to determine field existence (available or empty) for the Lens field list instead of relying on index mappings. - [float] [[kibana-telemetry-settings]] ==== Usage Data diff --git a/fleet_packages.json b/fleet_packages.json index a258e60fcc8bc..7ccfb852437cf 100644 --- a/fleet_packages.json +++ b/fleet_packages.json @@ -20,7 +20,7 @@ [ { "name": "apm", - "version": "8.7.0-preview-1674061297", + "version": "8.7.0-preview-1674665274", "forceAlignStackVersion": true }, { @@ -41,6 +41,6 @@ }, { "name": "security_detection_engine", - "version": "8.4.2-beta.1" + "version": "8.4.2" } ] \ No newline at end of file diff --git a/package.json b/package.json index 6046f5f6b734b..42b2c256c33c4 100644 --- a/package.json +++ b/package.json @@ -56,7 +56,7 @@ "makelogs": "node scripts/makelogs", "spec_to_console": "node scripts/spec_to_console", "start": "node scripts/kibana --dev", - "storybook": "node --openssl-legacy-provider scripts/storybook", + "storybook": "node scripts/storybook", "test:ftr": "node scripts/functional_tests", "test:ftr:runner": "node scripts/functional_test_runner", "test:ftr:server": "node scripts/functional_tests_server", @@ -68,11 +68,11 @@ "url": "https://github.com/elastic/kibana.git" }, "engines": { - "node": "18.13.0", + "node": "16.19.0", "yarn": "^1.22.19" }, "resolutions": { - "**/@types/node": "18.11.18", + "**/@types/node": "16.11.68", "**/chokidar": "^3.5.3", "**/deepmerge": "^4.2.2", "**/fast-deep-equal": "^3.1.1", @@ -151,32 +151,23 @@ "@kbn/content-management-table-list": "link:packages/content-management/table_list", "@kbn/core-analytics-browser": "link:packages/core/analytics/core-analytics-browser", "@kbn/core-analytics-browser-internal": "link:packages/core/analytics/core-analytics-browser-internal", - "@kbn/core-analytics-browser-mocks": "link:packages/core/analytics/core-analytics-browser-mocks", "@kbn/core-analytics-server": "link:packages/core/analytics/core-analytics-server", "@kbn/core-analytics-server-internal": "link:packages/core/analytics/core-analytics-server-internal", - "@kbn/core-analytics-server-mocks": "link:packages/core/analytics/core-analytics-server-mocks", "@kbn/core-application-browser": "link:packages/core/application/core-application-browser", "@kbn/core-application-browser-internal": "link:packages/core/application/core-application-browser-internal", - "@kbn/core-application-browser-mocks": "link:packages/core/application/core-application-browser-mocks", "@kbn/core-application-common": "link:packages/core/application/core-application-common", "@kbn/core-apps-browser-internal": "link:packages/core/apps/core-apps-browser-internal", - "@kbn/core-apps-browser-mocks": "link:packages/core/apps/core-apps-browser-mocks", "@kbn/core-apps-server-internal": "link:packages/core/apps/core-apps-server-internal", "@kbn/core-base-browser-internal": "link:packages/core/base/core-base-browser-internal", - "@kbn/core-base-browser-mocks": "link:packages/core/base/core-base-browser-mocks", "@kbn/core-base-common": "link:packages/core/base/core-base-common", "@kbn/core-base-common-internal": "link:packages/core/base/core-base-common-internal", "@kbn/core-base-server-internal": "link:packages/core/base/core-base-server-internal", - "@kbn/core-base-server-mocks": "link:packages/core/base/core-base-server-mocks", "@kbn/core-capabilities-browser-internal": "link:packages/core/capabilities/core-capabilities-browser-internal", - "@kbn/core-capabilities-browser-mocks": "link:packages/core/capabilities/core-capabilities-browser-mocks", "@kbn/core-capabilities-common": "link:packages/core/capabilities/core-capabilities-common", "@kbn/core-capabilities-server": "link:packages/core/capabilities/core-capabilities-server", "@kbn/core-capabilities-server-internal": "link:packages/core/capabilities/core-capabilities-server-internal", - "@kbn/core-capabilities-server-mocks": "link:packages/core/capabilities/core-capabilities-server-mocks", "@kbn/core-chrome-browser": "link:packages/core/chrome/core-chrome-browser", "@kbn/core-chrome-browser-internal": "link:packages/core/chrome/core-chrome-browser-internal", - "@kbn/core-chrome-browser-mocks": "link:packages/core/chrome/core-chrome-browser-mocks", "@kbn/core-config-server-internal": "link:packages/core/config/core-config-server-internal", "@kbn/core-custom-branding-browser": "link:packages/core/custom-branding/core-custom-branding-browser", "@kbn/core-custom-branding-browser-internal": "link:packages/core/custom-branding/core-custom-branding-browser-internal", @@ -187,146 +178,102 @@ "@kbn/core-custom-branding-server-mocks": "link:packages/core/custom-branding/core-custom-branding-server-mocks", "@kbn/core-deprecations-browser": "link:packages/core/deprecations/core-deprecations-browser", "@kbn/core-deprecations-browser-internal": "link:packages/core/deprecations/core-deprecations-browser-internal", - "@kbn/core-deprecations-browser-mocks": "link:packages/core/deprecations/core-deprecations-browser-mocks", "@kbn/core-deprecations-common": "link:packages/core/deprecations/core-deprecations-common", "@kbn/core-deprecations-server": "link:packages/core/deprecations/core-deprecations-server", "@kbn/core-deprecations-server-internal": "link:packages/core/deprecations/core-deprecations-server-internal", - "@kbn/core-deprecations-server-mocks": "link:packages/core/deprecations/core-deprecations-server-mocks", "@kbn/core-doc-links-browser": "link:packages/core/doc-links/core-doc-links-browser", "@kbn/core-doc-links-browser-internal": "link:packages/core/doc-links/core-doc-links-browser-internal", - "@kbn/core-doc-links-browser-mocks": "link:packages/core/doc-links/core-doc-links-browser-mocks", "@kbn/core-doc-links-server": "link:packages/core/doc-links/core-doc-links-server", "@kbn/core-doc-links-server-internal": "link:packages/core/doc-links/core-doc-links-server-internal", - "@kbn/core-doc-links-server-mocks": "link:packages/core/doc-links/core-doc-links-server-mocks", "@kbn/core-elasticsearch-client-server-internal": "link:packages/core/elasticsearch/core-elasticsearch-client-server-internal", - "@kbn/core-elasticsearch-client-server-mocks": "link:packages/core/elasticsearch/core-elasticsearch-client-server-mocks", "@kbn/core-elasticsearch-server": "link:packages/core/elasticsearch/core-elasticsearch-server", "@kbn/core-elasticsearch-server-internal": "link:packages/core/elasticsearch/core-elasticsearch-server-internal", - "@kbn/core-elasticsearch-server-mocks": "link:packages/core/elasticsearch/core-elasticsearch-server-mocks", "@kbn/core-environment-server-internal": "link:packages/core/environment/core-environment-server-internal", - "@kbn/core-environment-server-mocks": "link:packages/core/environment/core-environment-server-mocks", "@kbn/core-execution-context-browser": "link:packages/core/execution-context/core-execution-context-browser", "@kbn/core-execution-context-browser-internal": "link:packages/core/execution-context/core-execution-context-browser-internal", - "@kbn/core-execution-context-browser-mocks": "link:packages/core/execution-context/core-execution-context-browser-mocks", "@kbn/core-execution-context-common": "link:packages/core/execution-context/core-execution-context-common", "@kbn/core-execution-context-server": "link:packages/core/execution-context/core-execution-context-server", "@kbn/core-execution-context-server-internal": "link:packages/core/execution-context/core-execution-context-server-internal", - "@kbn/core-execution-context-server-mocks": "link:packages/core/execution-context/core-execution-context-server-mocks", "@kbn/core-fatal-errors-browser": "link:packages/core/fatal-errors/core-fatal-errors-browser", "@kbn/core-fatal-errors-browser-internal": "link:packages/core/fatal-errors/core-fatal-errors-browser-internal", - "@kbn/core-fatal-errors-browser-mocks": "link:packages/core/fatal-errors/core-fatal-errors-browser-mocks", "@kbn/core-http-browser": "link:packages/core/http/core-http-browser", "@kbn/core-http-browser-internal": "link:packages/core/http/core-http-browser-internal", - "@kbn/core-http-browser-mocks": "link:packages/core/http/core-http-browser-mocks", "@kbn/core-http-common": "link:packages/core/http/core-http-common", "@kbn/core-http-context-server-internal": "link:packages/core/http/core-http-context-server-internal", - "@kbn/core-http-context-server-mocks": "link:packages/core/http/core-http-context-server-mocks", "@kbn/core-http-request-handler-context-server": "link:packages/core/http/core-http-request-handler-context-server", "@kbn/core-http-request-handler-context-server-internal": "link:packages/core/http/core-http-request-handler-context-server-internal", "@kbn/core-http-resources-server": "link:packages/core/http/core-http-resources-server", "@kbn/core-http-resources-server-internal": "link:packages/core/http/core-http-resources-server-internal", - "@kbn/core-http-resources-server-mocks": "link:packages/core/http/core-http-resources-server-mocks", "@kbn/core-http-router-server-internal": "link:packages/core/http/core-http-router-server-internal", - "@kbn/core-http-router-server-mocks": "link:packages/core/http/core-http-router-server-mocks", "@kbn/core-http-server": "link:packages/core/http/core-http-server", "@kbn/core-http-server-internal": "link:packages/core/http/core-http-server-internal", - "@kbn/core-http-server-mocks": "link:packages/core/http/core-http-server-mocks", "@kbn/core-i18n-browser": "link:packages/core/i18n/core-i18n-browser", "@kbn/core-i18n-browser-internal": "link:packages/core/i18n/core-i18n-browser-internal", - "@kbn/core-i18n-browser-mocks": "link:packages/core/i18n/core-i18n-browser-mocks", "@kbn/core-i18n-server": "link:packages/core/i18n/core-i18n-server", "@kbn/core-i18n-server-internal": "link:packages/core/i18n/core-i18n-server-internal", - "@kbn/core-i18n-server-mocks": "link:packages/core/i18n/core-i18n-server-mocks", "@kbn/core-injected-metadata-browser-internal": "link:packages/core/injected-metadata/core-injected-metadata-browser-internal", - "@kbn/core-injected-metadata-browser-mocks": "link:packages/core/injected-metadata/core-injected-metadata-browser-mocks", "@kbn/core-injected-metadata-common-internal": "link:packages/core/injected-metadata/core-injected-metadata-common-internal", "@kbn/core-integrations-browser-internal": "link:packages/core/integrations/core-integrations-browser-internal", - "@kbn/core-integrations-browser-mocks": "link:packages/core/integrations/core-integrations-browser-mocks", "@kbn/core-lifecycle-browser": "link:packages/core/lifecycle/core-lifecycle-browser", "@kbn/core-lifecycle-browser-internal": "link:packages/core/lifecycle/core-lifecycle-browser-internal", - "@kbn/core-lifecycle-browser-mocks": "link:packages/core/lifecycle/core-lifecycle-browser-mocks", "@kbn/core-lifecycle-server": "link:packages/core/lifecycle/core-lifecycle-server", "@kbn/core-lifecycle-server-internal": "link:packages/core/lifecycle/core-lifecycle-server-internal", - "@kbn/core-lifecycle-server-mocks": "link:packages/core/lifecycle/core-lifecycle-server-mocks", "@kbn/core-logging-browser-internal": "link:packages/core/logging/core-logging-browser-internal", - "@kbn/core-logging-browser-mocks": "link:packages/core/logging/core-logging-browser-mocks", "@kbn/core-logging-common-internal": "link:packages/core/logging/core-logging-common-internal", "@kbn/core-logging-server": "link:packages/core/logging/core-logging-server", "@kbn/core-logging-server-internal": "link:packages/core/logging/core-logging-server-internal", - "@kbn/core-logging-server-mocks": "link:packages/core/logging/core-logging-server-mocks", "@kbn/core-metrics-collectors-server-internal": "link:packages/core/metrics/core-metrics-collectors-server-internal", - "@kbn/core-metrics-collectors-server-mocks": "link:packages/core/metrics/core-metrics-collectors-server-mocks", "@kbn/core-metrics-server": "link:packages/core/metrics/core-metrics-server", "@kbn/core-metrics-server-internal": "link:packages/core/metrics/core-metrics-server-internal", - "@kbn/core-metrics-server-mocks": "link:packages/core/metrics/core-metrics-server-mocks", "@kbn/core-mount-utils-browser": "link:packages/core/mount-utils/core-mount-utils-browser", "@kbn/core-mount-utils-browser-internal": "link:packages/core/mount-utils/core-mount-utils-browser-internal", "@kbn/core-node-server": "link:packages/core/node/core-node-server", "@kbn/core-node-server-internal": "link:packages/core/node/core-node-server-internal", - "@kbn/core-node-server-mocks": "link:packages/core/node/core-node-server-mocks", "@kbn/core-notifications-browser": "link:packages/core/notifications/core-notifications-browser", "@kbn/core-notifications-browser-internal": "link:packages/core/notifications/core-notifications-browser-internal", - "@kbn/core-notifications-browser-mocks": "link:packages/core/notifications/core-notifications-browser-mocks", "@kbn/core-overlays-browser": "link:packages/core/overlays/core-overlays-browser", "@kbn/core-overlays-browser-internal": "link:packages/core/overlays/core-overlays-browser-internal", - "@kbn/core-overlays-browser-mocks": "link:packages/core/overlays/core-overlays-browser-mocks", "@kbn/core-plugins-base-server-internal": "link:packages/core/plugins/core-plugins-base-server-internal", "@kbn/core-plugins-browser": "link:packages/core/plugins/core-plugins-browser", "@kbn/core-plugins-browser-internal": "link:packages/core/plugins/core-plugins-browser-internal", - "@kbn/core-plugins-browser-mocks": "link:packages/core/plugins/core-plugins-browser-mocks", "@kbn/core-plugins-server": "link:packages/core/plugins/core-plugins-server", "@kbn/core-plugins-server-internal": "link:packages/core/plugins/core-plugins-server-internal", - "@kbn/core-plugins-server-mocks": "link:packages/core/plugins/core-plugins-server-mocks", "@kbn/core-preboot-server": "link:packages/core/preboot/core-preboot-server", "@kbn/core-preboot-server-internal": "link:packages/core/preboot/core-preboot-server-internal", - "@kbn/core-preboot-server-mocks": "link:packages/core/preboot/core-preboot-server-mocks", "@kbn/core-rendering-browser-internal": "link:packages/core/rendering/core-rendering-browser-internal", - "@kbn/core-rendering-browser-mocks": "link:packages/core/rendering/core-rendering-browser-mocks", "@kbn/core-rendering-server-internal": "link:packages/core/rendering/core-rendering-server-internal", - "@kbn/core-rendering-server-mocks": "link:packages/core/rendering/core-rendering-server-mocks", "@kbn/core-root-browser-internal": "link:packages/core/root/core-root-browser-internal", "@kbn/core-root-server-internal": "link:packages/core/root/core-root-server-internal", "@kbn/core-saved-objects-api-browser": "link:packages/core/saved-objects/core-saved-objects-api-browser", "@kbn/core-saved-objects-api-server": "link:packages/core/saved-objects/core-saved-objects-api-server", "@kbn/core-saved-objects-api-server-internal": "link:packages/core/saved-objects/core-saved-objects-api-server-internal", - "@kbn/core-saved-objects-api-server-mocks": "link:packages/core/saved-objects/core-saved-objects-api-server-mocks", "@kbn/core-saved-objects-base-server-internal": "link:packages/core/saved-objects/core-saved-objects-base-server-internal", - "@kbn/core-saved-objects-base-server-mocks": "link:packages/core/saved-objects/core-saved-objects-base-server-mocks", "@kbn/core-saved-objects-browser": "link:packages/core/saved-objects/core-saved-objects-browser", "@kbn/core-saved-objects-browser-internal": "link:packages/core/saved-objects/core-saved-objects-browser-internal", - "@kbn/core-saved-objects-browser-mocks": "link:packages/core/saved-objects/core-saved-objects-browser-mocks", "@kbn/core-saved-objects-common": "link:packages/core/saved-objects/core-saved-objects-common", "@kbn/core-saved-objects-import-export-server-internal": "link:packages/core/saved-objects/core-saved-objects-import-export-server-internal", - "@kbn/core-saved-objects-import-export-server-mocks": "link:packages/core/saved-objects/core-saved-objects-import-export-server-mocks", "@kbn/core-saved-objects-migration-server-internal": "link:packages/core/saved-objects/core-saved-objects-migration-server-internal", - "@kbn/core-saved-objects-migration-server-mocks": "link:packages/core/saved-objects/core-saved-objects-migration-server-mocks", "@kbn/core-saved-objects-server": "link:packages/core/saved-objects/core-saved-objects-server", "@kbn/core-saved-objects-server-internal": "link:packages/core/saved-objects/core-saved-objects-server-internal", - "@kbn/core-saved-objects-server-mocks": "link:packages/core/saved-objects/core-saved-objects-server-mocks", "@kbn/core-saved-objects-utils-server": "link:packages/core/saved-objects/core-saved-objects-utils-server", "@kbn/core-status-common": "link:packages/core/status/core-status-common", "@kbn/core-status-common-internal": "link:packages/core/status/core-status-common-internal", "@kbn/core-status-server": "link:packages/core/status/core-status-server", "@kbn/core-status-server-internal": "link:packages/core/status/core-status-server-internal", - "@kbn/core-status-server-mocks": "link:packages/core/status/core-status-server-mocks", "@kbn/core-test-helpers-deprecations-getters": "link:packages/core/test-helpers/core-test-helpers-deprecations-getters", "@kbn/core-test-helpers-http-setup-browser": "link:packages/core/test-helpers/core-test-helpers-http-setup-browser", "@kbn/core-test-helpers-so-type-serializer": "link:packages/core/test-helpers/core-test-helpers-so-type-serializer", "@kbn/core-test-helpers-test-utils": "link:packages/core/test-helpers/core-test-helpers-test-utils", "@kbn/core-theme-browser": "link:packages/core/theme/core-theme-browser", "@kbn/core-theme-browser-internal": "link:packages/core/theme/core-theme-browser-internal", - "@kbn/core-theme-browser-mocks": "link:packages/core/theme/core-theme-browser-mocks", "@kbn/core-ui-settings-browser": "link:packages/core/ui-settings/core-ui-settings-browser", "@kbn/core-ui-settings-browser-internal": "link:packages/core/ui-settings/core-ui-settings-browser-internal", - "@kbn/core-ui-settings-browser-mocks": "link:packages/core/ui-settings/core-ui-settings-browser-mocks", "@kbn/core-ui-settings-common": "link:packages/core/ui-settings/core-ui-settings-common", "@kbn/core-ui-settings-server": "link:packages/core/ui-settings/core-ui-settings-server", "@kbn/core-ui-settings-server-internal": "link:packages/core/ui-settings/core-ui-settings-server-internal", - "@kbn/core-ui-settings-server-mocks": "link:packages/core/ui-settings/core-ui-settings-server-mocks", "@kbn/core-usage-data-base-server-internal": "link:packages/core/usage-data/core-usage-data-base-server-internal", "@kbn/core-usage-data-server": "link:packages/core/usage-data/core-usage-data-server", "@kbn/core-usage-data-server-internal": "link:packages/core/usage-data/core-usage-data-server-internal", - "@kbn/core-usage-data-server-mocks": "link:packages/core/usage-data/core-usage-data-server-mocks", "@kbn/crypto": "link:packages/kbn-crypto", "@kbn/crypto-browser": "link:packages/kbn-crypto-browser", "@kbn/datemath": "link:packages/kbn-datemath", @@ -507,7 +454,7 @@ "compare-versions": "3.5.1", "constate": "^3.3.2", "copy-to-clipboard": "^3.0.8", - "core-js": "^3.27.1", + "core-js": "^3.27.2", "cronstrue": "^1.51.0", "cuid": "^2.1.8", "cytoscape": "^3.10.0", @@ -527,7 +474,7 @@ "deepmerge": "^4.2.2", "del": "^6.1.0", "elastic-apm-http-client": "^11.0.1", - "elastic-apm-node": "^3.41.1", + "elastic-apm-node": "^3.42.0", "email-addresses": "^5.0.0", "execa": "^4.0.2", "expiry-js": "0.1.7", @@ -622,7 +569,7 @@ "query-string": "^6.13.2", "rbush": "^3.0.1", "re-resizable": "^6.1.1", - "re2": "1.17.7", + "re2": "1.17.4", "react": "^17.0.2", "react-ace": "^7.0.5", "react-beautiful-dnd": "^13.1.0", @@ -766,7 +713,60 @@ "@kbn/ci-stats-reporter": "link:packages/kbn-ci-stats-reporter", "@kbn/ci-stats-shipper-cli": "link:packages/kbn-ci-stats-shipper-cli", "@kbn/cli-dev-mode": "link:packages/kbn-cli-dev-mode", + "@kbn/core-analytics-browser-mocks": "link:packages/core/analytics/core-analytics-browser-mocks", + "@kbn/core-analytics-server-mocks": "link:packages/core/analytics/core-analytics-server-mocks", + "@kbn/core-application-browser-mocks": "link:packages/core/application/core-application-browser-mocks", + "@kbn/core-apps-browser-mocks": "link:packages/core/apps/core-apps-browser-mocks", + "@kbn/core-base-browser-mocks": "link:packages/core/base/core-base-browser-mocks", + "@kbn/core-base-server-mocks": "link:packages/core/base/core-base-server-mocks", + "@kbn/core-capabilities-browser-mocks": "link:packages/core/capabilities/core-capabilities-browser-mocks", + "@kbn/core-capabilities-server-mocks": "link:packages/core/capabilities/core-capabilities-server-mocks", + "@kbn/core-chrome-browser-mocks": "link:packages/core/chrome/core-chrome-browser-mocks", + "@kbn/core-deprecations-browser-mocks": "link:packages/core/deprecations/core-deprecations-browser-mocks", + "@kbn/core-deprecations-server-mocks": "link:packages/core/deprecations/core-deprecations-server-mocks", + "@kbn/core-doc-links-browser-mocks": "link:packages/core/doc-links/core-doc-links-browser-mocks", + "@kbn/core-doc-links-server-mocks": "link:packages/core/doc-links/core-doc-links-server-mocks", + "@kbn/core-elasticsearch-client-server-mocks": "link:packages/core/elasticsearch/core-elasticsearch-client-server-mocks", + "@kbn/core-elasticsearch-server-mocks": "link:packages/core/elasticsearch/core-elasticsearch-server-mocks", + "@kbn/core-environment-server-mocks": "link:packages/core/environment/core-environment-server-mocks", + "@kbn/core-execution-context-browser-mocks": "link:packages/core/execution-context/core-execution-context-browser-mocks", + "@kbn/core-execution-context-server-mocks": "link:packages/core/execution-context/core-execution-context-server-mocks", + "@kbn/core-fatal-errors-browser-mocks": "link:packages/core/fatal-errors/core-fatal-errors-browser-mocks", + "@kbn/core-http-browser-mocks": "link:packages/core/http/core-http-browser-mocks", + "@kbn/core-http-context-server-mocks": "link:packages/core/http/core-http-context-server-mocks", + "@kbn/core-http-resources-server-mocks": "link:packages/core/http/core-http-resources-server-mocks", + "@kbn/core-http-router-server-mocks": "link:packages/core/http/core-http-router-server-mocks", + "@kbn/core-http-server-mocks": "link:packages/core/http/core-http-server-mocks", + "@kbn/core-i18n-browser-mocks": "link:packages/core/i18n/core-i18n-browser-mocks", + "@kbn/core-i18n-server-mocks": "link:packages/core/i18n/core-i18n-server-mocks", + "@kbn/core-injected-metadata-browser-mocks": "link:packages/core/injected-metadata/core-injected-metadata-browser-mocks", + "@kbn/core-integrations-browser-mocks": "link:packages/core/integrations/core-integrations-browser-mocks", + "@kbn/core-lifecycle-browser-mocks": "link:packages/core/lifecycle/core-lifecycle-browser-mocks", + "@kbn/core-lifecycle-server-mocks": "link:packages/core/lifecycle/core-lifecycle-server-mocks", + "@kbn/core-logging-browser-mocks": "link:packages/core/logging/core-logging-browser-mocks", + "@kbn/core-logging-server-mocks": "link:packages/core/logging/core-logging-server-mocks", + "@kbn/core-metrics-collectors-server-mocks": "link:packages/core/metrics/core-metrics-collectors-server-mocks", + "@kbn/core-metrics-server-mocks": "link:packages/core/metrics/core-metrics-server-mocks", + "@kbn/core-node-server-mocks": "link:packages/core/node/core-node-server-mocks", + "@kbn/core-notifications-browser-mocks": "link:packages/core/notifications/core-notifications-browser-mocks", + "@kbn/core-overlays-browser-mocks": "link:packages/core/overlays/core-overlays-browser-mocks", + "@kbn/core-plugins-browser-mocks": "link:packages/core/plugins/core-plugins-browser-mocks", + "@kbn/core-plugins-server-mocks": "link:packages/core/plugins/core-plugins-server-mocks", + "@kbn/core-preboot-server-mocks": "link:packages/core/preboot/core-preboot-server-mocks", + "@kbn/core-rendering-browser-mocks": "link:packages/core/rendering/core-rendering-browser-mocks", + "@kbn/core-rendering-server-mocks": "link:packages/core/rendering/core-rendering-server-mocks", + "@kbn/core-saved-objects-api-server-mocks": "link:packages/core/saved-objects/core-saved-objects-api-server-mocks", + "@kbn/core-saved-objects-base-server-mocks": "link:packages/core/saved-objects/core-saved-objects-base-server-mocks", + "@kbn/core-saved-objects-browser-mocks": "link:packages/core/saved-objects/core-saved-objects-browser-mocks", + "@kbn/core-saved-objects-import-export-server-mocks": "link:packages/core/saved-objects/core-saved-objects-import-export-server-mocks", + "@kbn/core-saved-objects-migration-server-mocks": "link:packages/core/saved-objects/core-saved-objects-migration-server-mocks", + "@kbn/core-saved-objects-server-mocks": "link:packages/core/saved-objects/core-saved-objects-server-mocks", + "@kbn/core-status-server-mocks": "link:packages/core/status/core-status-server-mocks", "@kbn/core-test-helpers-kbn-server": "link:packages/core/test-helpers/core-test-helpers-kbn-server", + "@kbn/core-theme-browser-mocks": "link:packages/core/theme/core-theme-browser-mocks", + "@kbn/core-ui-settings-browser-mocks": "link:packages/core/ui-settings/core-ui-settings-browser-mocks", + "@kbn/core-ui-settings-server-mocks": "link:packages/core/ui-settings/core-ui-settings-server-mocks", + "@kbn/core-usage-data-server-mocks": "link:packages/core/usage-data/core-usage-data-server-mocks", "@kbn/cypress-config": "link:packages/kbn-cypress-config", "@kbn/dev-cli-errors": "link:packages/kbn-dev-cli-errors", "@kbn/dev-cli-runner": "link:packages/kbn-dev-cli-runner", @@ -857,7 +857,7 @@ "@types/adm-zip": "^0.5.0", "@types/archiver": "^5.3.1", "@types/async": "^3.2.3", - "@types/babel__core": "^7.1.20", + "@types/babel__core": "^7.20.0", "@types/babel__generator": "^7.6.4", "@types/babel__helper-plugin-utils": "^7.10.0", "@types/base64-js": "^1.2.5", @@ -937,7 +937,7 @@ "@types/multistream": "^4.1.0", "@types/mustache": "^0.8.31", "@types/nock": "^10.0.3", - "@types/node": "18.11.18", + "@types/node": "16.11.68", "@types/node-fetch": "^2.6.0", "@types/node-forge": "^1.3.1", "@types/nodemailer": "^6.4.0", diff --git a/packages/core/analytics/core-analytics-browser-mocks/kibana.jsonc b/packages/core/analytics/core-analytics-browser-mocks/kibana.jsonc index 93bbc23fbbb79..34e790b37c1bf 100644 --- a/packages/core/analytics/core-analytics-browser-mocks/kibana.jsonc +++ b/packages/core/analytics/core-analytics-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-analytics-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/analytics/core-analytics-server-mocks/kibana.jsonc b/packages/core/analytics/core-analytics-server-mocks/kibana.jsonc index 319fec0506fe4..53c4ffb2026f5 100644 --- a/packages/core/analytics/core-analytics-server-mocks/kibana.jsonc +++ b/packages/core/analytics/core-analytics-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-analytics-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/application/core-application-browser-mocks/kibana.jsonc b/packages/core/application/core-application-browser-mocks/kibana.jsonc index 35714d9df41d4..dc516ef5c9552 100644 --- a/packages/core/application/core-application-browser-mocks/kibana.jsonc +++ b/packages/core/application/core-application-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-application-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/apps/core-apps-browser-mocks/kibana.jsonc b/packages/core/apps/core-apps-browser-mocks/kibana.jsonc index 970d9411462ad..731bb6ff85d0e 100644 --- a/packages/core/apps/core-apps-browser-mocks/kibana.jsonc +++ b/packages/core/apps/core-apps-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-apps-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/apps/core-apps-server-internal/src/core_app.ts b/packages/core/apps/core-apps-server-internal/src/core_app.ts index 872f3761b327f..c50ddd6e5cc1f 100644 --- a/packages/core/apps/core-apps-server-internal/src/core_app.ts +++ b/packages/core/apps/core-apps-server-internal/src/core_app.ts @@ -179,7 +179,9 @@ export class CoreAppsService { } const querystring = query ? stringify(query) : undefined; - const url = `${requestBasePath}/${rewrittenPath}${querystring ? `?${querystring}` : ''}`; + const url = `${requestBasePath}/${encodeURIComponent(rewrittenPath)}${ + querystring ? `?${querystring}` : '' + }`; return res.redirected({ headers: { diff --git a/packages/core/base/core-base-browser-mocks/kibana.jsonc b/packages/core/base/core-base-browser-mocks/kibana.jsonc index 48c6b95d3afbd..75e25bf270abc 100644 --- a/packages/core/base/core-base-browser-mocks/kibana.jsonc +++ b/packages/core/base/core-base-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-base-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/base/core-base-server-mocks/kibana.jsonc b/packages/core/base/core-base-server-mocks/kibana.jsonc index 438181d917750..1286250c208ce 100644 --- a/packages/core/base/core-base-server-mocks/kibana.jsonc +++ b/packages/core/base/core-base-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-base-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/capabilities/core-capabilities-browser-mocks/kibana.jsonc b/packages/core/capabilities/core-capabilities-browser-mocks/kibana.jsonc index ab693c53daa3f..e359b398d6ecf 100644 --- a/packages/core/capabilities/core-capabilities-browser-mocks/kibana.jsonc +++ b/packages/core/capabilities/core-capabilities-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-capabilities-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/capabilities/core-capabilities-server-mocks/kibana.jsonc b/packages/core/capabilities/core-capabilities-server-mocks/kibana.jsonc index 68739c985d15b..e8e84de6cef6b 100644 --- a/packages/core/capabilities/core-capabilities-server-mocks/kibana.jsonc +++ b/packages/core/capabilities/core-capabilities-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-capabilities-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/chrome/core-chrome-browser-mocks/kibana.jsonc b/packages/core/chrome/core-chrome-browser-mocks/kibana.jsonc index e9283e5dab605..84c0c7c07701d 100644 --- a/packages/core/chrome/core-chrome-browser-mocks/kibana.jsonc +++ b/packages/core/chrome/core-chrome-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-chrome-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/deprecations/core-deprecations-browser-mocks/kibana.jsonc b/packages/core/deprecations/core-deprecations-browser-mocks/kibana.jsonc index 464f09cb0edd1..79a4354f8278c 100644 --- a/packages/core/deprecations/core-deprecations-browser-mocks/kibana.jsonc +++ b/packages/core/deprecations/core-deprecations-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-deprecations-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/deprecations/core-deprecations-server-mocks/kibana.jsonc b/packages/core/deprecations/core-deprecations-server-mocks/kibana.jsonc index f897a7c512b97..7a4729b822579 100644 --- a/packages/core/deprecations/core-deprecations-server-mocks/kibana.jsonc +++ b/packages/core/deprecations/core-deprecations-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-deprecations-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/doc-links/core-doc-links-browser-mocks/kibana.jsonc b/packages/core/doc-links/core-doc-links-browser-mocks/kibana.jsonc index c081dab3fdb64..0bfa8221ad87c 100644 --- a/packages/core/doc-links/core-doc-links-browser-mocks/kibana.jsonc +++ b/packages/core/doc-links/core-doc-links-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-doc-links-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/doc-links/core-doc-links-server-mocks/kibana.jsonc b/packages/core/doc-links/core-doc-links-server-mocks/kibana.jsonc index 76c59c8f5b31a..22a0368bfcda1 100644 --- a/packages/core/doc-links/core-doc-links-server-mocks/kibana.jsonc +++ b/packages/core/doc-links/core-doc-links-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-doc-links-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/elasticsearch/core-elasticsearch-client-server-mocks/kibana.jsonc b/packages/core/elasticsearch/core-elasticsearch-client-server-mocks/kibana.jsonc index 234f583289e7a..9e2eec284c98d 100644 --- a/packages/core/elasticsearch/core-elasticsearch-client-server-mocks/kibana.jsonc +++ b/packages/core/elasticsearch/core-elasticsearch-client-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-elasticsearch-client-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/elasticsearch/core-elasticsearch-server-mocks/kibana.jsonc b/packages/core/elasticsearch/core-elasticsearch-server-mocks/kibana.jsonc index 07c507160e1b3..e08bba9ad0e34 100644 --- a/packages/core/elasticsearch/core-elasticsearch-server-mocks/kibana.jsonc +++ b/packages/core/elasticsearch/core-elasticsearch-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-elasticsearch-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/environment/core-environment-server-mocks/kibana.jsonc b/packages/core/environment/core-environment-server-mocks/kibana.jsonc index 6905db81b1d91..52b0d1fd67358 100644 --- a/packages/core/environment/core-environment-server-mocks/kibana.jsonc +++ b/packages/core/environment/core-environment-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-environment-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/execution-context/core-execution-context-browser-mocks/kibana.jsonc b/packages/core/execution-context/core-execution-context-browser-mocks/kibana.jsonc index 63963af90bdff..2f26eabba462b 100644 --- a/packages/core/execution-context/core-execution-context-browser-mocks/kibana.jsonc +++ b/packages/core/execution-context/core-execution-context-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-execution-context-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/execution-context/core-execution-context-server-mocks/kibana.jsonc b/packages/core/execution-context/core-execution-context-server-mocks/kibana.jsonc index 05ebf05ec64ba..f00127ed53fd3 100644 --- a/packages/core/execution-context/core-execution-context-server-mocks/kibana.jsonc +++ b/packages/core/execution-context/core-execution-context-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-execution-context-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/fatal-errors/core-fatal-errors-browser-mocks/kibana.jsonc b/packages/core/fatal-errors/core-fatal-errors-browser-mocks/kibana.jsonc index 61cb6496a2410..7f109e5a82a33 100644 --- a/packages/core/fatal-errors/core-fatal-errors-browser-mocks/kibana.jsonc +++ b/packages/core/fatal-errors/core-fatal-errors-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-fatal-errors-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/http/core-http-browser-mocks/kibana.jsonc b/packages/core/http/core-http-browser-mocks/kibana.jsonc index 929adb25ee477..1a6824642b610 100644 --- a/packages/core/http/core-http-browser-mocks/kibana.jsonc +++ b/packages/core/http/core-http-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-http-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/http/core-http-context-server-mocks/kibana.jsonc b/packages/core/http/core-http-context-server-mocks/kibana.jsonc index aee5e424e6d33..19c6c700b54e6 100644 --- a/packages/core/http/core-http-context-server-mocks/kibana.jsonc +++ b/packages/core/http/core-http-context-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-http-context-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/http/core-http-resources-server-mocks/kibana.jsonc b/packages/core/http/core-http-resources-server-mocks/kibana.jsonc index fee811ff5d489..3b2bbee18b260 100644 --- a/packages/core/http/core-http-resources-server-mocks/kibana.jsonc +++ b/packages/core/http/core-http-resources-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-http-resources-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/http/core-http-router-server-mocks/kibana.jsonc b/packages/core/http/core-http-router-server-mocks/kibana.jsonc index a00b5ef3bdf10..5c6cbef3e8bd6 100644 --- a/packages/core/http/core-http-router-server-mocks/kibana.jsonc +++ b/packages/core/http/core-http-router-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-http-router-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/http/core-http-server-mocks/kibana.jsonc b/packages/core/http/core-http-server-mocks/kibana.jsonc index 6964e15f6ab82..07b23a084f966 100644 --- a/packages/core/http/core-http-server-mocks/kibana.jsonc +++ b/packages/core/http/core-http-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-http-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/i18n/core-i18n-browser-mocks/kibana.jsonc b/packages/core/i18n/core-i18n-browser-mocks/kibana.jsonc index b53670e4d6265..1c8b1d19d51ee 100644 --- a/packages/core/i18n/core-i18n-browser-mocks/kibana.jsonc +++ b/packages/core/i18n/core-i18n-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-i18n-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/i18n/core-i18n-server-mocks/kibana.jsonc b/packages/core/i18n/core-i18n-server-mocks/kibana.jsonc index 7cd0a24565bd7..1d651ce8a767b 100644 --- a/packages/core/i18n/core-i18n-server-mocks/kibana.jsonc +++ b/packages/core/i18n/core-i18n-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-i18n-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/injected-metadata/core-injected-metadata-browser-mocks/kibana.jsonc b/packages/core/injected-metadata/core-injected-metadata-browser-mocks/kibana.jsonc index 340968dde25f6..c353636f8b2a6 100644 --- a/packages/core/injected-metadata/core-injected-metadata-browser-mocks/kibana.jsonc +++ b/packages/core/injected-metadata/core-injected-metadata-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-injected-metadata-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/integrations/core-integrations-browser-mocks/kibana.jsonc b/packages/core/integrations/core-integrations-browser-mocks/kibana.jsonc index 3231c3e282bcd..c1506381719ad 100644 --- a/packages/core/integrations/core-integrations-browser-mocks/kibana.jsonc +++ b/packages/core/integrations/core-integrations-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-integrations-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/lifecycle/core-lifecycle-browser-mocks/kibana.jsonc b/packages/core/lifecycle/core-lifecycle-browser-mocks/kibana.jsonc index e3dda6943018b..d70f77670c1e4 100644 --- a/packages/core/lifecycle/core-lifecycle-browser-mocks/kibana.jsonc +++ b/packages/core/lifecycle/core-lifecycle-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-lifecycle-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/lifecycle/core-lifecycle-server-mocks/kibana.jsonc b/packages/core/lifecycle/core-lifecycle-server-mocks/kibana.jsonc index abb14b3c14867..4f780278c2806 100644 --- a/packages/core/lifecycle/core-lifecycle-server-mocks/kibana.jsonc +++ b/packages/core/lifecycle/core-lifecycle-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-lifecycle-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/logging/core-logging-browser-mocks/kibana.jsonc b/packages/core/logging/core-logging-browser-mocks/kibana.jsonc index 122934b8cfd18..04b3c2bd699df 100644 --- a/packages/core/logging/core-logging-browser-mocks/kibana.jsonc +++ b/packages/core/logging/core-logging-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-logging-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/logging/core-logging-server-internal/src/__snapshots__/logging_system.test.ts.snap b/packages/core/logging/core-logging-server-internal/src/__snapshots__/logging_system.test.ts.snap index 55a144b92ee26..36fd4b605e579 100644 --- a/packages/core/logging/core-logging-server-internal/src/__snapshots__/logging_system.test.ts.snap +++ b/packages/core/logging/core-logging-server-internal/src/__snapshots__/logging_system.test.ts.snap @@ -16,7 +16,7 @@ exports[`asLoggerFactory() only allows to create new loggers. 1`] = ` Object { "@timestamp": "2012-01-30T22:33:22.011-05:00", "ecs": Object { - "version": "8.4.0", + "version": "8.6.0", }, "log": Object { "level": "TRACE", @@ -33,7 +33,7 @@ exports[`asLoggerFactory() only allows to create new loggers. 2`] = ` Object { "@timestamp": "2012-01-30T17:33:22.011-05:00", "ecs": Object { - "version": "8.4.0", + "version": "8.6.0", }, "log": Object { "level": "INFO", @@ -51,7 +51,7 @@ exports[`asLoggerFactory() only allows to create new loggers. 3`] = ` Object { "@timestamp": "2012-01-30T12:33:22.011-05:00", "ecs": Object { - "version": "8.4.0", + "version": "8.6.0", }, "log": Object { "level": "FATAL", @@ -68,7 +68,7 @@ exports[`flushes memory buffer logger and switches to real logger once config is Object { "@timestamp": "2012-02-01T09:33:22.011-05:00", "ecs": Object { - "version": "8.4.0", + "version": "8.6.0", }, "log": Object { "level": "INFO", @@ -86,7 +86,7 @@ exports[`flushes memory buffer logger and switches to real logger once config is Object { "@timestamp": "2012-01-31T23:33:22.011-05:00", "ecs": Object { - "version": "8.4.0", + "version": "8.6.0", }, "log": Object { "level": "INFO", diff --git a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts index 1a197883e511d..dfa2144c28015 100644 --- a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts +++ b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.test.ts @@ -6,6 +6,7 @@ * Side Public License, v 1. */ +import { EcsVersion } from '@kbn/ecs'; import { LogLevel, LogRecord } from '@kbn/logging'; import { JsonLayout } from './json_layout'; @@ -81,7 +82,7 @@ test('`format()` correctly formats record and includes correct ECS version.', () for (const record of records) { const { ecs, ...restOfRecord } = JSON.parse(layout.format(record)); - expect(ecs).toStrictEqual({ version: '8.4.0' }); + expect(ecs).toStrictEqual({ version: EcsVersion }); expect(restOfRecord).toMatchSnapshot(); } }); diff --git a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts index 7d9e198565d98..cd41b7675464e 100644 --- a/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts +++ b/packages/core/logging/core-logging-server-internal/src/layouts/json_layout.ts @@ -9,7 +9,7 @@ import moment from 'moment-timezone'; import { merge } from '@kbn/std'; import { schema } from '@kbn/config-schema'; -import { Ecs } from '@kbn/ecs'; +import { Ecs, EcsVersion } from '@kbn/ecs'; import { LogRecord, Layout } from '@kbn/logging'; const { literal, object } = schema; @@ -43,7 +43,7 @@ export class JsonLayout implements Layout { const transactionId = record.meta?.transaction?.id ?? record.transactionId; const log: Ecs = { - ecs: { version: '8.4.0' }, + ecs: { version: EcsVersion }, '@timestamp': moment(record.timestamp).format('YYYY-MM-DDTHH:mm:ss.SSSZ'), message: record.message, error: JsonLayout.errorToSerializableObject(record.error), diff --git a/packages/core/logging/core-logging-server-internal/src/logging_system.test.ts b/packages/core/logging/core-logging-server-internal/src/logging_system.test.ts index bffe062118c5b..b28a95f731f72 100644 --- a/packages/core/logging/core-logging-server-internal/src/logging_system.test.ts +++ b/packages/core/logging/core-logging-server-internal/src/logging_system.test.ts @@ -8,7 +8,7 @@ import { mockStreamWrite, mockGetFlattenedObject } from './logging_system.test.mocks'; -const dynamicProps = { process: { pid: expect.any(Number) } }; +const dynamicProps = { process: { pid: expect.any(Number) }, ecs: { version: EcsVersion } }; const timestamp = new Date(Date.UTC(2012, 1, 1, 14, 33, 22, 11)); let mockConsoleLog: jest.SpyInstance; @@ -17,6 +17,7 @@ import { createWriteStream } from 'fs'; const mockCreateWriteStream = createWriteStream as unknown as jest.Mock; import { LoggingSystem, config } from '..'; +import { EcsVersion } from '@kbn/ecs'; let system: LoggingSystem; beforeEach(() => { diff --git a/packages/core/logging/core-logging-server-mocks/kibana.jsonc b/packages/core/logging/core-logging-server-mocks/kibana.jsonc index 3408f6692746c..443efb6cdcfe6 100644 --- a/packages/core/logging/core-logging-server-mocks/kibana.jsonc +++ b/packages/core/logging/core-logging-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-logging-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/metrics/core-metrics-collectors-server-mocks/kibana.jsonc b/packages/core/metrics/core-metrics-collectors-server-mocks/kibana.jsonc index 3b24f1787e049..7629dd18a55b5 100644 --- a/packages/core/metrics/core-metrics-collectors-server-mocks/kibana.jsonc +++ b/packages/core/metrics/core-metrics-collectors-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-metrics-collectors-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/metrics/core-metrics-server-mocks/kibana.jsonc b/packages/core/metrics/core-metrics-server-mocks/kibana.jsonc index 4e55b952f1321..b722ae6c1e702 100644 --- a/packages/core/metrics/core-metrics-server-mocks/kibana.jsonc +++ b/packages/core/metrics/core-metrics-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-metrics-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/node/core-node-server-mocks/kibana.jsonc b/packages/core/node/core-node-server-mocks/kibana.jsonc index 1f1b6639042ec..4a04e244899e5 100644 --- a/packages/core/node/core-node-server-mocks/kibana.jsonc +++ b/packages/core/node/core-node-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-node-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/notifications/core-notifications-browser-mocks/kibana.jsonc b/packages/core/notifications/core-notifications-browser-mocks/kibana.jsonc index 1705ff3144b48..e5971c404204f 100644 --- a/packages/core/notifications/core-notifications-browser-mocks/kibana.jsonc +++ b/packages/core/notifications/core-notifications-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-notifications-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/overlays/core-overlays-browser-mocks/kibana.jsonc b/packages/core/overlays/core-overlays-browser-mocks/kibana.jsonc index f157b590fb35b..ee4989cc38d1f 100644 --- a/packages/core/overlays/core-overlays-browser-mocks/kibana.jsonc +++ b/packages/core/overlays/core-overlays-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-overlays-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/plugins/core-plugins-browser-mocks/kibana.jsonc b/packages/core/plugins/core-plugins-browser-mocks/kibana.jsonc index 1a3f5258dca2d..8dd092a0835d1 100644 --- a/packages/core/plugins/core-plugins-browser-mocks/kibana.jsonc +++ b/packages/core/plugins/core-plugins-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-plugins-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/plugins/core-plugins-server-mocks/kibana.jsonc b/packages/core/plugins/core-plugins-server-mocks/kibana.jsonc index 62d8b6d118156..f56fe9da7ab06 100644 --- a/packages/core/plugins/core-plugins-server-mocks/kibana.jsonc +++ b/packages/core/plugins/core-plugins-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-plugins-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/preboot/core-preboot-server-mocks/kibana.jsonc b/packages/core/preboot/core-preboot-server-mocks/kibana.jsonc index 91e60bd62b1e1..de65649980659 100644 --- a/packages/core/preboot/core-preboot-server-mocks/kibana.jsonc +++ b/packages/core/preboot/core-preboot-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-preboot-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/rendering/core-rendering-browser-mocks/kibana.jsonc b/packages/core/rendering/core-rendering-browser-mocks/kibana.jsonc index 38be88afd1499..25279626447cb 100644 --- a/packages/core/rendering/core-rendering-browser-mocks/kibana.jsonc +++ b/packages/core/rendering/core-rendering-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-rendering-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/rendering/core-rendering-server-mocks/kibana.jsonc b/packages/core/rendering/core-rendering-server-mocks/kibana.jsonc index 8d836f9acddaa..f56b1a1c735b3 100644 --- a/packages/core/rendering/core-rendering-server-mocks/kibana.jsonc +++ b/packages/core/rendering/core-rendering-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-rendering-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-api-server-mocks/kibana.jsonc b/packages/core/saved-objects/core-saved-objects-api-server-mocks/kibana.jsonc index 0bb78d126e72d..396eaf6911868 100644 --- a/packages/core/saved-objects/core-saved-objects-api-server-mocks/kibana.jsonc +++ b/packages/core/saved-objects/core-saved-objects-api-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-saved-objects-api-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-base-server-mocks/kibana.jsonc b/packages/core/saved-objects/core-saved-objects-base-server-mocks/kibana.jsonc index 29356da39ae30..ec80952e8e88a 100644 --- a/packages/core/saved-objects/core-saved-objects-base-server-mocks/kibana.jsonc +++ b/packages/core/saved-objects/core-saved-objects-base-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-saved-objects-base-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-browser-mocks/kibana.jsonc b/packages/core/saved-objects/core-saved-objects-browser-mocks/kibana.jsonc index 105338611b28f..d23c1c7eaf8fb 100644 --- a/packages/core/saved-objects/core-saved-objects-browser-mocks/kibana.jsonc +++ b/packages/core/saved-objects/core-saved-objects-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-saved-objects-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-import-export-server-mocks/kibana.jsonc b/packages/core/saved-objects/core-saved-objects-import-export-server-mocks/kibana.jsonc index 20b09ed4cf69a..94155855e5a69 100644 --- a/packages/core/saved-objects/core-saved-objects-import-export-server-mocks/kibana.jsonc +++ b/packages/core/saved-objects/core-saved-objects-import-export-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-saved-objects-import-export-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-migration-server-mocks/kibana.jsonc b/packages/core/saved-objects/core-saved-objects-migration-server-mocks/kibana.jsonc index 49e49c7d12b4f..3085afaf90d13 100644 --- a/packages/core/saved-objects/core-saved-objects-migration-server-mocks/kibana.jsonc +++ b/packages/core/saved-objects/core-saved-objects-migration-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-saved-objects-migration-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-server-mocks/kibana.jsonc b/packages/core/saved-objects/core-saved-objects-server-mocks/kibana.jsonc index 4e9f3fa49b016..ed6812237c399 100644 --- a/packages/core/saved-objects/core-saved-objects-server-mocks/kibana.jsonc +++ b/packages/core/saved-objects/core-saved-objects-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-saved-objects-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts b/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts index 7ad9c37062a3d..1805e79b74340 100644 --- a/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts +++ b/packages/core/saved-objects/core-saved-objects-server/src/extensions/security.ts @@ -6,8 +6,8 @@ * Side Public License, v 1. */ -import type { EcsEventOutcome } from '@kbn/ecs'; -import type { SavedObject } from '../..'; +import type { SavedObject } from '@kbn/core-saved-objects-common'; +import type { EcsEvent } from '@kbn/ecs'; /** * The PerformAuthorizationParams interface contains settings for checking @@ -169,7 +169,7 @@ export interface AddAuditEventParams { * The outcome of the operation * 'failure' | 'success' | 'unknown' */ - outcome?: EcsEventOutcome; + outcome?: EcsEvent['outcome']; /** * relevant saved object information * object containing type & id strings diff --git a/packages/core/status/core-status-server-mocks/kibana.jsonc b/packages/core/status/core-status-server-mocks/kibana.jsonc index ebb50f47fb40f..91ee9ce8065bd 100644 --- a/packages/core/status/core-status-server-mocks/kibana.jsonc +++ b/packages/core/status/core-status-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-status-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/theme/core-theme-browser-mocks/kibana.jsonc b/packages/core/theme/core-theme-browser-mocks/kibana.jsonc index f04c78bf09fe5..5955ef8eb8beb 100644 --- a/packages/core/theme/core-theme-browser-mocks/kibana.jsonc +++ b/packages/core/theme/core-theme-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-theme-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/ui-settings/core-ui-settings-browser-mocks/kibana.jsonc b/packages/core/ui-settings/core-ui-settings-browser-mocks/kibana.jsonc index fe1b1c48238cd..8f3d630732b6d 100644 --- a/packages/core/ui-settings/core-ui-settings-browser-mocks/kibana.jsonc +++ b/packages/core/ui-settings/core-ui-settings-browser-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-ui-settings-browser-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/ui-settings/core-ui-settings-server-mocks/kibana.jsonc b/packages/core/ui-settings/core-ui-settings-server-mocks/kibana.jsonc index b82edffb705dd..f55c1ada332ee 100644 --- a/packages/core/ui-settings/core-ui-settings-server-mocks/kibana.jsonc +++ b/packages/core/ui-settings/core-ui-settings-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-ui-settings-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/core/usage-data/core-usage-data-server-mocks/kibana.jsonc b/packages/core/usage-data/core-usage-data-server-mocks/kibana.jsonc index f916d41050f66..65dd20ad22ece 100644 --- a/packages/core/usage-data/core-usage-data-server-mocks/kibana.jsonc +++ b/packages/core/usage-data/core-usage-data-server-mocks/kibana.jsonc @@ -1,5 +1,6 @@ { "type": "shared-common", "id": "@kbn/core-usage-data-server-mocks", + "devOnly": true, "owner": "@elastic/kibana-core" } diff --git a/packages/kbn-babel-preset/node_preset.js b/packages/kbn-babel-preset/node_preset.js index 54efea1cebb5a..0d8173308bd78 100644 --- a/packages/kbn-babel-preset/node_preset.js +++ b/packages/kbn-babel-preset/node_preset.js @@ -31,7 +31,7 @@ module.exports = (_, options = {}) => { // Because of that we should use for that value the same version we install // in the package.json in order to have the same polyfills between the environment // and the tests - corejs: '3.27.1', + corejs: '3.27.2', bugfixes: true, ...(options['@babel/preset-env'] || {}), diff --git a/packages/kbn-babel-preset/webpack_preset.js b/packages/kbn-babel-preset/webpack_preset.js index 7dfe996b91faf..ddcc165c5a9e2 100644 --- a/packages/kbn-babel-preset/webpack_preset.js +++ b/packages/kbn-babel-preset/webpack_preset.js @@ -19,7 +19,7 @@ module.exports = (api, options = {}) => { modules: false, // Please read the explanation for this // in node_preset.js - corejs: '3.27.1', + corejs: '3.27.2', bugfixes: true, browserslistEnv: api.env('production') ? 'production' : 'dev', }, diff --git a/packages/kbn-ecs/README.md b/packages/kbn-ecs/README.md index 8e57bb8f56691..7034a25d0108f 100644 --- a/packages/kbn-ecs/README.md +++ b/packages/kbn-ecs/README.md @@ -2,4 +2,6 @@ Base types for Elastic common schema. These types are used for `logging` and any extensions to the types declared in this package need to be in their own dedicated packages. -https://www.elastic.co/guide/en/ecs/current/index.html \ No newline at end of file +https://www.elastic.co/guide/en/ecs/current/index.html + +Type definitions are autogenerated with https://github.com/elastic/ecs-typescript \ No newline at end of file diff --git a/packages/kbn-ecs/generated/agent.ts b/packages/kbn-ecs/generated/agent.ts new file mode 100644 index 0000000000000..8c38bfdc09e4f --- /dev/null +++ b/packages/kbn-ecs/generated/agent.ts @@ -0,0 +1,46 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host. + * Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken. + */ +export interface EcsAgent { + build?: { + /** + * Extended build information for the agent. + * This field is intended to contain any build information that a data source may provide, no specific formatting is required. + */ + original?: string; + }; + + /** + * Ephemeral identifier of this agent (if one exists). + * This id normally changes across restarts, but `agent.id` does not. + */ + ephemeral_id?: string; + /** + * Unique identifier of this agent (if one exists). + * Example: For Beats this would be beat.id. + */ + id?: string; + /** + * Custom name of the agent. + * This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. + */ + name?: string; + /** + * Type of the agent. + * The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. + */ + type?: string; + /** + * Version of the agent. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/as.ts b/packages/kbn-ecs/generated/as.ts new file mode 100644 index 0000000000000..7b1b78e45d3dd --- /dev/null +++ b/packages/kbn-ecs/generated/as.ts @@ -0,0 +1,23 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet. + */ +export interface EcsAs { + /** + * Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + */ + number?: number; + organization?: { + /** + * Organization name. + */ + name?: string; + }; +} diff --git a/packages/kbn-ecs/generated/base.ts b/packages/kbn-ecs/generated/base.ts new file mode 100644 index 0000000000000..f9568a9f5b957 --- /dev/null +++ b/packages/kbn-ecs/generated/base.ts @@ -0,0 +1,36 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The `base` field set contains all fields which are at the root of the events. These fields are common across all types of events. + */ +export interface EcsBase { + /** + * Date/time when the event originated. + * This is the date/time extracted from the event, typically representing when the event was generated by the source. + * If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. + * Required field for all events. + */ + '@timestamp': string; + /** + * Custom key/value pairs. + * Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. + * Example: `docker` and `k8s` labels. + */ + labels?: Record; + /** + * For log events the message field contains the log message, optimized for viewing in a log viewer. + * For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. + * If multiple messages exist, they can be combined into one message. + */ + message?: string; + /** + * List of keywords used to tag each event. + */ + tags?: string[]; +} diff --git a/packages/kbn-ecs/generated/client.ts b/packages/kbn-ecs/generated/client.ts new file mode 100644 index 0000000000000..21fe4898e2c9e --- /dev/null +++ b/packages/kbn-ecs/generated/client.ts @@ -0,0 +1,186 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records. + * For TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events. + * Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately. + */ +export interface EcsClient { + /** + * Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. + * Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. + */ + address?: string; + as?: { + /** + * Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + */ + number?: number; + organization?: { + /** + * Organization name. + */ + name?: string; + }; + }; + + /** + * Bytes sent from the client to the server. + */ + bytes?: number; + /** + * The domain name of the client system. + * This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. + */ + domain?: string; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * IP address of the client (IPv4 or IPv6). + */ + ip?: string; + /** + * MAC address of the client. + * The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. + */ + mac?: string; + nat?: { + /** + * Translated IP of source based NAT sessions (e.g. internal client to internet). + * Typically connections traversing load balancers, firewalls, or routers. + */ + ip?: string; + /** + * Translated port of source based NAT sessions (e.g. internal client to internet). + * Typically connections traversing load balancers, firewalls, or routers. + */ + port?: number; + }; + + /** + * Packets sent from the client to the server. + */ + packets?: number; + /** + * Port of the client. + */ + port?: number; + /** + * The highest registered client domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. + * For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + user?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; +} diff --git a/packages/kbn-ecs/generated/cloud.ts b/packages/kbn-ecs/generated/cloud.ts new file mode 100644 index 0000000000000..6d9e138bc1b45 --- /dev/null +++ b/packages/kbn-ecs/generated/cloud.ts @@ -0,0 +1,208 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields related to the cloud or infrastructure the events are coming from. + */ +export interface EcsCloud { + account?: { + /** + * The cloud account or organization id used to identify different entities in a multi-tenant environment. + * Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. + */ + id?: string; + /** + * The cloud account name or alias used to identify different entities in a multi-tenant environment. + * Examples: AWS account name, Google Cloud ORG display name. + */ + name?: string; + }; + + /** + * Availability zone in which this host, resource, or service is located. + */ + availability_zone?: string; + instance?: { + /** + * Instance ID of the host machine. + */ + id?: string; + /** + * Instance name of the host machine. + */ + name?: string; + }; + + machine?: { + /** + * Machine type of the host machine. + */ + type?: string; + }; + + origin?: { + account?: { + /** + * The cloud account or organization id used to identify different entities in a multi-tenant environment. + * Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. + */ + id?: string; + /** + * The cloud account name or alias used to identify different entities in a multi-tenant environment. + * Examples: AWS account name, Google Cloud ORG display name. + */ + name?: string; + }; + + /** + * Availability zone in which this host, resource, or service is located. + */ + availability_zone?: string; + instance?: { + /** + * Instance ID of the host machine. + */ + id?: string; + /** + * Instance name of the host machine. + */ + name?: string; + }; + + machine?: { + /** + * Machine type of the host machine. + */ + type?: string; + }; + + project?: { + /** + * The cloud project identifier. + * Examples: Google Cloud Project id, Azure Project id. + */ + id?: string; + /** + * The cloud project name. + * Examples: Google Cloud Project name, Azure Project name. + */ + name?: string; + }; + + /** + * Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + */ + provider?: string; + /** + * Region in which this host, resource, or service is located. + */ + region?: string; + service?: { + /** + * The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server. + * Examples: app engine, app service, cloud run, fargate, lambda. + */ + name?: string; + }; + }; + + project?: { + /** + * The cloud project identifier. + * Examples: Google Cloud Project id, Azure Project id. + */ + id?: string; + /** + * The cloud project name. + * Examples: Google Cloud Project name, Azure Project name. + */ + name?: string; + }; + + /** + * Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + */ + provider?: string; + /** + * Region in which this host, resource, or service is located. + */ + region?: string; + service?: { + /** + * The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server. + * Examples: app engine, app service, cloud run, fargate, lambda. + */ + name?: string; + }; + + target?: { + account?: { + /** + * The cloud account or organization id used to identify different entities in a multi-tenant environment. + * Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. + */ + id?: string; + /** + * The cloud account name or alias used to identify different entities in a multi-tenant environment. + * Examples: AWS account name, Google Cloud ORG display name. + */ + name?: string; + }; + + /** + * Availability zone in which this host, resource, or service is located. + */ + availability_zone?: string; + instance?: { + /** + * Instance ID of the host machine. + */ + id?: string; + /** + * Instance name of the host machine. + */ + name?: string; + }; + + machine?: { + /** + * Machine type of the host machine. + */ + type?: string; + }; + + project?: { + /** + * The cloud project identifier. + * Examples: Google Cloud Project id, Azure Project id. + */ + id?: string; + /** + * The cloud project name. + * Examples: Google Cloud Project name, Azure Project name. + */ + name?: string; + }; + + /** + * Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + */ + provider?: string; + /** + * Region in which this host, resource, or service is located. + */ + region?: string; + service?: { + /** + * The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server. + * Examples: app engine, app service, cloud run, fargate, lambda. + */ + name?: string; + }; + }; +} diff --git a/packages/kbn-ecs/generated/code_signature.ts b/packages/kbn-ecs/generated/code_signature.ts new file mode 100644 index 0000000000000..0a7509b175207 --- /dev/null +++ b/packages/kbn-ecs/generated/code_signature.ts @@ -0,0 +1,55 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain information about binary code signatures. + */ +export interface EcsCodeSignature { + /** + * The hashing algorithm used to sign the process. + * This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. + */ + digest_algorithm?: string; + /** + * Boolean to capture if a signature is present. + */ + exists?: boolean; + /** + * The identifier used to sign the process. + * This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. + */ + signing_id?: string; + /** + * Additional information about the certificate status. + * This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + */ + status?: string; + /** + * Subject name of the code signer + */ + subject_name?: string; + /** + * The team identifier used to sign the process. + * This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. + */ + team_id?: string; + /** + * Date and time when the code signature was generated and signed. + */ + timestamp?: string; + /** + * Stores the trust status of the certificate chain. + * Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + */ + trusted?: boolean; + /** + * Boolean to capture if the digital signature is verified against the binary content. + * Leave unpopulated if a certificate was unchecked. + */ + valid?: boolean; +} diff --git a/packages/kbn-ecs/generated/container.ts b/packages/kbn-ecs/generated/container.ts new file mode 100644 index 0000000000000..d7c760d2ca803 --- /dev/null +++ b/packages/kbn-ecs/generated/container.ts @@ -0,0 +1,94 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Container fields are used for meta information about the specific container that is the source of information. + * These fields help correlate data based containers from any runtime. + */ +export interface EcsContainer { + cpu?: { + /** + * Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. + */ + usage?: number; + }; + + disk?: { + read?: { + /** + * The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. + */ + bytes?: number; + }; + + write?: { + /** + * The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. + */ + bytes?: number; + }; + }; + + /** + * Unique container id. + */ + id?: string; + image?: { + hash?: { + /** + * An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set. + */ + all?: string[]; + }; + + /** + * Name of the image the container was built on. + */ + name?: string; + /** + * Container image tags. + */ + tag?: string[]; + }; + + /** + * Image labels. + */ + labels?: Record; + memory?: { + /** + * Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000. + */ + usage?: number; + }; + + /** + * Container name. + */ + name?: string; + network?: { + egress?: { + /** + * The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection. + */ + bytes?: number; + }; + + ingress?: { + /** + * The number of bytes received (gauge) on all network interfaces by the container since the last metric collection. + */ + bytes?: number; + }; + }; + + /** + * Runtime managing this container. + */ + runtime?: string; +} diff --git a/packages/kbn-ecs/generated/data_stream.ts b/packages/kbn-ecs/generated/data_stream.ts new file mode 100644 index 0000000000000..42dde7dc158cb --- /dev/null +++ b/packages/kbn-ecs/generated/data_stream.ts @@ -0,0 +1,36 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The data_stream fields take part in defining the new data stream naming scheme. + * In the new data stream naming scheme the value of the data stream fields combine to the name of the actual data stream in the following manner: `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`. This means the fields can only contain characters that are valid as part of names of data streams. More details about this can be found in this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog post]. + * An Elasticsearch data stream consists of one or more backing indices, and a data stream name forms part of the backing indices names. Due to this convention, data streams must also follow index naming restrictions. For example, data stream names cannot include `\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, ` ` (space character), `,`, or `#`. Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions]. + */ +export interface EcsDataStream { + /** + * The field can contain anything that makes sense to signify the source of the data. + * Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. + * Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: + * * Must not contain `-` + * * No longer than 100 characters + */ + dataset?: string; + /** + * A user defined namespace. Namespaces are useful to allow grouping of data. + * Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. + * Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: + * * Must not contain `-` + * * No longer than 100 characters + */ + namespace?: string; + /** + * An overarching type for the data stream. + * Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. + */ + type?: string; +} diff --git a/packages/kbn-ecs/generated/destination.ts b/packages/kbn-ecs/generated/destination.ts new file mode 100644 index 0000000000000..351e14526b9d8 --- /dev/null +++ b/packages/kbn-ecs/generated/destination.ts @@ -0,0 +1,185 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction. + * Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated. + */ +export interface EcsDestination { + /** + * Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. + * Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. + */ + address?: string; + as?: { + /** + * Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + */ + number?: number; + organization?: { + /** + * Organization name. + */ + name?: string; + }; + }; + + /** + * Bytes sent from the destination to the source. + */ + bytes?: number; + /** + * The domain name of the destination system. + * This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. + */ + domain?: string; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * IP address of the destination (IPv4 or IPv6). + */ + ip?: string; + /** + * MAC address of the destination. + * The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. + */ + mac?: string; + nat?: { + /** + * Translated ip of destination based NAT sessions (e.g. internet to private DMZ) + * Typically used with load balancers, firewalls, or routers. + */ + ip?: string; + /** + * Port the source session is translated to by NAT Device. + * Typically used with load balancers, firewalls, or routers. + */ + port?: number; + }; + + /** + * Packets sent from the destination to the source. + */ + packets?: number; + /** + * Port of the destination. + */ + port?: number; + /** + * The highest registered destination domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. + * For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + user?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; +} diff --git a/packages/kbn-ecs/generated/device.ts b/packages/kbn-ecs/generated/device.ts new file mode 100644 index 0000000000000..83969cc6b4a56 --- /dev/null +++ b/packages/kbn-ecs/generated/device.ts @@ -0,0 +1,34 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields that describe a device instance and its characteristics. Data collected for applications and processes running on a (mobile) device can be enriched with these fields to describe the identity, type and other characteristics of the device. + * This field group definition is based on the Device namespace of the OpenTelemetry Semantic Conventions (https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/device/). + */ +export interface EcsDevice { + /** + * The unique identifier of a device. The identifier must not change across application sessions but stay fixex for an instance of a (mobile) device. + * On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. + * For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. + */ + id?: string; + /** + * The vendor name of the device manufacturer. + */ + manufacturer?: string; + model?: { + /** + * The machine readable identifier of the device model. + */ + identifier?: string; + /** + * The human readable marketing name of the device model. + */ + name?: string; + }; +} diff --git a/packages/kbn-ecs/generated/dll.ts b/packages/kbn-ecs/generated/dll.ts new file mode 100644 index 0000000000000..aec7584e5e937 --- /dev/null +++ b/packages/kbn-ecs/generated/dll.ts @@ -0,0 +1,139 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain information about code libraries dynamically loaded into processes. + * + * Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following: + * * Dynamic-link library (`.dll`) commonly used on Windows + * * Shared Object (`.so`) commonly used on Unix-like operating systems + * * Dynamic library (`.dylib`) commonly used on macOS + */ +export interface EcsDll { + code_signature?: { + /** + * The hashing algorithm used to sign the process. + * This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. + */ + digest_algorithm?: string; + /** + * Boolean to capture if a signature is present. + */ + exists?: boolean; + /** + * The identifier used to sign the process. + * This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. + */ + signing_id?: string; + /** + * Additional information about the certificate status. + * This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + */ + status?: string; + /** + * Subject name of the code signer + */ + subject_name?: string; + /** + * The team identifier used to sign the process. + * This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. + */ + team_id?: string; + /** + * Date and time when the code signature was generated and signed. + */ + timestamp?: string; + /** + * Stores the trust status of the certificate chain. + * Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + */ + trusted?: boolean; + /** + * Boolean to capture if the digital signature is verified against the binary content. + * Leave unpopulated if a certificate was unchecked. + */ + valid?: boolean; + }; + + hash?: { + /** + * MD5 hash. + */ + md5?: string; + /** + * SHA1 hash. + */ + sha1?: string; + /** + * SHA256 hash. + */ + sha256?: string; + /** + * SHA384 hash. + */ + sha384?: string; + /** + * SHA512 hash. + */ + sha512?: string; + /** + * SSDEEP hash. + */ + ssdeep?: string; + /** + * TLSH hash. + */ + tlsh?: string; + }; + + /** + * Name of the library. + * This generally maps to the name of the file on disk. + */ + name?: string; + /** + * Full file path of the library. + */ + path?: string; + pe?: { + /** + * CPU architecture target for the file. + */ + architecture?: string; + /** + * Internal company name of the file, provided at compile-time. + */ + company?: string; + /** + * Internal description of the file, provided at compile-time. + */ + description?: string; + /** + * Internal version of the file, provided at compile-time. + */ + file_version?: string; + /** + * A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + */ + imphash?: string; + /** + * Internal name of the file, provided at compile-time. + */ + original_file_name?: string; + /** + * A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. + * Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. + */ + pehash?: string; + /** + * Internal product name of the file, provided at compile-time. + */ + product?: string; + }; +} diff --git a/packages/kbn-ecs/generated/dns.ts b/packages/kbn-ecs/generated/dns.ts new file mode 100644 index 0000000000000..e2a8b122d3308 --- /dev/null +++ b/packages/kbn-ecs/generated/dns.ts @@ -0,0 +1,79 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields describing DNS queries and answers. + * DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`). + */ +export interface EcsDns { + /** + * An array containing an object for each answer section returned by the server. + * The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines. + * Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields. + */ + answers?: Array>; + /** + * Array of 2 letter DNS header flags. + */ + header_flags?: string[]; + /** + * The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. + */ + id?: string; + /** + * The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. + */ + op_code?: string; + question?: { + /** + * The class of records being queried. + */ + class?: string; + /** + * The name being queried. + * If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. + */ + name?: string; + /** + * The highest registered domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * The subdomain is all of the labels under the registered_domain. + * If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + /** + * The type of record being queried. + */ + type?: string; + }; + + /** + * Array containing all IPs seen in `answers.data`. + * The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. + */ + resolved_ip?: string[]; + /** + * The DNS response code. + */ + response_code?: string; + /** + * The type of DNS event captured, query or answer. + * If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. + * If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. + */ + type?: string; +} diff --git a/packages/kbn-ecs/generated/ecs.ts b/packages/kbn-ecs/generated/ecs.ts new file mode 100644 index 0000000000000..995c86f910e04 --- /dev/null +++ b/packages/kbn-ecs/generated/ecs.ts @@ -0,0 +1,18 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Meta-information specific to ECS. + */ +export interface EcsEcs { + /** + * ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. + * When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. + */ + version: '8.6.0'; +} diff --git a/packages/kbn-ecs/generated/ecs_flat.ts b/packages/kbn-ecs/generated/ecs_flat.ts new file mode 100644 index 0000000000000..63ce568d0d6f5 --- /dev/null +++ b/packages/kbn-ecs/generated/ecs_flat.ts @@ -0,0 +1,19303 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export const EcsFlat = { + '@timestamp': { + dashed_name: 'timestamp', + description: + 'Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.', + example: '2016-05-23T08:05:34.853Z', + flat_name: '@timestamp', + level: 'core', + name: '@timestamp', + normalize: [], + required: true, + short: 'Date/time when the event originated.', + type: 'date', + }, + 'agent.build.original': { + dashed_name: 'agent-build-original', + description: + 'Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.', + example: + 'metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]', + flat_name: 'agent.build.original', + ignore_above: 1024, + level: 'core', + name: 'build.original', + normalize: [], + short: 'Extended build information for the agent.', + type: 'keyword', + }, + 'agent.ephemeral_id': { + dashed_name: 'agent-ephemeral-id', + description: + 'Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.', + example: '8a4f500f', + flat_name: 'agent.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + short: 'Ephemeral identifier of this agent.', + type: 'keyword', + }, + 'agent.id': { + dashed_name: 'agent-id', + description: + 'Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.', + example: '8a4f500d', + flat_name: 'agent.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of this agent.', + type: 'keyword', + }, + 'agent.name': { + dashed_name: 'agent-name', + description: + 'Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.', + example: 'foo', + flat_name: 'agent.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Custom name of the agent.', + type: 'keyword', + }, + 'agent.type': { + dashed_name: 'agent-type', + description: + 'Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.', + example: 'filebeat', + flat_name: 'agent.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'Type of the agent.', + type: 'keyword', + }, + 'agent.version': { + dashed_name: 'agent-version', + description: 'Version of the agent.', + example: '6.0.0-rc2', + flat_name: 'agent.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Version of the agent.', + type: 'keyword', + }, + 'client.address': { + dashed_name: 'client-address', + description: + 'Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'client.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Client network address.', + type: 'keyword', + }, + 'client.as.number': { + dashed_name: 'client-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'client.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'client.as.organization.name': { + dashed_name: 'client-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'client.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'client.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'client.bytes': { + dashed_name: 'client-bytes', + description: 'Bytes sent from the client to the server.', + example: 184, + flat_name: 'client.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the client to the server.', + type: 'long', + }, + 'client.domain': { + dashed_name: 'client-domain', + description: + 'The domain name of the client system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'client.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the client.', + type: 'keyword', + }, + 'client.geo.city_name': { + dashed_name: 'client-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'client.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'client.geo.continent_code': { + dashed_name: 'client-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'client.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'client.geo.continent_name': { + dashed_name: 'client-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'client.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'client.geo.country_iso_code': { + dashed_name: 'client-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'client.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'client.geo.country_name': { + dashed_name: 'client-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'client.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'client.geo.location': { + dashed_name: 'client-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'client.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'client.geo.name': { + dashed_name: 'client-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'client.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'client.geo.postal_code': { + dashed_name: 'client-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'client.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'client.geo.region_iso_code': { + dashed_name: 'client-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'client.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'client.geo.region_name': { + dashed_name: 'client-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'client.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'client.geo.timezone': { + dashed_name: 'client-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'client.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'client.ip': { + dashed_name: 'client-ip', + description: 'IP address of the client (IPv4 or IPv6).', + flat_name: 'client.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the client.', + type: 'ip', + }, + 'client.mac': { + dashed_name: 'client-mac', + description: + 'MAC address of the client.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'client.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the client.', + type: 'keyword', + }, + 'client.nat.ip': { + dashed_name: 'client-nat-ip', + description: + 'Translated IP of source based NAT sessions (e.g. internal client to internet).\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'client.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Client NAT ip address', + type: 'ip', + }, + 'client.nat.port': { + dashed_name: 'client-nat-port', + description: + 'Translated port of source based NAT sessions (e.g. internal client to internet).\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'client.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Client NAT port', + type: 'long', + }, + 'client.packets': { + dashed_name: 'client-packets', + description: 'Packets sent from the client to the server.', + example: 12, + flat_name: 'client.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the client to the server.', + type: 'long', + }, + 'client.port': { + dashed_name: 'client-port', + description: 'Port of the client.', + flat_name: 'client.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the client.', + type: 'long', + }, + 'client.registered_domain': { + dashed_name: 'client-registered-domain', + description: + 'The highest registered client domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'client.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered client domain, stripped of the subdomain.', + type: 'keyword', + }, + 'client.subdomain': { + dashed_name: 'client-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'client.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'client.top_level_domain': { + dashed_name: 'client-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'client.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'client.user.domain': { + dashed_name: 'client-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'client.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'client.user.email': { + dashed_name: 'client-user-email', + description: 'User email address.', + flat_name: 'client.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'client.user.full_name': { + dashed_name: 'client-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'client.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'client.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'client.user.group.domain': { + dashed_name: 'client-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'client.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'client.user.group.id': { + dashed_name: 'client-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'client.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'client.user.group.name': { + dashed_name: 'client-user-group-name', + description: 'Name of the group.', + flat_name: 'client.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'client.user.hash': { + dashed_name: 'client-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'client.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'client.user.id': { + dashed_name: 'client-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'client.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'client.user.name': { + dashed_name: 'client-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'client.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'client.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'client.user.roles': { + dashed_name: 'client-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'client.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'cloud.account.id': { + dashed_name: 'cloud-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.account.name': { + dashed_name: 'cloud-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.availability_zone': { + dashed_name: 'cloud-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.instance.id': { + dashed_name: 'cloud-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.instance.name': { + dashed_name: 'cloud-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.machine.type': { + dashed_name: 'cloud-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.origin.account.id': { + dashed_name: 'cloud-origin-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.origin.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.origin.account.name': { + dashed_name: 'cloud-origin-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.origin.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.origin.availability_zone': { + dashed_name: 'cloud-origin-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.origin.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + original_fieldset: 'cloud', + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.origin.instance.id': { + dashed_name: 'cloud-origin-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.origin.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.origin.instance.name': { + dashed_name: 'cloud-origin-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.origin.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.origin.machine.type': { + dashed_name: 'cloud-origin-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.origin.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + original_fieldset: 'cloud', + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.origin.project.id': { + dashed_name: 'cloud-origin-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.origin.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.origin.project.name': { + dashed_name: 'cloud-origin-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.origin.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.origin.provider': { + dashed_name: 'cloud-origin-provider', + description: 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.origin.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + original_fieldset: 'cloud', + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.origin.region': { + dashed_name: 'cloud-origin-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.origin.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + original_fieldset: 'cloud', + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.origin.service.name': { + dashed_name: 'cloud-origin-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.origin.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud service name.', + type: 'keyword', + }, + 'cloud.project.id': { + dashed_name: 'cloud-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.project.name': { + dashed_name: 'cloud-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.provider': { + dashed_name: 'cloud-provider', + description: 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.region': { + dashed_name: 'cloud-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.service.name': { + dashed_name: 'cloud-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + short: 'The cloud service name.', + type: 'keyword', + }, + 'cloud.target.account.id': { + dashed_name: 'cloud-target-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.target.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.target.account.name': { + dashed_name: 'cloud-target-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.target.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.target.availability_zone': { + dashed_name: 'cloud-target-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.target.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + original_fieldset: 'cloud', + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.target.instance.id': { + dashed_name: 'cloud-target-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.target.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.target.instance.name': { + dashed_name: 'cloud-target-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.target.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.target.machine.type': { + dashed_name: 'cloud-target-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.target.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + original_fieldset: 'cloud', + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.target.project.id': { + dashed_name: 'cloud-target-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.target.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.target.project.name': { + dashed_name: 'cloud-target-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.target.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.target.provider': { + dashed_name: 'cloud-target-provider', + description: 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.target.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + original_fieldset: 'cloud', + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.target.region': { + dashed_name: 'cloud-target-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.target.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + original_fieldset: 'cloud', + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.target.service.name': { + dashed_name: 'cloud-target-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.target.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud service name.', + type: 'keyword', + }, + 'container.cpu.usage': { + dashed_name: 'container-cpu-usage', + description: + 'Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000.', + flat_name: 'container.cpu.usage', + level: 'extended', + name: 'cpu.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent CPU used, between 0 and 1.', + type: 'scaled_float', + }, + 'container.disk.read.bytes': { + dashed_name: 'container-disk-read-bytes', + description: + 'The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'container.disk.read.bytes', + level: 'extended', + name: 'disk.read.bytes', + normalize: [], + short: 'The number of bytes read by all disks.', + type: 'long', + }, + 'container.disk.write.bytes': { + dashed_name: 'container-disk-write-bytes', + description: + 'The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'container.disk.write.bytes', + level: 'extended', + name: 'disk.write.bytes', + normalize: [], + short: 'The number of bytes written on all disks.', + type: 'long', + }, + 'container.id': { + dashed_name: 'container-id', + description: 'Unique container id.', + flat_name: 'container.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique container id.', + type: 'keyword', + }, + 'container.image.hash.all': { + dashed_name: 'container-image-hash-all', + description: + 'An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.', + example: '[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]', + flat_name: 'container.image.hash.all', + ignore_above: 1024, + level: 'extended', + name: 'image.hash.all', + normalize: ['array'], + short: 'An array of digests of the image the container was built on.', + type: 'keyword', + }, + 'container.image.name': { + dashed_name: 'container-image-name', + description: 'Name of the image the container was built on.', + flat_name: 'container.image.name', + ignore_above: 1024, + level: 'extended', + name: 'image.name', + normalize: [], + short: 'Name of the image the container was built on.', + type: 'keyword', + }, + 'container.image.tag': { + dashed_name: 'container-image-tag', + description: 'Container image tags.', + flat_name: 'container.image.tag', + ignore_above: 1024, + level: 'extended', + name: 'image.tag', + normalize: ['array'], + short: 'Container image tags.', + type: 'keyword', + }, + 'container.labels': { + dashed_name: 'container-labels', + description: 'Image labels.', + flat_name: 'container.labels', + level: 'extended', + name: 'labels', + normalize: [], + object_type: 'keyword', + short: 'Image labels.', + type: 'object', + }, + 'container.memory.usage': { + dashed_name: 'container-memory-usage', + description: 'Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000.', + flat_name: 'container.memory.usage', + level: 'extended', + name: 'memory.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent memory used, between 0 and 1.', + type: 'scaled_float', + }, + 'container.name': { + dashed_name: 'container-name', + description: 'Container name.', + flat_name: 'container.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Container name.', + type: 'keyword', + }, + 'container.network.egress.bytes': { + dashed_name: 'container-network-egress-bytes', + description: + 'The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection.', + flat_name: 'container.network.egress.bytes', + level: 'extended', + name: 'network.egress.bytes', + normalize: [], + short: 'The number of bytes sent on all network interfaces.', + type: 'long', + }, + 'container.network.ingress.bytes': { + dashed_name: 'container-network-ingress-bytes', + description: + 'The number of bytes received (gauge) on all network interfaces by the container since the last metric collection.', + flat_name: 'container.network.ingress.bytes', + level: 'extended', + name: 'network.ingress.bytes', + normalize: [], + short: 'The number of bytes received on all network interfaces.', + type: 'long', + }, + 'container.runtime': { + dashed_name: 'container-runtime', + description: 'Runtime managing this container.', + example: 'docker', + flat_name: 'container.runtime', + ignore_above: 1024, + level: 'extended', + name: 'runtime', + normalize: [], + short: 'Runtime managing this container.', + type: 'keyword', + }, + 'data_stream.dataset': { + dashed_name: 'data-stream-dataset', + description: + 'The field can contain anything that makes sense to signify the source of the data.\nExamples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`.\nBeyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters', + example: 'nginx.access', + flat_name: 'data_stream.dataset', + level: 'extended', + name: 'dataset', + normalize: [], + short: 'The field can contain anything that makes sense to signify the source of the data.', + type: 'constant_keyword', + }, + 'data_stream.namespace': { + dashed_name: 'data-stream-namespace', + description: + 'A user defined namespace. Namespaces are useful to allow grouping of data.\nMany users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`.\nBeyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters', + example: 'production', + flat_name: 'data_stream.namespace', + level: 'extended', + name: 'namespace', + normalize: [], + short: 'A user defined namespace. Namespaces are useful to allow grouping of data.', + type: 'constant_keyword', + }, + 'data_stream.type': { + dashed_name: 'data-stream-type', + description: + 'An overarching type for the data stream.\nCurrently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future.', + example: 'logs', + flat_name: 'data_stream.type', + level: 'extended', + name: 'type', + normalize: [], + short: 'An overarching type for the data stream.', + type: 'constant_keyword', + }, + 'destination.address': { + dashed_name: 'destination-address', + description: + 'Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'destination.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Destination network address.', + type: 'keyword', + }, + 'destination.as.number': { + dashed_name: 'destination-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'destination.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'destination.as.organization.name': { + dashed_name: 'destination-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'destination.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'destination.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'destination.bytes': { + dashed_name: 'destination-bytes', + description: 'Bytes sent from the destination to the source.', + example: 184, + flat_name: 'destination.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the destination to the source.', + type: 'long', + }, + 'destination.domain': { + dashed_name: 'destination-domain', + description: + 'The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'destination.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the destination.', + type: 'keyword', + }, + 'destination.geo.city_name': { + dashed_name: 'destination-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'destination.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'destination.geo.continent_code': { + dashed_name: 'destination-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'destination.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'destination.geo.continent_name': { + dashed_name: 'destination-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'destination.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'destination.geo.country_iso_code': { + dashed_name: 'destination-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'destination.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'destination.geo.country_name': { + dashed_name: 'destination-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'destination.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'destination.geo.location': { + dashed_name: 'destination-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'destination.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'destination.geo.name': { + dashed_name: 'destination-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'destination.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'destination.geo.postal_code': { + dashed_name: 'destination-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'destination.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'destination.geo.region_iso_code': { + dashed_name: 'destination-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'destination.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'destination.geo.region_name': { + dashed_name: 'destination-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'destination.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'destination.geo.timezone': { + dashed_name: 'destination-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'destination.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'destination.ip': { + dashed_name: 'destination-ip', + description: 'IP address of the destination (IPv4 or IPv6).', + flat_name: 'destination.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the destination.', + type: 'ip', + }, + 'destination.mac': { + dashed_name: 'destination-mac', + description: + 'MAC address of the destination.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'destination.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the destination.', + type: 'keyword', + }, + 'destination.nat.ip': { + dashed_name: 'destination-nat-ip', + description: + 'Translated ip of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'destination.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Destination NAT ip', + type: 'ip', + }, + 'destination.nat.port': { + dashed_name: 'destination-nat-port', + description: + 'Port the source session is translated to by NAT Device.\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'destination.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Destination NAT Port', + type: 'long', + }, + 'destination.packets': { + dashed_name: 'destination-packets', + description: 'Packets sent from the destination to the source.', + example: 12, + flat_name: 'destination.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the destination to the source.', + type: 'long', + }, + 'destination.port': { + dashed_name: 'destination-port', + description: 'Port of the destination.', + flat_name: 'destination.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the destination.', + type: 'long', + }, + 'destination.registered_domain': { + dashed_name: 'destination-registered-domain', + description: + 'The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'destination.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered destination domain, stripped of the subdomain.', + type: 'keyword', + }, + 'destination.subdomain': { + dashed_name: 'destination-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'destination.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'destination.top_level_domain': { + dashed_name: 'destination-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'destination.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'destination.user.domain': { + dashed_name: 'destination-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'destination.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'destination.user.email': { + dashed_name: 'destination-user-email', + description: 'User email address.', + flat_name: 'destination.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'destination.user.full_name': { + dashed_name: 'destination-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'destination.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'destination.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'destination.user.group.domain': { + dashed_name: 'destination-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'destination.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'destination.user.group.id': { + dashed_name: 'destination-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'destination.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'destination.user.group.name': { + dashed_name: 'destination-user-group-name', + description: 'Name of the group.', + flat_name: 'destination.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'destination.user.hash': { + dashed_name: 'destination-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'destination.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'destination.user.id': { + dashed_name: 'destination-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'destination.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'destination.user.name': { + dashed_name: 'destination-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'destination.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'destination.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'destination.user.roles': { + dashed_name: 'destination-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'destination.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'device.id': { + dashed_name: 'device-id', + description: + 'The unique identifier of a device. The identifier must not change across application sessions but stay fixex for an instance of a (mobile) device. \nOn iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application.\nFor GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user.', + example: '00000000-54b3-e7c7-0000-000046bffd97', + flat_name: 'device.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'The unique identifier of a device.', + type: 'keyword', + }, + 'device.manufacturer': { + dashed_name: 'device-manufacturer', + description: 'The vendor name of the device manufacturer.', + example: 'Samsung', + flat_name: 'device.manufacturer', + ignore_above: 1024, + level: 'extended', + name: 'manufacturer', + normalize: [], + short: 'The vendor name of the device manufacturer.', + type: 'keyword', + }, + 'device.model.identifier': { + dashed_name: 'device-model-identifier', + description: 'The machine readable identifier of the device model.', + example: 'SM-G920F', + flat_name: 'device.model.identifier', + ignore_above: 1024, + level: 'extended', + name: 'model.identifier', + normalize: [], + short: 'The machine readable identifier of the device model.', + type: 'keyword', + }, + 'device.model.name': { + dashed_name: 'device-model-name', + description: 'The human readable marketing name of the device model.', + example: 'Samsung Galaxy S6', + flat_name: 'device.model.name', + ignore_above: 1024, + level: 'extended', + name: 'model.name', + normalize: [], + short: 'The human readable marketing name of the device model.', + type: 'keyword', + }, + 'dll.code_signature.digest_algorithm': { + dashed_name: 'dll-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'dll.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.exists': { + dashed_name: 'dll-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'dll.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'dll.code_signature.signing_id': { + dashed_name: 'dll-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'dll.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.status': { + dashed_name: 'dll-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'dll.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'dll.code_signature.subject_name': { + dashed_name: 'dll-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'dll.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'dll.code_signature.team_id': { + dashed_name: 'dll-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'dll.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.timestamp': { + dashed_name: 'dll-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'dll.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'dll.code_signature.trusted': { + dashed_name: 'dll-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'dll.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'dll.code_signature.valid': { + dashed_name: 'dll-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'dll.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'dll.hash.md5': { + dashed_name: 'dll-hash-md5', + description: 'MD5 hash.', + flat_name: 'dll.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'dll.hash.sha1': { + dashed_name: 'dll-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'dll.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'dll.hash.sha256': { + dashed_name: 'dll-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'dll.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'dll.hash.sha384': { + dashed_name: 'dll-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'dll.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'dll.hash.sha512': { + dashed_name: 'dll-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'dll.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'dll.hash.ssdeep': { + dashed_name: 'dll-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'dll.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'dll.hash.tlsh': { + dashed_name: 'dll-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'dll.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'dll.name': { + dashed_name: 'dll-name', + description: 'Name of the library.\nThis generally maps to the name of the file on disk.', + example: 'kernel32.dll', + flat_name: 'dll.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the library.', + type: 'keyword', + }, + 'dll.path': { + dashed_name: 'dll-path', + description: 'Full file path of the library.', + example: 'C:\\Windows\\System32\\kernel32.dll', + flat_name: 'dll.path', + ignore_above: 1024, + level: 'extended', + name: 'path', + normalize: [], + short: 'Full file path of the library.', + type: 'keyword', + }, + 'dll.pe.architecture': { + dashed_name: 'dll-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'dll.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'dll.pe.company': { + dashed_name: 'dll-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'dll.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.description': { + dashed_name: 'dll-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'dll.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.file_version': { + dashed_name: 'dll-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'dll.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'dll.pe.imphash': { + dashed_name: 'dll-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'dll.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'dll.pe.original_file_name': { + dashed_name: 'dll-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'dll.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.pehash': { + dashed_name: 'dll-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'dll.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'dll.pe.product': { + dashed_name: 'dll-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'dll.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dns.answers': { + dashed_name: 'dns-answers', + description: + 'An array containing an object for each answer section returned by the server.\nThe main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.\nNot all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields.', + flat_name: 'dns.answers', + level: 'extended', + name: 'answers', + normalize: ['array'], + short: 'Array of DNS answers.', + type: 'object', + }, + 'dns.answers.class': { + dashed_name: 'dns-answers-class', + description: 'The class of DNS data contained in this resource record.', + example: 'IN', + flat_name: 'dns.answers.class', + ignore_above: 1024, + level: 'extended', + name: 'answers.class', + normalize: [], + short: 'The class of DNS data contained in this resource record.', + type: 'keyword', + }, + 'dns.answers.data': { + dashed_name: 'dns-answers-data', + description: + 'The data describing the resource.\nThe meaning of this data depends on the type and class of the resource record.', + example: '10.10.10.10', + flat_name: 'dns.answers.data', + ignore_above: 1024, + level: 'extended', + name: 'answers.data', + normalize: [], + short: 'The data describing the resource.', + type: 'keyword', + }, + 'dns.answers.name': { + dashed_name: 'dns-answers-name', + description: + "The domain name to which this resource record pertains.\nIf a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated.", + example: 'www.example.com', + flat_name: 'dns.answers.name', + ignore_above: 1024, + level: 'extended', + name: 'answers.name', + normalize: [], + short: 'The domain name to which this resource record pertains.', + type: 'keyword', + }, + 'dns.answers.ttl': { + dashed_name: 'dns-answers-ttl', + description: + 'The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.', + example: 180, + flat_name: 'dns.answers.ttl', + level: 'extended', + name: 'answers.ttl', + normalize: [], + short: + 'The time interval in seconds that this resource record may be cached before it should be discarded.', + type: 'long', + }, + 'dns.answers.type': { + dashed_name: 'dns-answers-type', + description: 'The type of data contained in this resource record.', + example: 'CNAME', + flat_name: 'dns.answers.type', + ignore_above: 1024, + level: 'extended', + name: 'answers.type', + normalize: [], + short: 'The type of data contained in this resource record.', + type: 'keyword', + }, + 'dns.header_flags': { + dashed_name: 'dns-header-flags', + description: 'Array of 2 letter DNS header flags.', + example: '["RD", "RA"]', + expected_values: ['AA', 'TC', 'RD', 'RA', 'AD', 'CD', 'DO'], + flat_name: 'dns.header_flags', + ignore_above: 1024, + level: 'extended', + name: 'header_flags', + normalize: ['array'], + short: 'Array of DNS header flags.', + type: 'keyword', + }, + 'dns.id': { + dashed_name: 'dns-id', + description: + 'The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.', + example: 62111, + flat_name: 'dns.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: + 'The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.', + type: 'keyword', + }, + 'dns.op_code': { + dashed_name: 'dns-op-code', + description: + 'The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.', + example: 'QUERY', + flat_name: 'dns.op_code', + ignore_above: 1024, + level: 'extended', + name: 'op_code', + normalize: [], + short: 'The DNS operation code that specifies the kind of query in the message.', + type: 'keyword', + }, + 'dns.question.class': { + dashed_name: 'dns-question-class', + description: 'The class of records being queried.', + example: 'IN', + flat_name: 'dns.question.class', + ignore_above: 1024, + level: 'extended', + name: 'question.class', + normalize: [], + short: 'The class of records being queried.', + type: 'keyword', + }, + 'dns.question.name': { + dashed_name: 'dns-question-name', + description: + 'The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.', + example: 'www.example.com', + flat_name: 'dns.question.name', + ignore_above: 1024, + level: 'extended', + name: 'question.name', + normalize: [], + short: 'The name being queried.', + type: 'keyword', + }, + 'dns.question.registered_domain': { + dashed_name: 'dns-question-registered-domain', + description: + 'The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'dns.question.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'question.registered_domain', + normalize: [], + short: 'The highest registered domain, stripped of the subdomain.', + type: 'keyword', + }, + 'dns.question.subdomain': { + dashed_name: 'dns-question-subdomain', + description: + 'The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'www', + flat_name: 'dns.question.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'question.subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'dns.question.top_level_domain': { + dashed_name: 'dns-question-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'dns.question.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'question.top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'dns.question.type': { + dashed_name: 'dns-question-type', + description: 'The type of record being queried.', + example: 'AAAA', + flat_name: 'dns.question.type', + ignore_above: 1024, + level: 'extended', + name: 'question.type', + normalize: [], + short: 'The type of record being queried.', + type: 'keyword', + }, + 'dns.resolved_ip': { + dashed_name: 'dns-resolved-ip', + description: + 'Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.', + example: '["10.10.10.10", "10.10.10.11"]', + flat_name: 'dns.resolved_ip', + level: 'extended', + name: 'resolved_ip', + normalize: ['array'], + short: 'Array containing all IPs seen in answers.data', + type: 'ip', + }, + 'dns.response_code': { + dashed_name: 'dns-response-code', + description: 'The DNS response code.', + example: 'NOERROR', + flat_name: 'dns.response_code', + ignore_above: 1024, + level: 'extended', + name: 'response_code', + normalize: [], + short: 'The DNS response code.', + type: 'keyword', + }, + 'dns.type': { + dashed_name: 'dns-type', + description: + 'The type of DNS event captured, query or answer.\nIf your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`.\nIf your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers.', + example: 'answer', + flat_name: 'dns.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'The type of DNS event captured, query or answer.', + type: 'keyword', + }, + 'ecs.version': { + dashed_name: 'ecs-version', + description: + 'ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.', + example: '1.0.0', + flat_name: 'ecs.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + required: true, + short: 'ECS version this event conforms to.', + type: 'keyword', + }, + 'email.attachments': { + dashed_name: 'email-attachments', + description: + 'A list of objects describing the attachment files sent along with an email message.', + flat_name: 'email.attachments', + level: 'extended', + name: 'attachments', + normalize: ['array'], + short: 'List of objects describing the attachments.', + type: 'nested', + }, + 'email.attachments.file.extension': { + dashed_name: 'email-attachments-file-extension', + description: 'Attachment file extension, excluding the leading dot.', + example: 'txt', + flat_name: 'email.attachments.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.extension', + normalize: [], + short: 'Attachment file extension.', + type: 'keyword', + }, + 'email.attachments.file.hash.md5': { + dashed_name: 'email-attachments-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'email.attachments.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha1': { + dashed_name: 'email-attachments-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'email.attachments.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha256': { + dashed_name: 'email-attachments-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'email.attachments.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha384': { + dashed_name: 'email-attachments-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'email.attachments.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha512': { + dashed_name: 'email-attachments-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'email.attachments.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.ssdeep': { + dashed_name: 'email-attachments-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'email.attachments.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.tlsh': { + dashed_name: 'email-attachments-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'email.attachments.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'email.attachments.file.mime_type': { + dashed_name: 'email-attachments-file-mime-type', + description: + 'The MIME media type of the attachment.\nThis value will typically be extracted from the `Content-Type` MIME header field.', + example: 'text/plain', + flat_name: 'email.attachments.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.mime_type', + normalize: [], + short: 'MIME type of the attachment file.', + type: 'keyword', + }, + 'email.attachments.file.name': { + dashed_name: 'email-attachments-file-name', + description: 'Name of the attachment file including the file extension.', + example: 'attachment.txt', + flat_name: 'email.attachments.file.name', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.name', + normalize: [], + short: 'Name of the attachment file.', + type: 'keyword', + }, + 'email.attachments.file.size': { + dashed_name: 'email-attachments-file-size', + description: 'Attachment file size in bytes.', + example: 64329, + flat_name: 'email.attachments.file.size', + level: 'extended', + name: 'attachments.file.size', + normalize: [], + short: 'Attachment file size.', + type: 'long', + }, + 'email.bcc.address': { + dashed_name: 'email-bcc-address', + description: 'The email address of BCC recipient', + example: 'bcc.user1@example.com', + flat_name: 'email.bcc.address', + ignore_above: 1024, + level: 'extended', + name: 'bcc.address', + normalize: ['array'], + short: 'Email address of BCC recipient', + type: 'keyword', + }, + 'email.cc.address': { + dashed_name: 'email-cc-address', + description: 'The email address of CC recipient', + example: 'cc.user1@example.com', + flat_name: 'email.cc.address', + ignore_above: 1024, + level: 'extended', + name: 'cc.address', + normalize: ['array'], + short: 'Email address of CC recipient', + type: 'keyword', + }, + 'email.content_type': { + dashed_name: 'email-content-type', + description: 'Information about how the message is to be displayed.\nTypically a MIME type.', + example: 'text/plain', + flat_name: 'email.content_type', + ignore_above: 1024, + level: 'extended', + name: 'content_type', + normalize: [], + short: 'MIME type of the email message.', + type: 'keyword', + }, + 'email.delivery_timestamp': { + dashed_name: 'email-delivery-timestamp', + description: 'The date and time when the email message was received by the service or client.', + example: '2020-11-10T22:12:34.8196921Z', + flat_name: 'email.delivery_timestamp', + level: 'extended', + name: 'delivery_timestamp', + normalize: [], + short: 'Date and time when message was delivered.', + type: 'date', + }, + 'email.direction': { + dashed_name: 'email-direction', + description: 'The direction of the message based on the sending and receiving domains.', + example: 'inbound', + flat_name: 'email.direction', + ignore_above: 1024, + level: 'extended', + name: 'direction', + normalize: [], + short: 'Direction of the message.', + type: 'keyword', + }, + 'email.from.address': { + dashed_name: 'email-from-address', + description: + 'The email address of the sender, typically from the RFC 5322 `From:` header field.', + example: 'sender@example.com', + flat_name: 'email.from.address', + ignore_above: 1024, + level: 'extended', + name: 'from.address', + normalize: ['array'], + short: "The sender's email address.", + type: 'keyword', + }, + 'email.local_id': { + dashed_name: 'email-local-id', + description: + 'Unique identifier given to the email by the source that created the event.\nIdentifier is not persistent across hops.', + example: 'c26dbea0-80d5-463b-b93c-4e8b708219ce', + flat_name: 'email.local_id', + ignore_above: 1024, + level: 'extended', + name: 'local_id', + normalize: [], + short: 'Unique identifier given by the source.', + type: 'keyword', + }, + 'email.message_id': { + dashed_name: 'email-message-id', + description: + 'Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message.', + example: '81ce15$8r2j59@mail01.example.com', + flat_name: 'email.message_id', + level: 'extended', + name: 'message_id', + normalize: [], + short: 'Value from the Message-ID header.', + type: 'wildcard', + }, + 'email.origination_timestamp': { + dashed_name: 'email-origination-timestamp', + description: + 'The date and time the email message was composed. Many email clients will fill in this value automatically when the message is sent by a user.', + example: '2020-11-10T22:12:34.8196921Z', + flat_name: 'email.origination_timestamp', + level: 'extended', + name: 'origination_timestamp', + normalize: [], + short: 'Date and time the email was composed.', + type: 'date', + }, + 'email.reply_to.address': { + dashed_name: 'email-reply-to-address', + description: + 'The address that replies should be delivered to based on the value in the RFC 5322 `Reply-To:` header.', + example: 'reply.here@example.com', + flat_name: 'email.reply_to.address', + ignore_above: 1024, + level: 'extended', + name: 'reply_to.address', + normalize: ['array'], + short: 'Address replies should be delivered to.', + type: 'keyword', + }, + 'email.sender.address': { + dashed_name: 'email-sender-address', + description: + 'Per RFC 5322, specifies the address responsible for the actual transmission of the message.', + flat_name: 'email.sender.address', + ignore_above: 1024, + level: 'extended', + name: 'sender.address', + normalize: [], + short: 'Address of the message sender.', + type: 'keyword', + }, + 'email.subject': { + dashed_name: 'email-subject', + description: 'A brief summary of the topic of the message.', + example: 'Please see this important message.', + flat_name: 'email.subject', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'email.subject.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'subject', + normalize: [], + short: 'The subject of the email message.', + type: 'keyword', + }, + 'email.to.address': { + dashed_name: 'email-to-address', + description: 'The email address of recipient', + example: 'user1@example.com', + flat_name: 'email.to.address', + ignore_above: 1024, + level: 'extended', + name: 'to.address', + normalize: ['array'], + short: 'Email address of recipient', + type: 'keyword', + }, + 'email.x_mailer': { + dashed_name: 'email-x-mailer', + description: + 'The name of the application that was used to draft and send the original email message.', + example: 'Spambot v2.5', + flat_name: 'email.x_mailer', + ignore_above: 1024, + level: 'extended', + name: 'x_mailer', + normalize: [], + short: 'Application that drafted email.', + type: 'keyword', + }, + 'error.code': { + dashed_name: 'error-code', + description: 'Error code describing the error.', + flat_name: 'error.code', + ignore_above: 1024, + level: 'core', + name: 'code', + normalize: [], + short: 'Error code describing the error.', + type: 'keyword', + }, + 'error.id': { + dashed_name: 'error-id', + description: 'Unique identifier for the error.', + flat_name: 'error.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier for the error.', + type: 'keyword', + }, + 'error.message': { + dashed_name: 'error-message', + description: 'Error message.', + flat_name: 'error.message', + level: 'core', + name: 'message', + normalize: [], + short: 'Error message.', + type: 'match_only_text', + }, + 'error.stack_trace': { + dashed_name: 'error-stack-trace', + description: 'The stack trace of this error in plain text.', + flat_name: 'error.stack_trace', + level: 'extended', + multi_fields: [ + { + flat_name: 'error.stack_trace.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'stack_trace', + normalize: [], + short: 'The stack trace of this error in plain text.', + type: 'wildcard', + }, + 'error.type': { + dashed_name: 'error-type', + description: 'The type of the error, for example the class name of the exception.', + example: 'java.lang.NullPointerException', + flat_name: 'error.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'The type of the error, for example the class name of the exception.', + type: 'keyword', + }, + 'event.action': { + dashed_name: 'event-action', + description: + 'The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.', + example: 'user-password-change', + flat_name: 'event.action', + ignore_above: 1024, + level: 'core', + name: 'action', + normalize: [], + short: 'The action captured by the event.', + type: 'keyword', + }, + 'event.agent_id_status': { + dashed_name: 'event-agent-id-status', + description: + "Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation.\nFor example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used.\nIf no validation is performed then the field should be omitted.\nThe allowed values are:\n`verified` - The `agent.id` field value matches expected value obtained from auth metadata.\n`mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata.\n`missing` - There was no `agent.id` field in the event to validate.\n`auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID.", + example: 'verified', + flat_name: 'event.agent_id_status', + ignore_above: 1024, + level: 'extended', + name: 'agent_id_status', + normalize: [], + short: "Validation status of the event's agent.id field.", + type: 'keyword', + }, + 'event.category': { + allowed_values: [ + { + description: + 'Events in this category are related to the challenge and response process in which credentials are supplied and verified to allow the creation of a session. Common sources for these logs are Windows event logs and ssh logs. Visualize and analyze events in this category to look for failed logins, and other authentication-related activity.', + expected_event_types: ['start', 'end', 'info'], + name: 'authentication', + }, + { + description: + 'Events in the configuration category have to deal with creating, modifying, or deleting the settings or parameters of an application, process, or system.\nExample sources include security policy change logs, configuration auditing logging, and system integrity monitoring.', + expected_event_types: ['access', 'change', 'creation', 'deletion', 'info'], + name: 'configuration', + }, + { + description: + 'The database category denotes events and metrics relating to a data storage and retrieval system. Note that use of this category is not limited to relational database systems. Examples include event logs from MS SQL, MySQL, Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database activity such as accesses and changes.', + expected_event_types: ['access', 'change', 'info', 'error'], + name: 'database', + }, + { + description: + 'Events in the driver category have to do with operating system device drivers and similar software entities such as Windows drivers, kernel extensions, kernel modules, etc.\nUse events and metrics in this category to visualize and analyze driver-related activity and status on hosts.', + expected_event_types: ['change', 'end', 'info', 'start'], + name: 'driver', + }, + { + description: + 'This category is used for events relating to email messages, email attachments, and email network or protocol activity.\nEmails events can be produced by email security gateways, mail transfer agents, email cloud service providers, or mail server monitoring applications.', + expected_event_types: ['info'], + name: 'email', + }, + { + description: + 'Relating to a set of information that has been created on, or has existed on a filesystem. Use this category of events to visualize and analyze the creation, access, and deletions of files. Events in this category can come from both host-based and network-based sources. An example source of a network-based detection of a file transfer would be the Zeek file.log.', + expected_event_types: ['change', 'creation', 'deletion', 'info'], + name: 'file', + }, + { + description: + 'Use this category to visualize and analyze information such as host inventory or host lifecycle events.\nMost of the events in this category can usually be observed from the outside, such as from a hypervisor or a control plane\'s point of view. Some can also be seen from within, such as "start" or "end".\nNote that this category is for information about hosts themselves; it is not meant to capture activity "happening on a host".', + expected_event_types: ['access', 'change', 'end', 'info', 'start'], + name: 'host', + }, + { + description: + 'Identity and access management (IAM) events relating to users, groups, and administration. Use this category to visualize and analyze IAM-related logs and data from active directory, LDAP, Okta, Duo, and other IAM systems.', + expected_event_types: ['admin', 'change', 'creation', 'deletion', 'group', 'info', 'user'], + name: 'iam', + }, + { + description: + 'Relating to intrusion detections from IDS/IPS systems and functions, both network and host-based. Use this category to visualize and analyze intrusion detection alerts from systems such as Snort, Suricata, and Palo Alto threat detections.', + expected_event_types: ['allowed', 'denied', 'info'], + name: 'intrusion_detection', + }, + { + description: + 'Malware detection events and alerts. Use this category to visualize and analyze malware detections from EDR/EPP systems such as Elastic Endpoint Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems such as Suricata, or other sources of malware-related events such as Palo Alto Networks threat logs and Wildfire logs.', + expected_event_types: ['info'], + name: 'malware', + }, + { + description: + 'Relating to all network activity, including network connection lifecycle, network traffic, and essentially any event that includes an IP address. Many events containing decoded network protocol transactions fit into this category. Use events in this category to visualize or analyze counts of network ports, protocols, addresses, geolocation information, etc.', + expected_event_types: [ + 'access', + 'allowed', + 'connection', + 'denied', + 'end', + 'info', + 'protocol', + 'start', + ], + name: 'network', + }, + { + description: + 'Relating to software packages installed on hosts. Use this category to visualize and analyze inventory of software installed on various hosts, or to determine host vulnerability in the absence of vulnerability scan data.', + expected_event_types: ['access', 'change', 'deletion', 'info', 'installation', 'start'], + name: 'package', + }, + { + description: + 'Use this category of events to visualize and analyze process-specific information such as lifecycle events or process ancestry.', + expected_event_types: ['access', 'change', 'end', 'info', 'start'], + name: 'process', + }, + { + description: + 'Having to do with settings and assets stored in the Windows registry. Use this category to visualize and analyze activity such as registry access and modifications.', + expected_event_types: ['access', 'change', 'creation', 'deletion'], + name: 'registry', + }, + { + description: + 'The session category is applied to events and metrics regarding logical persistent connections to hosts and services. Use this category to visualize and analyze interactive or automated persistent connections between assets. Data for this category may come from Windows Event logs, SSH logs, or stateless sessions such as HTTP cookie-based sessions, etc.', + expected_event_types: ['start', 'end', 'info'], + name: 'session', + }, + { + description: + "Use this category to visualize and analyze events describing threat actors' targets, motives, or behaviors.", + expected_event_types: ['indicator'], + name: 'threat', + }, + { + description: + 'Relating to vulnerability scan results. Use this category to analyze vulnerabilities detected by Tenable, Qualys, internal scanners, and other vulnerability management sources.', + expected_event_types: ['info'], + name: 'vulnerability', + }, + { + description: + 'Relating to web server access. Use this category to create a dashboard of web server/proxy activity from apache, IIS, nginx web servers, etc. Note: events from network observers such as Zeek http log may also be included in this category.', + expected_event_types: ['access', 'error', 'info'], + name: 'web', + }, + ], + dashed_name: 'event-category', + description: + 'This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.', + example: 'authentication', + flat_name: 'event.category', + ignore_above: 1024, + level: 'core', + name: 'category', + normalize: ['array'], + short: 'Event category. The second categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.code': { + dashed_name: 'event-code', + description: + 'Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.', + example: 4648, + flat_name: 'event.code', + ignore_above: 1024, + level: 'extended', + name: 'code', + normalize: [], + short: 'Identification code for this event.', + type: 'keyword', + }, + 'event.created': { + dashed_name: 'event-created', + description: + "event.created contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, @timestamp should be used.", + example: '2016-05-23T08:05:34.857Z', + flat_name: 'event.created', + level: 'core', + name: 'created', + normalize: [], + short: 'Time when the event was first read by an agent or by your pipeline.', + type: 'date', + }, + 'event.dataset': { + dashed_name: 'event-dataset', + description: + "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.", + example: 'apache.access', + flat_name: 'event.dataset', + ignore_above: 1024, + level: 'core', + name: 'dataset', + normalize: [], + short: 'Name of the dataset.', + type: 'keyword', + }, + 'event.duration': { + dashed_name: 'event-duration', + description: + 'Duration of the event in nanoseconds.\nIf event.start and event.end are known this value should be the difference between the end and start time.', + flat_name: 'event.duration', + format: 'duration', + input_format: 'nanoseconds', + level: 'core', + name: 'duration', + normalize: [], + output_format: 'asMilliseconds', + output_precision: 1, + short: 'Duration of the event in nanoseconds.', + type: 'long', + }, + 'event.end': { + dashed_name: 'event-end', + description: + 'event.end contains the date when the event ended or when the activity was last observed.', + flat_name: 'event.end', + level: 'extended', + name: 'end', + normalize: [], + short: + 'event.end contains the date when the event ended or when the activity was last observed.', + type: 'date', + }, + 'event.hash': { + dashed_name: 'event-hash', + description: + 'Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.', + example: '123456789012345678901234567890ABCD', + flat_name: 'event.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + short: + 'Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.', + type: 'keyword', + }, + 'event.id': { + dashed_name: 'event-id', + description: 'Unique ID to describe the event.', + example: '8a4f500d', + flat_name: 'event.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique ID to describe the event.', + type: 'keyword', + }, + 'event.ingested': { + dashed_name: 'event-ingested', + description: + "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.", + example: '2016-05-23T08:05:35.101Z', + flat_name: 'event.ingested', + level: 'core', + name: 'ingested', + normalize: [], + short: 'Timestamp when an event arrived in the central data store.', + type: 'date', + }, + 'event.kind': { + allowed_values: [ + { + description: + 'This value indicates an event such as an alert or notable event, triggered by a detection rule executing externally to the Elastic Stack.\n`event.kind:alert` is often populated for events coming from firewalls, intrusion detection systems, endpoint detection and response systems, and so on.\nThis value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.', + name: 'alert', + }, + { + description: + 'The `enrichment` value indicates an event collected to provide additional context, often to other events.\nAn example is collecting indicators of compromise (IOCs) from a threat intelligence provider with the intent to use those values to enrich other events. The IOC events from the intelligence provider should be categorized as `event.kind:enrichment`.', + name: 'enrichment', + }, + { + description: + 'This value is the most general and most common value for this field. It is used to represent events that indicate that something happened.', + name: 'event', + }, + { + description: + 'This value is used to indicate that this event describes a numeric measurement taken at given point in time.\nExamples include CPU utilization, memory usage, or device temperature.\nMetric events are often collected on a predictable frequency, such as once every few seconds, or once a minute, but can also be used to describe ad-hoc numeric metric queries.', + name: 'metric', + }, + { + description: + "The state value is similar to metric, indicating that this event describes a measurement taken at given point in time, except that the measurement does not result in a numeric value, but rather one of a fixed set of categorical values that represent conditions or states.\nExamples include periodic events reporting Elasticsearch cluster state (green/yellow/red), the state of a TCP connection (open, closed, fin_wait, etc.), the state of a host with respect to a software vulnerability (vulnerable, not vulnerable), and the state of a system regarding compliance with a regulatory standard (compliant, not compliant).\nNote that an event that describes a change of state would not use `event.kind:state`, but instead would use 'event.kind:event' since a state change fits the more general event definition of something that happened.\nState events are often collected on a predictable frequency, such as once every few seconds, once a minute, once an hour, or once a day, but can also be used to describe ad-hoc state queries.", + name: 'state', + }, + { + description: + 'This value indicates that an error occurred during the ingestion of this event, and that event data may be missing, inconsistent, or incorrect. `event.kind:pipeline_error` is often associated with parsing errors.', + name: 'pipeline_error', + }, + { + description: + 'This value is used by Elastic solutions (e.g., Security, Observability) for alert documents that are created by rules executing within the Kibana alerting framework.\nUsage of this value is reserved, and data ingestion pipelines must not populate `event.kind` with the value "signal".', + name: 'signal', + }, + ], + dashed_name: 'event-kind', + description: + 'This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.', + example: 'alert', + flat_name: 'event.kind', + ignore_above: 1024, + level: 'core', + name: 'kind', + normalize: [], + short: 'The kind of the event. The highest categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.module': { + dashed_name: 'event-module', + description: + 'Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.', + example: 'apache', + flat_name: 'event.module', + ignore_above: 1024, + level: 'core', + name: 'module', + normalize: [], + short: 'Name of the module this data is coming from.', + type: 'keyword', + }, + 'event.original': { + dashed_name: 'event-original', + description: + 'Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex.\nThis field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`.', + doc_values: false, + example: + 'Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232', + flat_name: 'event.original', + index: false, + level: 'core', + name: 'original', + normalize: [], + short: 'Raw text message of entire event.', + type: 'keyword', + }, + 'event.outcome': { + allowed_values: [ + { + description: + 'Indicates that this event describes a failed result. A common example is `event.category:file AND event.type:access AND event.outcome:failure` to indicate that a file access was attempted, but was not successful.', + name: 'failure', + }, + { + description: + 'Indicates that this event describes a successful result. A common example is `event.category:file AND event.type:create AND event.outcome:success` to indicate that a file was successfully created.', + name: 'success', + }, + { + description: + "Indicates that this event describes only an attempt for which the result is unknown from the perspective of the event producer. For example, if the event contains information only about the request side of a transaction that results in a response, populating `event.outcome:unknown` in the request event is appropriate. The unknown value should not be used when an outcome doesn't make logical sense for the event. In such cases `event.outcome` should not be populated.", + name: 'unknown', + }, + ], + dashed_name: 'event-outcome', + description: + 'This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.', + example: 'success', + flat_name: 'event.outcome', + ignore_above: 1024, + level: 'core', + name: 'outcome', + normalize: [], + short: 'The outcome of the event. The lowest level categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.provider': { + dashed_name: 'event-provider', + description: + 'Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).', + example: 'kernel', + flat_name: 'event.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + short: 'Source of the event.', + type: 'keyword', + }, + 'event.reason': { + dashed_name: 'event-reason', + description: + 'Reason why this event happened, according to the source.\nThis describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`).', + example: 'Terminated an unexpected process', + flat_name: 'event.reason', + ignore_above: 1024, + level: 'extended', + name: 'reason', + normalize: [], + short: 'Reason why this event happened, according to the source', + type: 'keyword', + }, + 'event.reference': { + dashed_name: 'event-reference', + description: + 'Reference URL linking to additional information about this event.\nThis URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field.', + example: 'https://system.example.com/event/#0001234', + flat_name: 'event.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Event reference URL', + type: 'keyword', + }, + 'event.risk_score': { + dashed_name: 'event-risk-score', + description: + "Risk score or priority of the event (e.g. security solutions). Use your system's original value here.", + flat_name: 'event.risk_score', + level: 'core', + name: 'risk_score', + normalize: [], + short: + "Risk score or priority of the event (e.g. security solutions). Use your system's original value here.", + type: 'float', + }, + 'event.risk_score_norm': { + dashed_name: 'event-risk-score-norm', + description: + 'Normalized risk score or priority of the event, on a scale of 0 to 100.\nThis is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems.', + flat_name: 'event.risk_score_norm', + level: 'extended', + name: 'risk_score_norm', + normalize: [], + short: 'Normalized risk score or priority of the event (0-100).', + type: 'float', + }, + 'event.sequence': { + dashed_name: 'event-sequence', + description: + 'Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.', + flat_name: 'event.sequence', + format: 'string', + level: 'extended', + name: 'sequence', + normalize: [], + short: 'Sequence number of the event.', + type: 'long', + }, + 'event.severity': { + dashed_name: 'event-severity', + description: + "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.", + example: 7, + flat_name: 'event.severity', + format: 'string', + level: 'core', + name: 'severity', + normalize: [], + short: 'Numeric severity of the event.', + type: 'long', + }, + 'event.start': { + dashed_name: 'event-start', + description: + 'event.start contains the date when the event started or when the activity was first observed.', + flat_name: 'event.start', + level: 'extended', + name: 'start', + normalize: [], + short: + 'event.start contains the date when the event started or when the activity was first observed.', + type: 'date', + }, + 'event.timezone': { + dashed_name: 'event-timezone', + description: + 'This field should be populated when the event\'s timestamp does not include timezone information already (e.g. default Syslog timestamps). It\'s optional otherwise.\nAcceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").', + flat_name: 'event.timezone', + ignore_above: 1024, + level: 'extended', + name: 'timezone', + normalize: [], + short: 'Event time zone.', + type: 'keyword', + }, + 'event.type': { + allowed_values: [ + { + description: + 'The access event type is used for the subset of events within a category that indicate that something was accessed. Common examples include `event.category:database AND event.type:access`, or `event.category:file AND event.type:access`. Note for file access, both directory listings and file opens should be included in this subcategory. You can further distinguish access operations using the ECS `event.action` field.', + name: 'access', + }, + { + description: + 'The admin event type is used for the subset of events within a category that are related to admin objects. For example, administrative changes within an IAM framework that do not specifically affect a user or group (e.g., adding new applications to a federation solution or connecting discrete forests in Active Directory) would fall into this subcategory. Common example: `event.category:iam AND event.type:change AND event.type:admin`. You can further distinguish admin operations using the ECS `event.action` field.', + name: 'admin', + }, + { + description: + 'The allowed event type is used for the subset of events within a category that indicate that something was allowed. Common examples include `event.category:network AND event.type:connection AND event.type:allowed` (to indicate a network firewall event for which the firewall disposition was to allow the connection to complete) and `event.category:intrusion_detection AND event.type:allowed` (to indicate a network intrusion prevention system event for which the IPS disposition was to allow the connection to complete). You can further distinguish allowed operations using the ECS `event.action` field, populating with values of your choosing, such as "allow", "detect", or "pass".', + name: 'allowed', + }, + { + description: + 'The change event type is used for the subset of events within a category that indicate that something has changed. If semantics best describe an event as modified, then include them in this subcategory. Common examples include `event.category:process AND event.type:change`, and `event.category:file AND event.type:change`. You can further distinguish change operations using the ECS `event.action` field.', + name: 'change', + }, + { + description: + 'Used primarily with `event.category:network` this value is used for the subset of network traffic that includes sufficient information for the event to be included in flow or connection analysis. Events in this subcategory will contain at least source and destination IP addresses, source and destination TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred. Events in this subcategory may contain unidirectional or bidirectional information, including summary information. Use this subcategory to visualize and analyze network connections. Flow analysis, including Netflow, IPFIX, and other flow-related events fit in this subcategory. Note that firewall events from many Next-Generation Firewall (NGFW) devices will also fit into this subcategory. A common filter for flow/connection information would be `event.category:network AND event.type:connection AND event.type:end` (to view or analyze all completed network connections, ignoring mid-flow reports). You can further distinguish connection events using the ECS `event.action` field, populating with values of your choosing, such as "timeout", or "reset".', + name: 'connection', + }, + { + description: + 'The "creation" event type is used for the subset of events within a category that indicate that something was created. A common example is `event.category:file AND event.type:creation`.', + name: 'creation', + }, + { + description: + 'The deletion event type is used for the subset of events within a category that indicate that something was deleted. A common example is `event.category:file AND event.type:deletion` to indicate that a file has been deleted.', + name: 'deletion', + }, + { + description: + 'The denied event type is used for the subset of events within a category that indicate that something was denied. Common examples include `event.category:network AND event.type:denied` (to indicate a network firewall event for which the firewall disposition was to deny the connection) and `event.category:intrusion_detection AND event.type:denied` (to indicate a network intrusion prevention system event for which the IPS disposition was to deny the connection to complete). You can further distinguish denied operations using the ECS `event.action` field, populating with values of your choosing, such as "blocked", "dropped", or "quarantined".', + name: 'denied', + }, + { + description: + 'The end event type is used for the subset of events within a category that indicate something has ended. A common example is `event.category:process AND event.type:end`.', + name: 'end', + }, + { + description: + 'The error event type is used for the subset of events within a category that indicate or describe an error. A common example is `event.category:database AND event.type:error`. Note that pipeline errors that occur during the event ingestion process should not use this `event.type` value. Instead, they should use `event.kind:pipeline_error`.', + name: 'error', + }, + { + description: + 'The group event type is used for the subset of events within a category that are related to group objects. Common example: `event.category:iam AND event.type:creation AND event.type:group`. You can further distinguish group operations using the ECS `event.action` field.', + name: 'group', + }, + { + description: + 'The indicator event type is used for the subset of events within a category that contain details about indicators of compromise (IOCs).\nA common example is `event.category:threat AND event.type:indicator`.', + name: 'indicator', + }, + { + description: + 'The info event type is used for the subset of events within a category that indicate that they are purely informational, and don\'t report a state change, or any type of action. For example, an initial run of a file integrity monitoring system (FIM), where an agent reports all files under management, would fall into the "info" subcategory. Similarly, an event containing a dump of all currently running processes (as opposed to reporting that a process started/ended) would fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection AND event.type:info`.', + name: 'info', + }, + { + description: + 'The installation event type is used for the subset of events within a category that indicate that something was installed. A common example is `event.category:package` AND `event.type:installation`.', + name: 'installation', + }, + { + description: + 'The protocol event type is used for the subset of events within a category that indicate that they contain protocol details or analysis, beyond simply identifying the protocol. Generally, network events that contain specific protocol details will fall into this subcategory. A common example is `event.category:network AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate that the event is a network connection event sent at the end of a connection that also includes a protocol detail breakdown). Note that events that only indicate the name or id of the protocol should not use the protocol value. Further note that when the protocol subcategory is used, the identified protocol is populated in the ECS `network.protocol` field.', + name: 'protocol', + }, + { + description: + 'The start event type is used for the subset of events within a category that indicate something has started. A common example is `event.category:process AND event.type:start`.', + name: 'start', + }, + { + description: + 'The user event type is used for the subset of events within a category that are related to user objects. Common example: `event.category:iam AND event.type:deletion AND event.type:user`. You can further distinguish user operations using the ECS `event.action` field.', + name: 'user', + }, + ], + dashed_name: 'event-type', + description: + 'This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.', + flat_name: 'event.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: ['array'], + short: 'Event type. The third categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.url': { + dashed_name: 'event-url', + description: + 'URL linking to an external system to continue investigation of this event.\nThis URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field.', + example: 'https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe', + flat_name: 'event.url', + ignore_above: 1024, + level: 'extended', + name: 'url', + normalize: [], + short: 'Event investigation URL', + type: 'keyword', + }, + 'faas.coldstart': { + dashed_name: 'faas-coldstart', + description: 'Boolean value indicating a cold start of a function.', + flat_name: 'faas.coldstart', + level: 'extended', + name: 'coldstart', + normalize: [], + short: 'Boolean value indicating a cold start of a function.', + type: 'boolean', + }, + 'faas.execution': { + dashed_name: 'faas-execution', + description: 'The execution ID of the current function execution.', + example: 'af9d5aa4-a685-4c5f-a22b-444f80b3cc28', + flat_name: 'faas.execution', + ignore_above: 1024, + level: 'extended', + name: 'execution', + normalize: [], + short: 'The execution ID of the current function execution.', + type: 'keyword', + }, + 'faas.id': { + dashed_name: 'faas-id', + description: + "The unique identifier of a serverless function.\nFor AWS Lambda it's the function ARN (Amazon Resource Name) without a version or alias suffix.", + example: 'arn:aws:lambda:us-west-2:123456789012:function:my-function', + flat_name: 'faas.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'The unique identifier of a serverless function.', + type: 'keyword', + }, + 'faas.name': { + dashed_name: 'faas-name', + description: 'The name of a serverless function.', + example: 'my-function', + flat_name: 'faas.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'The name of a serverless function.', + type: 'keyword', + }, + 'faas.trigger': { + dashed_name: 'faas-trigger', + description: 'Details about the function trigger.', + flat_name: 'faas.trigger', + level: 'extended', + name: 'trigger', + normalize: [], + short: 'Details about the function trigger.', + type: 'nested', + }, + 'faas.trigger.request_id': { + dashed_name: 'faas-trigger-request-id', + description: 'The ID of the trigger request , message, event, etc.', + example: 123456789, + flat_name: 'faas.trigger.request_id', + ignore_above: 1024, + level: 'extended', + name: 'trigger.request_id', + normalize: [], + short: 'The ID of the trigger request , message, event, etc.', + type: 'keyword', + }, + 'faas.trigger.type': { + dashed_name: 'faas-trigger-type', + description: 'The trigger for the function execution.', + example: 'http', + expected_values: ['http', 'pubsub', 'datasource', 'timer', 'other'], + flat_name: 'faas.trigger.type', + ignore_above: 1024, + level: 'extended', + name: 'trigger.type', + normalize: [], + short: 'The trigger for the function execution.', + type: 'keyword', + }, + 'faas.version': { + dashed_name: 'faas-version', + description: 'The version of a serverless function.', + example: '123', + flat_name: 'faas.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'The version of a serverless function.', + type: 'keyword', + }, + 'file.accessed': { + dashed_name: 'file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + short: 'Last time the file was accessed.', + type: 'date', + }, + 'file.attributes': { + dashed_name: 'file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + short: 'Array of file attributes.', + type: 'keyword', + }, + 'file.code_signature.digest_algorithm': { + dashed_name: 'file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.exists': { + dashed_name: 'file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'file.code_signature.signing_id': { + dashed_name: 'file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.status': { + dashed_name: 'file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'file.code_signature.subject_name': { + dashed_name: 'file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'file.code_signature.team_id': { + dashed_name: 'file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.timestamp': { + dashed_name: 'file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'file.code_signature.trusted': { + dashed_name: 'file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'file.code_signature.valid': { + dashed_name: 'file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'file.created': { + dashed_name: 'file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'file.created', + level: 'extended', + name: 'created', + normalize: [], + short: 'File creation time.', + type: 'date', + }, + 'file.ctime': { + dashed_name: 'file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'file.device': { + dashed_name: 'file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'file.directory': { + dashed_name: 'file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'file.drive_letter': { + dashed_name: 'file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'file.elf.architecture': { + dashed_name: 'file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'file.elf.byte_order': { + dashed_name: 'file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'file.elf.cpu_type': { + dashed_name: 'file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'file.elf.creation_date': { + dashed_name: 'file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'file.elf.exports': { + dashed_name: 'file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'file.elf.header.abi_version': { + dashed_name: 'file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'file.elf.header.class': { + dashed_name: 'file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'file.elf.header.data': { + dashed_name: 'file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'file.elf.header.entrypoint': { + dashed_name: 'file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'file.elf.header.object_version': { + dashed_name: 'file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'file.elf.header.os_abi': { + dashed_name: 'file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'file.elf.header.type': { + dashed_name: 'file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'file.elf.header.version': { + dashed_name: 'file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'file.elf.imports': { + dashed_name: 'file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'file.elf.sections': { + dashed_name: 'file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'file.elf.sections.chi2': { + dashed_name: 'file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'file.elf.sections.entropy': { + dashed_name: 'file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'file.elf.sections.flags': { + dashed_name: 'file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'file.elf.sections.name': { + dashed_name: 'file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'file.elf.sections.physical_offset': { + dashed_name: 'file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'file.elf.sections.physical_size': { + dashed_name: 'file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'file.elf.sections.type': { + dashed_name: 'file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'file.elf.sections.virtual_address': { + dashed_name: 'file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'file.elf.sections.virtual_size': { + dashed_name: 'file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'file.elf.segments': { + dashed_name: 'file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'file.elf.segments.sections': { + dashed_name: 'file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'file.elf.segments.type': { + dashed_name: 'file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'file.elf.shared_libraries': { + dashed_name: 'file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'file.elf.telfhash': { + dashed_name: 'file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'file.extension': { + dashed_name: 'file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'file.fork_name': { + dashed_name: 'file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'file.gid': { + dashed_name: 'file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'file.group': { + dashed_name: 'file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'file.hash.md5': { + dashed_name: 'file-hash-md5', + description: 'MD5 hash.', + flat_name: 'file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'file.hash.sha1': { + dashed_name: 'file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'file.hash.sha256': { + dashed_name: 'file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'file.hash.sha384': { + dashed_name: 'file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'file.hash.sha512': { + dashed_name: 'file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'file.hash.ssdeep': { + dashed_name: 'file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'file.hash.tlsh': { + dashed_name: 'file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'file.inode': { + dashed_name: 'file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'file.mime_type': { + dashed_name: 'file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'file.mode': { + dashed_name: 'file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'file.mtime': { + dashed_name: 'file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + short: 'Last time the file content was modified.', + type: 'date', + }, + 'file.name': { + dashed_name: 'file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'file.owner': { + dashed_name: 'file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + short: "File owner's username.", + type: 'keyword', + }, + 'file.path': { + dashed_name: 'file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'file.path.text', name: 'text', type: 'match_only_text' }], + name: 'path', + normalize: [], + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'file.pe.architecture': { + dashed_name: 'file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'file.pe.company': { + dashed_name: 'file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.description': { + dashed_name: 'file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.file_version': { + dashed_name: 'file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'file.pe.imphash': { + dashed_name: 'file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'file.pe.original_file_name': { + dashed_name: 'file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.pehash': { + dashed_name: 'file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'file.pe.product': { + dashed_name: 'file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.size': { + dashed_name: 'file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'file.size', + level: 'extended', + name: 'size', + normalize: [], + short: 'File size in bytes.', + type: 'long', + }, + 'file.target_path': { + dashed_name: 'file-target-path', + description: 'Target path for symlinks.', + flat_name: 'file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'file.type': { + dashed_name: 'file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'file.uid': { + dashed_name: 'file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'file.x509.alternative_names': { + dashed_name: 'file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'file.x509.issuer.common_name': { + dashed_name: 'file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.country': { + dashed_name: 'file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'file.x509.issuer.distinguished_name': { + dashed_name: 'file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.locality': { + dashed_name: 'file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'file.x509.issuer.organization': { + dashed_name: 'file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.organizational_unit': { + dashed_name: 'file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.state_or_province': { + dashed_name: 'file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'file.x509.not_after': { + dashed_name: 'file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'file.x509.not_before': { + dashed_name: 'file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'file.x509.public_key_algorithm': { + dashed_name: 'file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'file.x509.public_key_curve': { + dashed_name: 'file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'file.x509.public_key_exponent': { + dashed_name: 'file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'file.x509.public_key_size': { + dashed_name: 'file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'file.x509.serial_number': { + dashed_name: 'file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'file.x509.signature_algorithm': { + dashed_name: 'file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'file.x509.subject.common_name': { + dashed_name: 'file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'file.x509.subject.country': { + dashed_name: 'file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'file.x509.subject.distinguished_name': { + dashed_name: 'file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'file.x509.subject.locality': { + dashed_name: 'file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'file.x509.subject.organization': { + dashed_name: 'file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'file.x509.subject.organizational_unit': { + dashed_name: 'file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'file.x509.subject.state_or_province': { + dashed_name: 'file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'file.x509.version_number': { + dashed_name: 'file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'group.domain': { + dashed_name: 'group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'group.id': { + dashed_name: 'group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'group.name': { + dashed_name: 'group-name', + description: 'Name of the group.', + flat_name: 'group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the group.', + type: 'keyword', + }, + 'host.architecture': { + dashed_name: 'host-architecture', + description: 'Operating system architecture.', + example: 'x86_64', + flat_name: 'host.architecture', + ignore_above: 1024, + level: 'core', + name: 'architecture', + normalize: [], + short: 'Operating system architecture.', + type: 'keyword', + }, + 'host.boot.id': { + beta: 'This field is beta and subject to change.', + dashed_name: 'host-boot-id', + description: + 'Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.', + example: '88a1f0ed-5ae5-41ee-af6b-41921c311872', + flat_name: 'host.boot.id', + ignore_above: 1024, + level: 'extended', + name: 'boot.id', + normalize: [], + short: 'Linux boot uuid taken from /proc/sys/kernel/random/boot_id', + type: 'keyword', + }, + 'host.cpu.usage': { + dashed_name: 'host-cpu-usage', + description: + 'Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1.\nScaling factor: 1000.\nFor example: For a two core host, this value should be the average of the two cores, between 0 and 1.', + flat_name: 'host.cpu.usage', + level: 'extended', + name: 'cpu.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent CPU used, between 0 and 1.', + type: 'scaled_float', + }, + 'host.disk.read.bytes': { + dashed_name: 'host-disk-read-bytes', + description: + 'The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'host.disk.read.bytes', + level: 'extended', + name: 'disk.read.bytes', + normalize: [], + short: 'The number of bytes read by all disks.', + type: 'long', + }, + 'host.disk.write.bytes': { + dashed_name: 'host-disk-write-bytes', + description: + 'The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'host.disk.write.bytes', + level: 'extended', + name: 'disk.write.bytes', + normalize: [], + short: 'The number of bytes written on all disks.', + type: 'long', + }, + 'host.domain': { + dashed_name: 'host-domain', + description: + "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.", + example: 'CONTOSO', + flat_name: 'host.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'host.geo.city_name': { + dashed_name: 'host-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'host.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'host.geo.continent_code': { + dashed_name: 'host-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'host.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'host.geo.continent_name': { + dashed_name: 'host-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'host.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'host.geo.country_iso_code': { + dashed_name: 'host-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'host.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'host.geo.country_name': { + dashed_name: 'host-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'host.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'host.geo.location': { + dashed_name: 'host-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'host.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'host.geo.name': { + dashed_name: 'host-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'host.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'host.geo.postal_code': { + dashed_name: 'host-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'host.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'host.geo.region_iso_code': { + dashed_name: 'host-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'host.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'host.geo.region_name': { + dashed_name: 'host-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'host.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'host.geo.timezone': { + dashed_name: 'host-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'host.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'host.hostname': { + dashed_name: 'host-hostname', + description: + 'Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.', + flat_name: 'host.hostname', + ignore_above: 1024, + level: 'core', + name: 'hostname', + normalize: [], + short: 'Hostname of the host.', + type: 'keyword', + }, + 'host.id': { + dashed_name: 'host-id', + description: + 'Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.', + flat_name: 'host.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique host id.', + type: 'keyword', + }, + 'host.ip': { + dashed_name: 'host-ip', + description: 'Host ip addresses.', + flat_name: 'host.ip', + level: 'core', + name: 'ip', + normalize: ['array'], + short: 'Host ip addresses.', + type: 'ip', + }, + 'host.mac': { + dashed_name: 'host-mac', + description: + 'Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]', + flat_name: 'host.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: ['array'], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'Host MAC addresses.', + type: 'keyword', + }, + 'host.name': { + dashed_name: 'host-name', + description: + 'Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.', + flat_name: 'host.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the host.', + type: 'keyword', + }, + 'host.network.egress.bytes': { + dashed_name: 'host-network-egress-bytes', + description: + 'The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.egress.bytes', + level: 'extended', + name: 'network.egress.bytes', + normalize: [], + short: 'The number of bytes sent on all network interfaces.', + type: 'long', + }, + 'host.network.egress.packets': { + dashed_name: 'host-network-egress-packets', + description: + 'The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.egress.packets', + level: 'extended', + name: 'network.egress.packets', + normalize: [], + short: 'The number of packets sent on all network interfaces.', + type: 'long', + }, + 'host.network.ingress.bytes': { + dashed_name: 'host-network-ingress-bytes', + description: + 'The number of bytes received (gauge) on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.ingress.bytes', + level: 'extended', + name: 'network.ingress.bytes', + normalize: [], + short: 'The number of bytes received on all network interfaces.', + type: 'long', + }, + 'host.network.ingress.packets': { + dashed_name: 'host-network-ingress-packets', + description: + 'The number of packets (gauge) received on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.ingress.packets', + level: 'extended', + name: 'network.ingress.packets', + normalize: [], + short: 'The number of packets received on all network interfaces.', + type: 'long', + }, + 'host.os.family': { + dashed_name: 'host-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'host.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'host.os.full': { + dashed_name: 'host-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'host.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'host.os.full.text', name: 'text', type: 'match_only_text' }], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'host.os.kernel': { + dashed_name: 'host-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'host.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'host.os.name': { + dashed_name: 'host-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'host.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'host.os.name.text', name: 'text', type: 'match_only_text' }], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'host.os.platform': { + dashed_name: 'host-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'host.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'host.os.type': { + dashed_name: 'host-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'host.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'host.os.version': { + dashed_name: 'host-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'host.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'host.pid_ns_ino': { + beta: 'This field is beta and subject to change.', + dashed_name: 'host-pid-ns-ino', + description: + 'This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.', + example: 256383, + flat_name: 'host.pid_ns_ino', + ignore_above: 1024, + level: 'extended', + name: 'pid_ns_ino', + normalize: [], + short: 'Pid namespace inode', + type: 'keyword', + }, + 'host.risk.calculated_level': { + dashed_name: 'host-risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'host.risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'host.risk.calculated_score': { + dashed_name: 'host-risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'host.risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'host.risk.calculated_score_norm': { + dashed_name: 'host-risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'host.risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'host.risk.static_level': { + dashed_name: 'host-risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'host.risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'host.risk.static_score': { + dashed_name: 'host-risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'host.risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'host.risk.static_score_norm': { + dashed_name: 'host-risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'host.risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + 'host.type': { + dashed_name: 'host-type', + description: + 'Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.', + flat_name: 'host.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'Type of host.', + type: 'keyword', + }, + 'host.uptime': { + dashed_name: 'host-uptime', + description: 'Seconds the host has been up.', + example: 1325, + flat_name: 'host.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + short: 'Seconds the host has been up.', + type: 'long', + }, + 'http.request.body.bytes': { + dashed_name: 'http-request-body-bytes', + description: 'Size in bytes of the request body.', + example: 887, + flat_name: 'http.request.body.bytes', + format: 'bytes', + level: 'extended', + name: 'request.body.bytes', + normalize: [], + short: 'Size in bytes of the request body.', + type: 'long', + }, + 'http.request.body.content': { + dashed_name: 'http-request-body-content', + description: 'The full HTTP request body.', + example: 'Hello world', + flat_name: 'http.request.body.content', + level: 'extended', + multi_fields: [ + { + flat_name: 'http.request.body.content.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'request.body.content', + normalize: [], + short: 'The full HTTP request body.', + type: 'wildcard', + }, + 'http.request.bytes': { + dashed_name: 'http-request-bytes', + description: 'Total size in bytes of the request (body and headers).', + example: 1437, + flat_name: 'http.request.bytes', + format: 'bytes', + level: 'extended', + name: 'request.bytes', + normalize: [], + short: 'Total size in bytes of the request (body and headers).', + type: 'long', + }, + 'http.request.id': { + dashed_name: 'http-request-id', + description: + 'A unique identifier for each HTTP request to correlate logs between clients and servers in transactions.\nThe id may be contained in a non-standard HTTP header, such as `X-Request-ID` or `X-Correlation-ID`.', + example: '123e4567-e89b-12d3-a456-426614174000', + flat_name: 'http.request.id', + ignore_above: 1024, + level: 'extended', + name: 'request.id', + normalize: [], + short: 'HTTP request ID.', + type: 'keyword', + }, + 'http.request.method': { + dashed_name: 'http-request-method', + description: + 'HTTP request method.\nThe value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field.', + example: 'POST', + flat_name: 'http.request.method', + ignore_above: 1024, + level: 'extended', + name: 'request.method', + normalize: [], + short: 'HTTP request method.', + type: 'keyword', + }, + 'http.request.mime_type': { + dashed_name: 'http-request-mime-type', + description: + "Mime type of the body of the request.\nThis value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients.", + example: 'image/gif', + flat_name: 'http.request.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'request.mime_type', + normalize: [], + short: 'Mime type of the body of the request.', + type: 'keyword', + }, + 'http.request.referrer': { + dashed_name: 'http-request-referrer', + description: 'Referrer for this HTTP request.', + example: 'https://blog.example.com/', + flat_name: 'http.request.referrer', + ignore_above: 1024, + level: 'extended', + name: 'request.referrer', + normalize: [], + short: 'Referrer for this HTTP request.', + type: 'keyword', + }, + 'http.response.body.bytes': { + dashed_name: 'http-response-body-bytes', + description: 'Size in bytes of the response body.', + example: 887, + flat_name: 'http.response.body.bytes', + format: 'bytes', + level: 'extended', + name: 'response.body.bytes', + normalize: [], + short: 'Size in bytes of the response body.', + type: 'long', + }, + 'http.response.body.content': { + dashed_name: 'http-response-body-content', + description: 'The full HTTP response body.', + example: 'Hello world', + flat_name: 'http.response.body.content', + level: 'extended', + multi_fields: [ + { + flat_name: 'http.response.body.content.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'response.body.content', + normalize: [], + short: 'The full HTTP response body.', + type: 'wildcard', + }, + 'http.response.bytes': { + dashed_name: 'http-response-bytes', + description: 'Total size in bytes of the response (body and headers).', + example: 1437, + flat_name: 'http.response.bytes', + format: 'bytes', + level: 'extended', + name: 'response.bytes', + normalize: [], + short: 'Total size in bytes of the response (body and headers).', + type: 'long', + }, + 'http.response.mime_type': { + dashed_name: 'http-response-mime-type', + description: + "Mime type of the body of the response.\nThis value must only be populated based on the content of the response body, not on the `Content-Type` header. Comparing the mime type of a response with the response's Content-Type header can be helpful in detecting misconfigured servers.", + example: 'image/gif', + flat_name: 'http.response.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'response.mime_type', + normalize: [], + short: 'Mime type of the body of the response.', + type: 'keyword', + }, + 'http.response.status_code': { + dashed_name: 'http-response-status-code', + description: 'HTTP response status code.', + example: 404, + flat_name: 'http.response.status_code', + format: 'string', + level: 'extended', + name: 'response.status_code', + normalize: [], + short: 'HTTP response status code.', + type: 'long', + }, + 'http.version': { + dashed_name: 'http-version', + description: 'HTTP version.', + example: 1.1, + flat_name: 'http.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'HTTP version.', + type: 'keyword', + }, + labels: { + dashed_name: 'labels', + description: + 'Custom key/value pairs.\nCan be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.\nExample: `docker` and `k8s` labels.', + example: '{"application": "foo-bar", "env": "production"}', + flat_name: 'labels', + level: 'core', + name: 'labels', + normalize: [], + object_type: 'keyword', + short: 'Custom key/value pairs.', + type: 'object', + }, + 'log.file.path': { + dashed_name: 'log-file-path', + description: + "Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate.\nIf the event wasn't read from a log file, do not populate this field.", + example: '/var/log/fun-times.log', + flat_name: 'log.file.path', + ignore_above: 1024, + level: 'extended', + name: 'file.path', + normalize: [], + short: 'Full path to the log file this event came from.', + type: 'keyword', + }, + 'log.level': { + dashed_name: 'log-level', + description: + "Original log level of the log event.\nIf the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity).\nSome examples are `warn`, `err`, `i`, `informational`.", + example: 'error', + flat_name: 'log.level', + ignore_above: 1024, + level: 'core', + name: 'level', + normalize: [], + short: 'Log level of the log event.', + type: 'keyword', + }, + 'log.logger': { + dashed_name: 'log-logger', + description: + 'The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name.', + example: 'org.elasticsearch.bootstrap.Bootstrap', + flat_name: 'log.logger', + ignore_above: 1024, + level: 'core', + name: 'logger', + normalize: [], + short: 'Name of the logger.', + type: 'keyword', + }, + 'log.origin.file.line': { + dashed_name: 'log-origin-file-line', + description: + 'The line number of the file containing the source code which originated the log event.', + example: 42, + flat_name: 'log.origin.file.line', + level: 'extended', + name: 'origin.file.line', + normalize: [], + short: 'The line number of the file which originated the log event.', + type: 'long', + }, + 'log.origin.file.name': { + dashed_name: 'log-origin-file-name', + description: + 'The name of the file containing the source code which originated the log event.\nNote that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`.', + example: 'Bootstrap.java', + flat_name: 'log.origin.file.name', + ignore_above: 1024, + level: 'extended', + name: 'origin.file.name', + normalize: [], + short: 'The code file which originated the log event.', + type: 'keyword', + }, + 'log.origin.function': { + dashed_name: 'log-origin-function', + description: 'The name of the function or method which originated the log event.', + example: 'init', + flat_name: 'log.origin.function', + ignore_above: 1024, + level: 'extended', + name: 'origin.function', + normalize: [], + short: 'The function which originated the log event.', + type: 'keyword', + }, + 'log.syslog': { + dashed_name: 'log-syslog', + description: + 'The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164.', + flat_name: 'log.syslog', + level: 'extended', + name: 'syslog', + normalize: [], + short: 'Syslog metadata', + type: 'object', + }, + 'log.syslog.appname': { + dashed_name: 'log-syslog-appname', + description: 'The device or application that originated the Syslog message, if available.', + example: 'sshd', + flat_name: 'log.syslog.appname', + ignore_above: 1024, + level: 'extended', + name: 'syslog.appname', + normalize: [], + short: 'The device or application that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.facility.code': { + dashed_name: 'log-syslog-facility-code', + description: + 'The Syslog numeric facility of the log event, if available.\nAccording to RFCs 5424 and 3164, this value should be an integer between 0 and 23.', + example: 23, + flat_name: 'log.syslog.facility.code', + format: 'string', + level: 'extended', + name: 'syslog.facility.code', + normalize: [], + short: 'Syslog numeric facility of the event.', + type: 'long', + }, + 'log.syslog.facility.name': { + dashed_name: 'log-syslog-facility-name', + description: 'The Syslog text-based facility of the log event, if available.', + example: 'local7', + flat_name: 'log.syslog.facility.name', + ignore_above: 1024, + level: 'extended', + name: 'syslog.facility.name', + normalize: [], + short: 'Syslog text-based facility of the event.', + type: 'keyword', + }, + 'log.syslog.hostname': { + dashed_name: 'log-syslog-hostname', + description: + 'The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector.', + example: 'example-host', + flat_name: 'log.syslog.hostname', + ignore_above: 1024, + level: 'extended', + name: 'syslog.hostname', + normalize: [], + short: 'The host that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.msgid': { + dashed_name: 'log-syslog-msgid', + description: + 'An identifier for the type of Syslog message, if available. Only applicable for RFC 5424 messages.', + example: 'ID47', + flat_name: 'log.syslog.msgid', + ignore_above: 1024, + level: 'extended', + name: 'syslog.msgid', + normalize: [], + short: 'An identifier for the type of Syslog message.', + type: 'keyword', + }, + 'log.syslog.priority': { + dashed_name: 'log-syslog-priority', + description: + 'Syslog numeric priority of the event, if available.\nAccording to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.', + example: 135, + flat_name: 'log.syslog.priority', + format: 'string', + level: 'extended', + name: 'syslog.priority', + normalize: [], + short: 'Syslog priority of the event.', + type: 'long', + }, + 'log.syslog.procid': { + dashed_name: 'log-syslog-procid', + description: 'The process name or ID that originated the Syslog message, if available.', + example: 12345, + flat_name: 'log.syslog.procid', + ignore_above: 1024, + level: 'extended', + name: 'syslog.procid', + normalize: [], + short: 'The process name or ID that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.severity.code': { + dashed_name: 'log-syslog-severity-code', + description: + "The Syslog numeric severity of the log event, if available.\nIf the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`.", + example: 3, + flat_name: 'log.syslog.severity.code', + level: 'extended', + name: 'syslog.severity.code', + normalize: [], + short: 'Syslog numeric severity of the event.', + type: 'long', + }, + 'log.syslog.severity.name': { + dashed_name: 'log-syslog-severity-name', + description: + "The Syslog numeric severity of the log event, if available.\nIf the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`.", + example: 'Error', + flat_name: 'log.syslog.severity.name', + ignore_above: 1024, + level: 'extended', + name: 'syslog.severity.name', + normalize: [], + short: 'Syslog text-based severity of the event.', + type: 'keyword', + }, + 'log.syslog.structured_data': { + dashed_name: 'log-syslog-structured-data', + description: + 'Structured data expressed in RFC 5424 messages, if available. These are key-value pairs formed from the structured data portion of the syslog message, as defined in RFC 5424 Section 6.3.', + flat_name: 'log.syslog.structured_data', + level: 'extended', + name: 'syslog.structured_data', + normalize: [], + short: 'Structured data expressed in RFC 5424 messages.', + type: 'flattened', + }, + 'log.syslog.version': { + dashed_name: 'log-syslog-version', + description: + 'The version of the Syslog protocol specification. Only applicable for RFC 5424 messages.', + example: 1, + flat_name: 'log.syslog.version', + ignore_above: 1024, + level: 'extended', + name: 'syslog.version', + normalize: [], + short: 'Syslog protocol version.', + type: 'keyword', + }, + message: { + dashed_name: 'message', + description: + 'For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.', + example: 'Hello World', + flat_name: 'message', + level: 'core', + name: 'message', + normalize: [], + short: 'Log message optimized for viewing in a log viewer.', + type: 'match_only_text', + }, + 'network.application': { + dashed_name: 'network-application', + description: + "When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.\nFor example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.\nThe field value must be normalized to lowercase for querying.", + example: 'aim', + flat_name: 'network.application', + ignore_above: 1024, + level: 'extended', + name: 'application', + normalize: [], + short: 'Application level protocol name.', + type: 'keyword', + }, + 'network.bytes': { + dashed_name: 'network-bytes', + description: + 'Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.', + example: 368, + flat_name: 'network.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Total bytes transferred in both directions.', + type: 'long', + }, + 'network.community_id': { + dashed_name: 'network-community-id', + description: + 'A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.', + example: '1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=', + flat_name: 'network.community_id', + ignore_above: 1024, + level: 'extended', + name: 'community_id', + normalize: [], + short: 'A hash of source and destination IPs and ports.', + type: 'keyword', + }, + 'network.direction': { + dashed_name: 'network-direction', + description: + 'Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host\'s point of view, using the values "ingress" or "egress".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".\nNote that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.', + example: 'inbound', + expected_values: [ + 'ingress', + 'egress', + 'inbound', + 'outbound', + 'internal', + 'external', + 'unknown', + ], + flat_name: 'network.direction', + ignore_above: 1024, + level: 'core', + name: 'direction', + normalize: [], + short: 'Direction of the network traffic.', + type: 'keyword', + }, + 'network.forwarded_ip': { + dashed_name: 'network-forwarded-ip', + description: 'Host IP address when the source IP address is the proxy.', + example: '192.1.1.2', + flat_name: 'network.forwarded_ip', + level: 'core', + name: 'forwarded_ip', + normalize: [], + short: 'Host IP address when the source IP address is the proxy.', + type: 'ip', + }, + 'network.iana_number': { + dashed_name: 'network-iana-number', + description: + 'IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.', + example: 6, + flat_name: 'network.iana_number', + ignore_above: 1024, + level: 'extended', + name: 'iana_number', + normalize: [], + short: 'IANA Protocol Number.', + type: 'keyword', + }, + 'network.inner': { + dashed_name: 'network-inner', + description: + 'Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)', + flat_name: 'network.inner', + level: 'extended', + name: 'inner', + normalize: [], + short: 'Inner VLAN tag information', + type: 'object', + }, + 'network.inner.vlan.id': { + dashed_name: 'network-inner-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'network.inner.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'network.inner.vlan.name': { + dashed_name: 'network-inner-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'network.inner.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'network.name': { + dashed_name: 'network-name', + description: 'Name given by operators to sections of their network.', + example: 'Guest Wifi', + flat_name: 'network.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name given by operators to sections of their network.', + type: 'keyword', + }, + 'network.packets': { + dashed_name: 'network-packets', + description: + 'Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.', + example: 24, + flat_name: 'network.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Total packets transferred in both directions.', + type: 'long', + }, + 'network.protocol': { + dashed_name: 'network-protocol', + description: + 'In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.', + example: 'http', + flat_name: 'network.protocol', + ignore_above: 1024, + level: 'core', + name: 'protocol', + normalize: [], + short: 'Application protocol name.', + type: 'keyword', + }, + 'network.transport': { + dashed_name: 'network-transport', + description: + 'Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.', + example: 'tcp', + flat_name: 'network.transport', + ignore_above: 1024, + level: 'core', + name: 'transport', + normalize: [], + short: 'Protocol Name corresponding to the field `iana_number`.', + type: 'keyword', + }, + 'network.type': { + dashed_name: 'network-type', + description: + 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.', + example: 'ipv4', + flat_name: 'network.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc', + type: 'keyword', + }, + 'network.vlan.id': { + dashed_name: 'network-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'network.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'network.vlan.name': { + dashed_name: 'network-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'network.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.egress': { + dashed_name: 'observer-egress', + description: + 'Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.', + flat_name: 'observer.egress', + level: 'extended', + name: 'egress', + normalize: [], + short: 'Object field for egress information', + type: 'object', + }, + 'observer.egress.interface.alias': { + dashed_name: 'observer-egress-interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'observer.egress.interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + original_fieldset: 'interface', + short: 'Interface alias', + type: 'keyword', + }, + 'observer.egress.interface.id': { + dashed_name: 'observer-egress-interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'observer.egress.interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'interface', + short: 'Interface ID', + type: 'keyword', + }, + 'observer.egress.interface.name': { + dashed_name: 'observer-egress-interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'observer.egress.interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'interface', + short: 'Interface name', + type: 'keyword', + }, + 'observer.egress.vlan.id': { + dashed_name: 'observer-egress-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'observer.egress.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'observer.egress.vlan.name': { + dashed_name: 'observer-egress-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'observer.egress.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.egress.zone': { + dashed_name: 'observer-egress-zone', + description: + 'Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.', + example: 'Public_Internet', + flat_name: 'observer.egress.zone', + ignore_above: 1024, + level: 'extended', + name: 'egress.zone', + normalize: [], + short: 'Observer Egress zone', + type: 'keyword', + }, + 'observer.geo.city_name': { + dashed_name: 'observer-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'observer.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'observer.geo.continent_code': { + dashed_name: 'observer-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'observer.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'observer.geo.continent_name': { + dashed_name: 'observer-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'observer.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'observer.geo.country_iso_code': { + dashed_name: 'observer-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'observer.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'observer.geo.country_name': { + dashed_name: 'observer-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'observer.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'observer.geo.location': { + dashed_name: 'observer-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'observer.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'observer.geo.name': { + dashed_name: 'observer-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'observer.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'observer.geo.postal_code': { + dashed_name: 'observer-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'observer.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'observer.geo.region_iso_code': { + dashed_name: 'observer-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'observer.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'observer.geo.region_name': { + dashed_name: 'observer-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'observer.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'observer.geo.timezone': { + dashed_name: 'observer-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'observer.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'observer.hostname': { + dashed_name: 'observer-hostname', + description: 'Hostname of the observer.', + flat_name: 'observer.hostname', + ignore_above: 1024, + level: 'core', + name: 'hostname', + normalize: [], + short: 'Hostname of the observer.', + type: 'keyword', + }, + 'observer.ingress': { + dashed_name: 'observer-ingress', + description: + 'Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.', + flat_name: 'observer.ingress', + level: 'extended', + name: 'ingress', + normalize: [], + short: 'Object field for ingress information', + type: 'object', + }, + 'observer.ingress.interface.alias': { + dashed_name: 'observer-ingress-interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'observer.ingress.interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + original_fieldset: 'interface', + short: 'Interface alias', + type: 'keyword', + }, + 'observer.ingress.interface.id': { + dashed_name: 'observer-ingress-interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'observer.ingress.interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'interface', + short: 'Interface ID', + type: 'keyword', + }, + 'observer.ingress.interface.name': { + dashed_name: 'observer-ingress-interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'observer.ingress.interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'interface', + short: 'Interface name', + type: 'keyword', + }, + 'observer.ingress.vlan.id': { + dashed_name: 'observer-ingress-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'observer.ingress.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'observer.ingress.vlan.name': { + dashed_name: 'observer-ingress-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'observer.ingress.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.ingress.zone': { + dashed_name: 'observer-ingress-zone', + description: + 'Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.', + example: 'DMZ', + flat_name: 'observer.ingress.zone', + ignore_above: 1024, + level: 'extended', + name: 'ingress.zone', + normalize: [], + short: 'Observer ingress zone', + type: 'keyword', + }, + 'observer.ip': { + dashed_name: 'observer-ip', + description: 'IP addresses of the observer.', + flat_name: 'observer.ip', + level: 'core', + name: 'ip', + normalize: ['array'], + short: 'IP addresses of the observer.', + type: 'ip', + }, + 'observer.mac': { + dashed_name: 'observer-mac', + description: + 'MAC addresses of the observer.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]', + flat_name: 'observer.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: ['array'], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC addresses of the observer.', + type: 'keyword', + }, + 'observer.name': { + dashed_name: 'observer-name', + description: + 'Custom name of the observer.\nThis is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization.\nIf no custom name is needed, the field can be left empty.', + example: '1_proxySG', + flat_name: 'observer.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Custom name of the observer.', + type: 'keyword', + }, + 'observer.os.family': { + dashed_name: 'observer-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'observer.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'observer.os.full': { + dashed_name: 'observer-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'observer.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'observer.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'observer.os.kernel': { + dashed_name: 'observer-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'observer.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'observer.os.name': { + dashed_name: 'observer-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'observer.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'observer.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'observer.os.platform': { + dashed_name: 'observer-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'observer.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'observer.os.type': { + dashed_name: 'observer-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'observer.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'observer.os.version': { + dashed_name: 'observer-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'observer.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'observer.product': { + dashed_name: 'observer-product', + description: 'The product name of the observer.', + example: 's200', + flat_name: 'observer.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + short: 'The product name of the observer.', + type: 'keyword', + }, + 'observer.serial_number': { + dashed_name: 'observer-serial-number', + description: 'Observer serial number.', + flat_name: 'observer.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + short: 'Observer serial number.', + type: 'keyword', + }, + 'observer.type': { + dashed_name: 'observer-type', + description: + 'The type of the observer the data is coming from.\nThere is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.', + example: 'firewall', + flat_name: 'observer.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'The type of the observer the data is coming from.', + type: 'keyword', + }, + 'observer.vendor': { + dashed_name: 'observer-vendor', + description: 'Vendor name of the observer.', + example: 'Symantec', + flat_name: 'observer.vendor', + ignore_above: 1024, + level: 'core', + name: 'vendor', + normalize: [], + short: 'Vendor name of the observer.', + type: 'keyword', + }, + 'observer.version': { + dashed_name: 'observer-version', + description: 'Observer version.', + flat_name: 'observer.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Observer version.', + type: 'keyword', + }, + 'orchestrator.api_version': { + dashed_name: 'orchestrator-api-version', + description: 'API version being used to carry out the action', + example: 'v1beta1', + flat_name: 'orchestrator.api_version', + ignore_above: 1024, + level: 'extended', + name: 'api_version', + normalize: [], + short: 'API version being used to carry out the action', + type: 'keyword', + }, + 'orchestrator.cluster.id': { + dashed_name: 'orchestrator-cluster-id', + description: 'Unique ID of the cluster.', + flat_name: 'orchestrator.cluster.id', + ignore_above: 1024, + level: 'extended', + name: 'cluster.id', + normalize: [], + short: 'Unique ID of the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.name': { + dashed_name: 'orchestrator-cluster-name', + description: 'Name of the cluster.', + flat_name: 'orchestrator.cluster.name', + ignore_above: 1024, + level: 'extended', + name: 'cluster.name', + normalize: [], + short: 'Name of the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.url': { + dashed_name: 'orchestrator-cluster-url', + description: 'URL of the API used to manage the cluster.', + flat_name: 'orchestrator.cluster.url', + ignore_above: 1024, + level: 'extended', + name: 'cluster.url', + normalize: [], + short: 'URL of the API used to manage the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.version': { + dashed_name: 'orchestrator-cluster-version', + description: 'The version of the cluster.', + flat_name: 'orchestrator.cluster.version', + ignore_above: 1024, + level: 'extended', + name: 'cluster.version', + normalize: [], + short: 'The version of the cluster.', + type: 'keyword', + }, + 'orchestrator.namespace': { + dashed_name: 'orchestrator-namespace', + description: 'Namespace in which the action is taking place.', + example: 'kube-system', + flat_name: 'orchestrator.namespace', + ignore_above: 1024, + level: 'extended', + name: 'namespace', + normalize: [], + short: 'Namespace in which the action is taking place.', + type: 'keyword', + }, + 'orchestrator.organization': { + dashed_name: 'orchestrator-organization', + description: 'Organization affected by the event (for multi-tenant orchestrator setups).', + example: 'elastic', + flat_name: 'orchestrator.organization', + ignore_above: 1024, + level: 'extended', + name: 'organization', + normalize: [], + short: 'Organization affected by the event (for multi-tenant orchestrator setups).', + type: 'keyword', + }, + 'orchestrator.resource.id': { + dashed_name: 'orchestrator-resource-id', + description: 'Unique ID of the resource being acted upon.', + flat_name: 'orchestrator.resource.id', + ignore_above: 1024, + level: 'extended', + name: 'resource.id', + normalize: [], + short: 'Unique ID of the resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.resource.ip': { + dashed_name: 'orchestrator-resource-ip', + description: + 'IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).', + flat_name: 'orchestrator.resource.ip', + level: 'extended', + name: 'resource.ip', + normalize: ['array'], + short: 'IP address assigned to the resource associated with the event being observed.', + type: 'ip', + }, + 'orchestrator.resource.name': { + dashed_name: 'orchestrator-resource-name', + description: 'Name of the resource being acted upon.', + example: 'test-pod-cdcws', + flat_name: 'orchestrator.resource.name', + ignore_above: 1024, + level: 'extended', + name: 'resource.name', + normalize: [], + short: 'Name of the resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.resource.parent.type': { + dashed_name: 'orchestrator-resource-parent-type', + description: + 'Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).', + example: 'DaemonSet', + flat_name: 'orchestrator.resource.parent.type', + ignore_above: 1024, + level: 'extended', + name: 'resource.parent.type', + normalize: [], + short: 'Type or kind of the parent resource associated with the event being observed.', + type: 'keyword', + }, + 'orchestrator.resource.type': { + dashed_name: 'orchestrator-resource-type', + description: 'Type of resource being acted upon.', + example: 'service', + flat_name: 'orchestrator.resource.type', + ignore_above: 1024, + level: 'extended', + name: 'resource.type', + normalize: [], + short: 'Type of resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.type': { + dashed_name: 'orchestrator-type', + description: 'Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).', + example: 'kubernetes', + flat_name: 'orchestrator.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).', + type: 'keyword', + }, + 'organization.id': { + dashed_name: 'organization-id', + description: 'Unique identifier for the organization.', + flat_name: 'organization.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Unique identifier for the organization.', + type: 'keyword', + }, + 'organization.name': { + dashed_name: 'organization-name', + description: 'Organization name.', + flat_name: 'organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Organization name.', + type: 'keyword', + }, + 'package.architecture': { + dashed_name: 'package-architecture', + description: 'Package architecture.', + example: 'x86_64', + flat_name: 'package.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'Package architecture.', + type: 'keyword', + }, + 'package.build_version': { + dashed_name: 'package-build-version', + description: + 'Additional information about the build version of the installed package.\nFor example use the commit SHA of a non-released package.', + example: '36f4f7e89dd61b0988b12ee000b98966867710cd', + flat_name: 'package.build_version', + ignore_above: 1024, + level: 'extended', + name: 'build_version', + normalize: [], + short: 'Build version information', + type: 'keyword', + }, + 'package.checksum': { + dashed_name: 'package-checksum', + description: 'Checksum of the installed package for verification.', + example: '68b329da9893e34099c7d8ad5cb9c940', + flat_name: 'package.checksum', + ignore_above: 1024, + level: 'extended', + name: 'checksum', + normalize: [], + short: 'Checksum of the installed package for verification.', + type: 'keyword', + }, + 'package.description': { + dashed_name: 'package-description', + description: 'Description of the package.', + example: 'Open source programming language to build simple/reliable/efficient software.', + flat_name: 'package.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Description of the package.', + type: 'keyword', + }, + 'package.install_scope': { + dashed_name: 'package-install-scope', + description: 'Indicating how the package was installed, e.g. user-local, global.', + example: 'global', + flat_name: 'package.install_scope', + ignore_above: 1024, + level: 'extended', + name: 'install_scope', + normalize: [], + short: 'Indicating how the package was installed, e.g. user-local, global.', + type: 'keyword', + }, + 'package.installed': { + dashed_name: 'package-installed', + description: 'Time when package was installed.', + flat_name: 'package.installed', + level: 'extended', + name: 'installed', + normalize: [], + short: 'Time when package was installed.', + type: 'date', + }, + 'package.license': { + dashed_name: 'package-license', + description: + 'License under which the package was released.\nUse a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/).', + example: 'Apache License 2.0', + flat_name: 'package.license', + ignore_above: 1024, + level: 'extended', + name: 'license', + normalize: [], + short: 'Package license', + type: 'keyword', + }, + 'package.name': { + dashed_name: 'package-name', + description: 'Package name', + example: 'go', + flat_name: 'package.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Package name', + type: 'keyword', + }, + 'package.path': { + dashed_name: 'package-path', + description: 'Path where the package is installed.', + example: '/usr/local/Cellar/go/1.12.9/', + flat_name: 'package.path', + ignore_above: 1024, + level: 'extended', + name: 'path', + normalize: [], + short: 'Path where the package is installed.', + type: 'keyword', + }, + 'package.reference': { + dashed_name: 'package-reference', + description: 'Home page or reference URL of the software in this package, if available.', + example: 'https://golang.org', + flat_name: 'package.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Package home page or reference URL', + type: 'keyword', + }, + 'package.size': { + dashed_name: 'package-size', + description: 'Package size in bytes.', + example: 62231, + flat_name: 'package.size', + format: 'string', + level: 'extended', + name: 'size', + normalize: [], + short: 'Package size in bytes.', + type: 'long', + }, + 'package.type': { + dashed_name: 'package-type', + description: + 'Type of package.\nThis should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.', + example: 'rpm', + flat_name: 'package.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Package type', + type: 'keyword', + }, + 'package.version': { + dashed_name: 'package-version', + description: 'Package version', + example: '1.12.9', + flat_name: 'package.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Package version', + type: 'keyword', + }, + 'process.args': { + dashed_name: 'process-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.args_count': { + dashed_name: 'process-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.code_signature.digest_algorithm': { + dashed_name: 'process-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'process.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.exists': { + dashed_name: 'process-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'process.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'process.code_signature.signing_id': { + dashed_name: 'process-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'process.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.status': { + dashed_name: 'process-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'process.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'process.code_signature.subject_name': { + dashed_name: 'process-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'process.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'process.code_signature.team_id': { + dashed_name: 'process-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'process.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.timestamp': { + dashed_name: 'process-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'process.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'process.code_signature.trusted': { + dashed_name: 'process-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'process.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'process.code_signature.valid': { + dashed_name: 'process-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'process.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'process.command_line': { + dashed_name: 'process-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.elf.architecture': { + dashed_name: 'process-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'process.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'process.elf.byte_order': { + dashed_name: 'process-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'process.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'process.elf.cpu_type': { + dashed_name: 'process-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'process.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'process.elf.creation_date': { + dashed_name: 'process-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'process.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'process.elf.exports': { + dashed_name: 'process-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'process.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'process.elf.header.abi_version': { + dashed_name: 'process-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'process.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'process.elf.header.class': { + dashed_name: 'process-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'process.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'process.elf.header.data': { + dashed_name: 'process-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'process.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'process.elf.header.entrypoint': { + dashed_name: 'process-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'process.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'process.elf.header.object_version': { + dashed_name: 'process-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'process.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'process.elf.header.os_abi': { + dashed_name: 'process-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'process.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'process.elf.header.type': { + dashed_name: 'process-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'process.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'process.elf.header.version': { + dashed_name: 'process-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'process.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'process.elf.imports': { + dashed_name: 'process-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'process.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'process.elf.sections': { + dashed_name: 'process-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'process.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'process.elf.sections.chi2': { + dashed_name: 'process-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'process.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'process.elf.sections.entropy': { + dashed_name: 'process-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'process.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'process.elf.sections.flags': { + dashed_name: 'process-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'process.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'process.elf.sections.name': { + dashed_name: 'process-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'process.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'process.elf.sections.physical_offset': { + dashed_name: 'process-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'process.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'process.elf.sections.physical_size': { + dashed_name: 'process-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'process.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'process.elf.sections.type': { + dashed_name: 'process-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'process.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'process.elf.sections.virtual_address': { + dashed_name: 'process-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'process.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'process.elf.sections.virtual_size': { + dashed_name: 'process-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'process.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'process.elf.segments': { + dashed_name: 'process-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'process.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'process.elf.segments.sections': { + dashed_name: 'process-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'process.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'process.elf.segments.type': { + dashed_name: 'process-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'process.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'process.elf.shared_libraries': { + dashed_name: 'process-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'process.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'process.elf.telfhash': { + dashed_name: 'process-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'process.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'process.end': { + dashed_name: 'process-end', + description: 'The time the process ended.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.end', + level: 'extended', + name: 'end', + normalize: [], + short: 'The time the process ended.', + type: 'date', + }, + 'process.entity_id': { + dashed_name: 'process-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.args': { + dashed_name: 'process-entry-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.entry_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.entry_leader.args_count': { + dashed_name: 'process-entry-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.entry_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.entry_leader.attested_groups.name': { + dashed_name: 'process-entry-leader-attested-groups-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.attested_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.attested_user.id': { + dashed_name: 'process-entry-leader-attested-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.attested_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.attested_user.name': { + dashed_name: 'process-entry-leader-attested-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.attested_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.attested_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.command_line': { + dashed_name: 'process-entry-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.entry_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.entry_leader.entity_id': { + dashed_name: 'process-entry-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.entry_meta.source.ip': { + dashed_name: 'process-entry-leader-entry-meta-source-ip', + description: 'IP address of the source (IPv4 or IPv6).', + flat_name: 'process.entry_leader.entry_meta.source.ip', + level: 'core', + name: 'ip', + normalize: [], + original_fieldset: 'source', + short: 'IP address of the source.', + type: 'ip', + }, + 'process.entry_leader.entry_meta.type': { + dashed_name: 'process-entry-leader-entry-meta-type', + description: + 'The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader.', + flat_name: 'process.entry_leader.entry_meta.type', + ignore_above: 1024, + level: 'extended', + name: 'entry_meta.type', + normalize: [], + original_fieldset: 'process', + short: 'The entry type for the entry session leader.', + type: 'keyword', + }, + 'process.entry_leader.executable': { + dashed_name: 'process-entry-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.entry_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.entry_leader.group.id': { + dashed_name: 'process-entry-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.group.name': { + dashed_name: 'process-entry-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.interactive': { + dashed_name: 'process-entry-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.entry_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.entry_leader.name': { + dashed_name: 'process-entry-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.entry_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.entry_leader.parent.entity_id': { + dashed_name: 'process-entry-leader-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.parent.pid': { + dashed_name: 'process-entry-leader-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.parent.session_leader.entity_id': { + dashed_name: 'process-entry-leader-parent-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.parent.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.parent.session_leader.pid': { + dashed_name: 'process-entry-leader-parent-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.parent.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.parent.session_leader.start': { + dashed_name: 'process-entry-leader-parent-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.parent.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.parent.start': { + dashed_name: 'process-entry-leader-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.pid': { + dashed_name: 'process-entry-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.real_group.id': { + dashed_name: 'process-entry-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.real_group.name': { + dashed_name: 'process-entry-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.real_user.id': { + dashed_name: 'process-entry-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.real_user.name': { + dashed_name: 'process-entry-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.same_as_process': { + dashed_name: 'process-entry-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.entry_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.entry_leader.saved_group.id': { + dashed_name: 'process-entry-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.saved_group.name': { + dashed_name: 'process-entry-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.saved_user.id': { + dashed_name: 'process-entry-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.saved_user.name': { + dashed_name: 'process-entry-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.start': { + dashed_name: 'process-entry-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.supplemental_groups.id': { + dashed_name: 'process-entry-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.supplemental_groups.name': { + dashed_name: 'process-entry-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.tty': { + dashed_name: 'process-entry-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.entry_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.entry_leader.tty.char_device.major': { + dashed_name: 'process-entry-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.entry_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.entry_leader.tty.char_device.minor': { + dashed_name: 'process-entry-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.entry_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.entry_leader.user.id': { + dashed_name: 'process-entry-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.user.name': { + dashed_name: 'process-entry-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.working_directory': { + dashed_name: 'process-entry-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.entry_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.env_vars': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-env-vars', + description: + 'Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.', + example: '["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]', + flat_name: 'process.env_vars', + ignore_above: 1024, + level: 'extended', + name: 'env_vars', + normalize: ['array'], + short: 'Array of environment variable bindings.', + type: 'keyword', + }, + 'process.executable': { + dashed_name: 'process-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.exit_code': { + dashed_name: 'process-exit-code', + description: + 'The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).', + example: 137, + flat_name: 'process.exit_code', + level: 'extended', + name: 'exit_code', + normalize: [], + short: 'The exit code of the process.', + type: 'long', + }, + 'process.group_leader.args': { + dashed_name: 'process-group-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.group_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.group_leader.args_count': { + dashed_name: 'process-group-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.group_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.group_leader.command_line': { + dashed_name: 'process-group-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.group_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.group_leader.entity_id': { + dashed_name: 'process-group-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.group_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.group_leader.executable': { + dashed_name: 'process-group-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.group_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.group_leader.group.id': { + dashed_name: 'process-group-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.group.name': { + dashed_name: 'process-group-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.interactive': { + dashed_name: 'process-group-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.group_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.group_leader.name': { + dashed_name: 'process-group-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.group_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.group_leader.pid': { + dashed_name: 'process-group-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.group_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.group_leader.real_group.id': { + dashed_name: 'process-group-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.real_group.name': { + dashed_name: 'process-group-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.real_user.id': { + dashed_name: 'process-group-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.real_user.name': { + dashed_name: 'process-group-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.same_as_process': { + dashed_name: 'process-group-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.group_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.group_leader.saved_group.id': { + dashed_name: 'process-group-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.saved_group.name': { + dashed_name: 'process-group-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.saved_user.id': { + dashed_name: 'process-group-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.saved_user.name': { + dashed_name: 'process-group-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.start': { + dashed_name: 'process-group-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.group_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.group_leader.supplemental_groups.id': { + dashed_name: 'process-group-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.supplemental_groups.name': { + dashed_name: 'process-group-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.tty': { + dashed_name: 'process-group-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.group_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.group_leader.tty.char_device.major': { + dashed_name: 'process-group-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.group_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.group_leader.tty.char_device.minor': { + dashed_name: 'process-group-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.group_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.group_leader.user.id': { + dashed_name: 'process-group-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.user.name': { + dashed_name: 'process-group-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.working_directory': { + dashed_name: 'process-group-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.group_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.hash.md5': { + dashed_name: 'process-hash-md5', + description: 'MD5 hash.', + flat_name: 'process.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'process.hash.sha1': { + dashed_name: 'process-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'process.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'process.hash.sha256': { + dashed_name: 'process-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'process.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'process.hash.sha384': { + dashed_name: 'process-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'process.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'process.hash.sha512': { + dashed_name: 'process-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'process.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'process.hash.ssdeep': { + dashed_name: 'process-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'process.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'process.hash.tlsh': { + dashed_name: 'process-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'process.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'process.interactive': { + dashed_name: 'process-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.io': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io', + description: + 'A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input.', + flat_name: 'process.io', + level: 'extended', + name: 'io', + normalize: [], + short: 'A chunk of input or output (IO) from a single process.', + type: 'object', + }, + 'process.io.bytes_skipped': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped', + description: 'An array of byte offsets and lengths denoting where IO data has been skipped.', + flat_name: 'process.io.bytes_skipped', + level: 'extended', + name: 'io.bytes_skipped', + normalize: ['array'], + short: 'An array of byte offsets and lengths denoting where IO data has been skipped.', + type: 'object', + }, + 'process.io.bytes_skipped.length': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped-length', + description: 'The length of bytes skipped.', + flat_name: 'process.io.bytes_skipped.length', + level: 'extended', + name: 'io.bytes_skipped.length', + normalize: [], + short: 'The length of bytes skipped.', + type: 'long', + }, + 'process.io.bytes_skipped.offset': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped-offset', + description: + "The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.", + flat_name: 'process.io.bytes_skipped.offset', + level: 'extended', + name: 'io.bytes_skipped.offset', + normalize: [], + short: + "The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.", + type: 'long', + }, + 'process.io.max_bytes_per_process_exceeded': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-max-bytes-per-process-exceeded', + description: + 'If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.', + flat_name: 'process.io.max_bytes_per_process_exceeded', + level: 'extended', + name: 'io.max_bytes_per_process_exceeded', + normalize: [], + short: + 'If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.', + type: 'boolean', + }, + 'process.io.text': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-text', + description: + 'A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.', + flat_name: 'process.io.text', + level: 'extended', + name: 'io.text', + normalize: [], + short: 'A chunk of output or input sanitized to UTF-8.', + type: 'wildcard', + }, + 'process.io.total_bytes_captured': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-total-bytes-captured', + description: 'The total number of bytes captured in this event.', + flat_name: 'process.io.total_bytes_captured', + level: 'extended', + name: 'io.total_bytes_captured', + normalize: [], + short: 'The total number of bytes captured in this event.', + type: 'long', + }, + 'process.io.total_bytes_skipped': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-total-bytes-skipped', + description: + 'The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero', + flat_name: 'process.io.total_bytes_skipped', + level: 'extended', + name: 'io.total_bytes_skipped', + normalize: [], + short: + 'The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.', + type: 'long', + }, + 'process.io.type': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-type', + description: + "The type of object on which the IO action (read or write) was taken.\nCurrently only 'tty' is supported. Other types may be added in the future for 'file' and 'socket' support.", + flat_name: 'process.io.type', + ignore_above: 1024, + level: 'extended', + name: 'io.type', + normalize: [], + short: 'The type of object on which the IO action (read or write) was taken.', + type: 'keyword', + }, + 'process.name': { + dashed_name: 'process-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'process.name.text', name: 'text', type: 'match_only_text' }], + name: 'name', + normalize: [], + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.args': { + dashed_name: 'process-parent-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.parent.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.parent.args_count': { + dashed_name: 'process-parent-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.parent.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.parent.code_signature.digest_algorithm': { + dashed_name: 'process-parent-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'process.parent.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.exists': { + dashed_name: 'process-parent-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'process.parent.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'process.parent.code_signature.signing_id': { + dashed_name: 'process-parent-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'process.parent.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.status': { + dashed_name: 'process-parent-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'process.parent.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'process.parent.code_signature.subject_name': { + dashed_name: 'process-parent-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'process.parent.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'process.parent.code_signature.team_id': { + dashed_name: 'process-parent-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'process.parent.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.timestamp': { + dashed_name: 'process-parent-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'process.parent.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'process.parent.code_signature.trusted': { + dashed_name: 'process-parent-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'process.parent.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'process.parent.code_signature.valid': { + dashed_name: 'process-parent-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'process.parent.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'process.parent.command_line': { + dashed_name: 'process-parent-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.parent.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.parent.elf.architecture': { + dashed_name: 'process-parent-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'process.parent.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.byte_order': { + dashed_name: 'process-parent-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'process.parent.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'process.parent.elf.cpu_type': { + dashed_name: 'process-parent-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'process.parent.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.creation_date': { + dashed_name: 'process-parent-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'process.parent.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'process.parent.elf.exports': { + dashed_name: 'process-parent-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'process.parent.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'process.parent.elf.header.abi_version': { + dashed_name: 'process-parent-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'process.parent.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'process.parent.elf.header.class': { + dashed_name: 'process-parent-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'process.parent.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.header.data': { + dashed_name: 'process-parent-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'process.parent.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'process.parent.elf.header.entrypoint': { + dashed_name: 'process-parent-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'process.parent.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'process.parent.elf.header.object_version': { + dashed_name: 'process-parent-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'process.parent.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'process.parent.elf.header.os_abi': { + dashed_name: 'process-parent-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'process.parent.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'process.parent.elf.header.type': { + dashed_name: 'process-parent-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'process.parent.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.header.version': { + dashed_name: 'process-parent-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'process.parent.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'process.parent.elf.imports': { + dashed_name: 'process-parent-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'process.parent.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'process.parent.elf.sections': { + dashed_name: 'process-parent-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'process.parent.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'process.parent.elf.sections.chi2': { + dashed_name: 'process-parent-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'process.parent.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'process.parent.elf.sections.entropy': { + dashed_name: 'process-parent-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'process.parent.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'process.parent.elf.sections.flags': { + dashed_name: 'process-parent-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'process.parent.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'process.parent.elf.sections.name': { + dashed_name: 'process-parent-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'process.parent.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'process.parent.elf.sections.physical_offset': { + dashed_name: 'process-parent-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'process.parent.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'process.parent.elf.sections.physical_size': { + dashed_name: 'process-parent-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'process.parent.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'process.parent.elf.sections.type': { + dashed_name: 'process-parent-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'process.parent.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'process.parent.elf.sections.virtual_address': { + dashed_name: 'process-parent-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'process.parent.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'process.parent.elf.sections.virtual_size': { + dashed_name: 'process-parent-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'process.parent.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'process.parent.elf.segments': { + dashed_name: 'process-parent-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'process.parent.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'process.parent.elf.segments.sections': { + dashed_name: 'process-parent-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'process.parent.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'process.parent.elf.segments.type': { + dashed_name: 'process-parent-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'process.parent.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'process.parent.elf.shared_libraries': { + dashed_name: 'process-parent-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'process.parent.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'process.parent.elf.telfhash': { + dashed_name: 'process-parent-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'process.parent.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'process.parent.end': { + dashed_name: 'process-parent-end', + description: 'The time the process ended.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.end', + level: 'extended', + name: 'end', + normalize: [], + original_fieldset: 'process', + short: 'The time the process ended.', + type: 'date', + }, + 'process.parent.entity_id': { + dashed_name: 'process-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.parent.executable': { + dashed_name: 'process-parent-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.parent.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.parent.exit_code': { + dashed_name: 'process-parent-exit-code', + description: + 'The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).', + example: 137, + flat_name: 'process.parent.exit_code', + level: 'extended', + name: 'exit_code', + normalize: [], + original_fieldset: 'process', + short: 'The exit code of the process.', + type: 'long', + }, + 'process.parent.group.id': { + dashed_name: 'process-parent-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.group.name': { + dashed_name: 'process-parent-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.group_leader.entity_id': { + dashed_name: 'process-parent-group-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.parent.group_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.parent.group_leader.pid': { + dashed_name: 'process-parent-group-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.parent.group_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.parent.group_leader.start': { + dashed_name: 'process-parent-group-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.group_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.parent.hash.md5': { + dashed_name: 'process-parent-hash-md5', + description: 'MD5 hash.', + flat_name: 'process.parent.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha1': { + dashed_name: 'process-parent-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'process.parent.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha256': { + dashed_name: 'process-parent-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'process.parent.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha384': { + dashed_name: 'process-parent-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'process.parent.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha512': { + dashed_name: 'process-parent-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'process.parent.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'process.parent.hash.ssdeep': { + dashed_name: 'process-parent-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'process.parent.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'process.parent.hash.tlsh': { + dashed_name: 'process-parent-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'process.parent.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'process.parent.interactive': { + dashed_name: 'process-parent-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.parent.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.parent.name': { + dashed_name: 'process-parent-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.parent.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.pe.architecture': { + dashed_name: 'process-parent-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'process.parent.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'process.parent.pe.company': { + dashed_name: 'process-parent-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'process.parent.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.description': { + dashed_name: 'process-parent-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'process.parent.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.file_version': { + dashed_name: 'process-parent-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'process.parent.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.pe.imphash': { + dashed_name: 'process-parent-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'process.parent.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'process.parent.pe.original_file_name': { + dashed_name: 'process-parent-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'process.parent.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.pehash': { + dashed_name: 'process-parent-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'process.parent.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'process.parent.pe.product': { + dashed_name: 'process-parent-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'process.parent.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pgid': { + dashed_name: 'process-parent-pgid', + description: + 'Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.', + flat_name: 'process.parent.pgid', + format: 'string', + level: 'extended', + name: 'pgid', + normalize: [], + original_fieldset: 'process', + short: 'Deprecated identifier of the group of processes the process belongs to.', + type: 'long', + }, + 'process.parent.pid': { + dashed_name: 'process-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.parent.real_group.id': { + dashed_name: 'process-parent-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.real_group.name': { + dashed_name: 'process-parent-real-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.real_user.id': { + dashed_name: 'process-parent-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.real_user.name': { + dashed_name: 'process-parent-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.saved_group.id': { + dashed_name: 'process-parent-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.saved_group.name': { + dashed_name: 'process-parent-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.saved_user.id': { + dashed_name: 'process-parent-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.saved_user.name': { + dashed_name: 'process-parent-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.start': { + dashed_name: 'process-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.parent.supplemental_groups.id': { + dashed_name: 'process-parent-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.supplemental_groups.name': { + dashed_name: 'process-parent-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.parent.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.thread.id': { + dashed_name: 'process-parent-thread-id', + description: 'Thread ID.', + example: 4242, + flat_name: 'process.parent.thread.id', + format: 'string', + level: 'extended', + name: 'thread.id', + normalize: [], + original_fieldset: 'process', + short: 'Thread ID.', + type: 'long', + }, + 'process.parent.thread.name': { + dashed_name: 'process-parent-thread-name', + description: 'Thread name.', + example: 'thread-0', + flat_name: 'process.parent.thread.name', + ignore_above: 1024, + level: 'extended', + name: 'thread.name', + normalize: [], + original_fieldset: 'process', + short: 'Thread name.', + type: 'keyword', + }, + 'process.parent.title': { + dashed_name: 'process-parent-title', + description: + 'Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.', + flat_name: 'process.parent.title', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.title.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'title', + normalize: [], + original_fieldset: 'process', + short: 'Process title.', + type: 'keyword', + }, + 'process.parent.tty': { + dashed_name: 'process-parent-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.parent.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.parent.tty.char_device.major': { + dashed_name: 'process-parent-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.parent.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.parent.tty.char_device.minor': { + dashed_name: 'process-parent-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.parent.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.parent.uptime': { + dashed_name: 'process-parent-uptime', + description: 'Seconds the process has been up.', + example: 1325, + flat_name: 'process.parent.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + original_fieldset: 'process', + short: 'Seconds the process has been up.', + type: 'long', + }, + 'process.parent.user.id': { + dashed_name: 'process-parent-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.user.name': { + dashed_name: 'process-parent-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.working_directory': { + dashed_name: 'process-parent-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.parent.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.pe.architecture': { + dashed_name: 'process-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'process.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'process.pe.company': { + dashed_name: 'process-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'process.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.description': { + dashed_name: 'process-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'process.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.file_version': { + dashed_name: 'process-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'process.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'process.pe.imphash': { + dashed_name: 'process-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'process.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'process.pe.original_file_name': { + dashed_name: 'process-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'process.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.pehash': { + dashed_name: 'process-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'process.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'process.pe.product': { + dashed_name: 'process-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'process.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pgid': { + dashed_name: 'process-pgid', + description: + 'Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.', + flat_name: 'process.pgid', + format: 'string', + level: 'extended', + name: 'pgid', + normalize: [], + short: 'Deprecated identifier of the group of processes the process belongs to.', + type: 'long', + }, + 'process.pid': { + dashed_name: 'process-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + short: 'Process id.', + type: 'long', + }, + 'process.previous.args': { + dashed_name: 'process-previous-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.previous.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.previous.args_count': { + dashed_name: 'process-previous-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.previous.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.previous.executable': { + dashed_name: 'process-previous-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.previous.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.previous.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.real_group.id': { + dashed_name: 'process-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.real_group.name': { + dashed_name: 'process-real-group-name', + description: 'Name of the group.', + flat_name: 'process.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.real_user.id': { + dashed_name: 'process-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.real_user.name': { + dashed_name: 'process-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.saved_group.id': { + dashed_name: 'process-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.saved_group.name': { + dashed_name: 'process-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.saved_user.id': { + dashed_name: 'process-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.saved_user.name': { + dashed_name: 'process-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.args': { + dashed_name: 'process-session-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.session_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.session_leader.args_count': { + dashed_name: 'process-session-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.session_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.session_leader.command_line': { + dashed_name: 'process-session-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.session_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.session_leader.entity_id': { + dashed_name: 'process-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.executable': { + dashed_name: 'process-session-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.session_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.session_leader.group.id': { + dashed_name: 'process-session-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.group.name': { + dashed_name: 'process-session-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.interactive': { + dashed_name: 'process-session-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.session_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.session_leader.name': { + dashed_name: 'process-session-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.session_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.session_leader.parent.entity_id': { + dashed_name: 'process-session-leader-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.parent.pid': { + dashed_name: 'process-session-leader-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.parent.session_leader.entity_id': { + dashed_name: 'process-session-leader-parent-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.parent.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.parent.session_leader.pid': { + dashed_name: 'process-session-leader-parent-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.parent.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.parent.session_leader.start': { + dashed_name: 'process-session-leader-parent-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.parent.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.parent.start': { + dashed_name: 'process-session-leader-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.pid': { + dashed_name: 'process-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.real_group.id': { + dashed_name: 'process-session-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.real_group.name': { + dashed_name: 'process-session-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.real_user.id': { + dashed_name: 'process-session-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.real_user.name': { + dashed_name: 'process-session-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.same_as_process': { + dashed_name: 'process-session-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.session_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.session_leader.saved_group.id': { + dashed_name: 'process-session-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.saved_group.name': { + dashed_name: 'process-session-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.saved_user.id': { + dashed_name: 'process-session-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.saved_user.name': { + dashed_name: 'process-session-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.start': { + dashed_name: 'process-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.supplemental_groups.id': { + dashed_name: 'process-session-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.supplemental_groups.name': { + dashed_name: 'process-session-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.tty': { + dashed_name: 'process-session-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.session_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.session_leader.tty.char_device.major': { + dashed_name: 'process-session-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.session_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.session_leader.tty.char_device.minor': { + dashed_name: 'process-session-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.session_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.session_leader.user.id': { + dashed_name: 'process-session-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.user.name': { + dashed_name: 'process-session-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.working_directory': { + dashed_name: 'process-session-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.session_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.start': { + dashed_name: 'process-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.start', + level: 'extended', + name: 'start', + normalize: [], + short: 'The time the process started.', + type: 'date', + }, + 'process.supplemental_groups.id': { + dashed_name: 'process-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.supplemental_groups.name': { + dashed_name: 'process-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.thread.id': { + dashed_name: 'process-thread-id', + description: 'Thread ID.', + example: 4242, + flat_name: 'process.thread.id', + format: 'string', + level: 'extended', + name: 'thread.id', + normalize: [], + short: 'Thread ID.', + type: 'long', + }, + 'process.thread.name': { + dashed_name: 'process-thread-name', + description: 'Thread name.', + example: 'thread-0', + flat_name: 'process.thread.name', + ignore_above: 1024, + level: 'extended', + name: 'thread.name', + normalize: [], + short: 'Thread name.', + type: 'keyword', + }, + 'process.title': { + dashed_name: 'process-title', + description: + 'Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.', + flat_name: 'process.title', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.title.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'title', + normalize: [], + short: 'Process title.', + type: 'keyword', + }, + 'process.tty': { + dashed_name: 'process-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.tty', + level: 'extended', + name: 'tty', + normalize: [], + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.tty.char_device.major': { + dashed_name: 'process-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.tty.char_device.minor': { + dashed_name: 'process-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.tty.columns': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-tty-columns', + description: + "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'", + example: 80, + flat_name: 'process.tty.columns', + level: 'extended', + name: 'tty.columns', + normalize: [], + short: 'The number of character columns per line. e.g terminal width', + type: 'long', + }, + 'process.tty.rows': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-tty-rows', + description: + "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'", + example: 24, + flat_name: 'process.tty.rows', + level: 'extended', + name: 'tty.rows', + normalize: [], + short: 'The number of character rows in the terminal. e.g terminal height', + type: 'long', + }, + 'process.uptime': { + dashed_name: 'process-uptime', + description: 'Seconds the process has been up.', + example: 1325, + flat_name: 'process.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + short: 'Seconds the process has been up.', + type: 'long', + }, + 'process.user.id': { + dashed_name: 'process-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.user.name': { + dashed_name: 'process-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.working_directory': { + dashed_name: 'process-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + short: 'The working directory of the process.', + type: 'keyword', + }, + 'registry.data.bytes': { + dashed_name: 'registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'registry.data.strings': { + dashed_name: 'registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'registry.data.type': { + dashed_name: 'registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'registry.hive': { + dashed_name: 'registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'registry.key': { + dashed_name: 'registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'registry.path': { + dashed_name: 'registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'registry.value': { + dashed_name: 'registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + short: 'Name of the value written.', + type: 'keyword', + }, + 'related.hash': { + dashed_name: 'related-hash', + description: + "All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search).", + flat_name: 'related.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: ['array'], + short: 'All the hashes seen on your event.', + type: 'keyword', + }, + 'related.hosts': { + dashed_name: 'related-hosts', + description: + 'All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases.', + flat_name: 'related.hosts', + ignore_above: 1024, + level: 'extended', + name: 'hosts', + normalize: ['array'], + short: 'All the host identifiers seen on your event.', + type: 'keyword', + }, + 'related.ip': { + dashed_name: 'related-ip', + description: 'All of the IPs seen on your event.', + flat_name: 'related.ip', + level: 'extended', + name: 'ip', + normalize: ['array'], + short: 'All of the IPs seen on your event.', + type: 'ip', + }, + 'related.user': { + dashed_name: 'related-user', + description: 'All the user names or other user identifiers seen on the event.', + flat_name: 'related.user', + ignore_above: 1024, + level: 'extended', + name: 'user', + normalize: ['array'], + short: 'All the user names or other user identifiers seen on the event.', + type: 'keyword', + }, + 'rule.author': { + dashed_name: 'rule-author', + description: + 'Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.', + example: '["Star-Lord"]', + flat_name: 'rule.author', + ignore_above: 1024, + level: 'extended', + name: 'author', + normalize: ['array'], + short: 'Rule author', + type: 'keyword', + }, + 'rule.category': { + dashed_name: 'rule-category', + description: + 'A categorization value keyword used by the entity using the rule for detection of this event.', + example: 'Attempted Information Leak', + flat_name: 'rule.category', + ignore_above: 1024, + level: 'extended', + name: 'category', + normalize: [], + short: 'Rule category', + type: 'keyword', + }, + 'rule.description': { + dashed_name: 'rule-description', + description: 'The description of the rule generating the event.', + example: 'Block requests to public DNS over HTTPS / TLS protocols', + flat_name: 'rule.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Rule description', + type: 'keyword', + }, + 'rule.id': { + dashed_name: 'rule-id', + description: + 'A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.', + example: 101, + flat_name: 'rule.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Rule ID', + type: 'keyword', + }, + 'rule.license': { + dashed_name: 'rule-license', + description: + 'Name of the license under which the rule used to generate this event is made available.', + example: 'Apache 2.0', + flat_name: 'rule.license', + ignore_above: 1024, + level: 'extended', + name: 'license', + normalize: [], + short: 'Rule license', + type: 'keyword', + }, + 'rule.name': { + dashed_name: 'rule-name', + description: 'The name of the rule or signature generating the event.', + example: 'BLOCK_DNS_over_TLS', + flat_name: 'rule.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Rule name', + type: 'keyword', + }, + 'rule.reference': { + dashed_name: 'rule-reference', + description: + "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.", + example: 'https://en.wikipedia.org/wiki/DNS_over_TLS', + flat_name: 'rule.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Rule reference URL', + type: 'keyword', + }, + 'rule.ruleset': { + dashed_name: 'rule-ruleset', + description: + 'Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.', + example: 'Standard_Protocol_Filters', + flat_name: 'rule.ruleset', + ignore_above: 1024, + level: 'extended', + name: 'ruleset', + normalize: [], + short: 'Rule ruleset', + type: 'keyword', + }, + 'rule.uuid': { + dashed_name: 'rule-uuid', + description: + 'A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.', + example: 1100110011, + flat_name: 'rule.uuid', + ignore_above: 1024, + level: 'extended', + name: 'uuid', + normalize: [], + short: 'Rule UUID', + type: 'keyword', + }, + 'rule.version': { + dashed_name: 'rule-version', + description: 'The version / revision of the rule being used for analysis.', + example: 1.1, + flat_name: 'rule.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Rule version', + type: 'keyword', + }, + 'server.address': { + dashed_name: 'server-address', + description: + 'Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'server.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Server network address.', + type: 'keyword', + }, + 'server.as.number': { + dashed_name: 'server-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'server.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'server.as.organization.name': { + dashed_name: 'server-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'server.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'server.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'server.bytes': { + dashed_name: 'server-bytes', + description: 'Bytes sent from the server to the client.', + example: 184, + flat_name: 'server.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the server to the client.', + type: 'long', + }, + 'server.domain': { + dashed_name: 'server-domain', + description: + 'The domain name of the server system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'server.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the server.', + type: 'keyword', + }, + 'server.geo.city_name': { + dashed_name: 'server-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'server.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'server.geo.continent_code': { + dashed_name: 'server-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'server.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'server.geo.continent_name': { + dashed_name: 'server-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'server.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'server.geo.country_iso_code': { + dashed_name: 'server-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'server.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'server.geo.country_name': { + dashed_name: 'server-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'server.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'server.geo.location': { + dashed_name: 'server-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'server.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'server.geo.name': { + dashed_name: 'server-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'server.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'server.geo.postal_code': { + dashed_name: 'server-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'server.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'server.geo.region_iso_code': { + dashed_name: 'server-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'server.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'server.geo.region_name': { + dashed_name: 'server-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'server.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'server.geo.timezone': { + dashed_name: 'server-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'server.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'server.ip': { + dashed_name: 'server-ip', + description: 'IP address of the server (IPv4 or IPv6).', + flat_name: 'server.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the server.', + type: 'ip', + }, + 'server.mac': { + dashed_name: 'server-mac', + description: + 'MAC address of the server.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'server.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the server.', + type: 'keyword', + }, + 'server.nat.ip': { + dashed_name: 'server-nat-ip', + description: + 'Translated ip of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'server.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Server NAT ip', + type: 'ip', + }, + 'server.nat.port': { + dashed_name: 'server-nat-port', + description: + 'Translated port of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'server.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Server NAT port', + type: 'long', + }, + 'server.packets': { + dashed_name: 'server-packets', + description: 'Packets sent from the server to the client.', + example: 12, + flat_name: 'server.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the server to the client.', + type: 'long', + }, + 'server.port': { + dashed_name: 'server-port', + description: 'Port of the server.', + flat_name: 'server.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the server.', + type: 'long', + }, + 'server.registered_domain': { + dashed_name: 'server-registered-domain', + description: + 'The highest registered server domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'server.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered server domain, stripped of the subdomain.', + type: 'keyword', + }, + 'server.subdomain': { + dashed_name: 'server-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'server.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'server.top_level_domain': { + dashed_name: 'server-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'server.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'server.user.domain': { + dashed_name: 'server-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'server.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'server.user.email': { + dashed_name: 'server-user-email', + description: 'User email address.', + flat_name: 'server.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'server.user.full_name': { + dashed_name: 'server-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'server.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'server.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'server.user.group.domain': { + dashed_name: 'server-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'server.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'server.user.group.id': { + dashed_name: 'server-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'server.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'server.user.group.name': { + dashed_name: 'server-user-group-name', + description: 'Name of the group.', + flat_name: 'server.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'server.user.hash': { + dashed_name: 'server-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'server.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'server.user.id': { + dashed_name: 'server-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'server.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'server.user.name': { + dashed_name: 'server-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'server.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'server.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'server.user.roles': { + dashed_name: 'server-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'server.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'service.address': { + dashed_name: 'service-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Address of this service.', + type: 'keyword', + }, + 'service.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.ephemeral_id': { + dashed_name: 'service-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.id': { + dashed_name: 'service-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.name': { + dashed_name: 'service-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the service.', + type: 'keyword', + }, + 'service.node.name': { + dashed_name: 'service-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.node.role': { + dashed_name: 'service-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.node.roles': { + dashed_name: 'service-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.origin.address': { + dashed_name: 'service-origin-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.origin.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + original_fieldset: 'service', + short: 'Address of this service.', + type: 'keyword', + }, + 'service.origin.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-origin-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.origin.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + original_fieldset: 'service', + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.origin.ephemeral_id': { + dashed_name: 'service-origin-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.origin.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + original_fieldset: 'service', + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.origin.id': { + dashed_name: 'service-origin-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.origin.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'service', + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.origin.name': { + dashed_name: 'service-origin-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.origin.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service.', + type: 'keyword', + }, + 'service.origin.node.name': { + dashed_name: 'service-origin-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.origin.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.origin.node.role': { + dashed_name: 'service-origin-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.origin.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + original_fieldset: 'service', + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.origin.node.roles': { + dashed_name: 'service-origin-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.origin.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + original_fieldset: 'service', + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.origin.state': { + dashed_name: 'service-origin-state', + description: 'Current state of the service.', + flat_name: 'service.origin.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + original_fieldset: 'service', + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.origin.type': { + dashed_name: 'service-origin-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.origin.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + original_fieldset: 'service', + short: 'The type of the service.', + type: 'keyword', + }, + 'service.origin.version': { + dashed_name: 'service-origin-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.origin.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + original_fieldset: 'service', + short: 'Version of the service.', + type: 'keyword', + }, + 'service.state': { + dashed_name: 'service-state', + description: 'Current state of the service.', + flat_name: 'service.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.target.address': { + dashed_name: 'service-target-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.target.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + original_fieldset: 'service', + short: 'Address of this service.', + type: 'keyword', + }, + 'service.target.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-target-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.target.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + original_fieldset: 'service', + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.target.ephemeral_id': { + dashed_name: 'service-target-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.target.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + original_fieldset: 'service', + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.target.id': { + dashed_name: 'service-target-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.target.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'service', + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.target.name': { + dashed_name: 'service-target-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.target.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service.', + type: 'keyword', + }, + 'service.target.node.name': { + dashed_name: 'service-target-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.target.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.target.node.role': { + dashed_name: 'service-target-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.target.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + original_fieldset: 'service', + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.target.node.roles': { + dashed_name: 'service-target-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.target.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + original_fieldset: 'service', + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.target.state': { + dashed_name: 'service-target-state', + description: 'Current state of the service.', + flat_name: 'service.target.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + original_fieldset: 'service', + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.target.type': { + dashed_name: 'service-target-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.target.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + original_fieldset: 'service', + short: 'The type of the service.', + type: 'keyword', + }, + 'service.target.version': { + dashed_name: 'service-target-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.target.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + original_fieldset: 'service', + short: 'Version of the service.', + type: 'keyword', + }, + 'service.type': { + dashed_name: 'service-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'The type of the service.', + type: 'keyword', + }, + 'service.version': { + dashed_name: 'service-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Version of the service.', + type: 'keyword', + }, + 'source.address': { + dashed_name: 'source-address', + description: + 'Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'source.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Source network address.', + type: 'keyword', + }, + 'source.as.number': { + dashed_name: 'source-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'source.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'source.as.organization.name': { + dashed_name: 'source-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'source.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'source.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'source.bytes': { + dashed_name: 'source-bytes', + description: 'Bytes sent from the source to the destination.', + example: 184, + flat_name: 'source.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the source to the destination.', + type: 'long', + }, + 'source.domain': { + dashed_name: 'source-domain', + description: + 'The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'source.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the source.', + type: 'keyword', + }, + 'source.geo.city_name': { + dashed_name: 'source-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'source.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'source.geo.continent_code': { + dashed_name: 'source-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'source.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'source.geo.continent_name': { + dashed_name: 'source-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'source.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'source.geo.country_iso_code': { + dashed_name: 'source-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'source.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'source.geo.country_name': { + dashed_name: 'source-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'source.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'source.geo.location': { + dashed_name: 'source-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'source.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'source.geo.name': { + dashed_name: 'source-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'source.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'source.geo.postal_code': { + dashed_name: 'source-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'source.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'source.geo.region_iso_code': { + dashed_name: 'source-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'source.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'source.geo.region_name': { + dashed_name: 'source-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'source.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'source.geo.timezone': { + dashed_name: 'source-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'source.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'source.ip': { + dashed_name: 'source-ip', + description: 'IP address of the source (IPv4 or IPv6).', + flat_name: 'source.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the source.', + type: 'ip', + }, + 'source.mac': { + dashed_name: 'source-mac', + description: + 'MAC address of the source.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'source.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the source.', + type: 'keyword', + }, + 'source.nat.ip': { + dashed_name: 'source-nat-ip', + description: + 'Translated ip of source based NAT sessions (e.g. internal client to internet)\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'source.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Source NAT ip', + type: 'ip', + }, + 'source.nat.port': { + dashed_name: 'source-nat-port', + description: + 'Translated port of source based NAT sessions. (e.g. internal client to internet)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'source.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Source NAT port', + type: 'long', + }, + 'source.packets': { + dashed_name: 'source-packets', + description: 'Packets sent from the source to the destination.', + example: 12, + flat_name: 'source.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the source to the destination.', + type: 'long', + }, + 'source.port': { + dashed_name: 'source-port', + description: 'Port of the source.', + flat_name: 'source.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the source.', + type: 'long', + }, + 'source.registered_domain': { + dashed_name: 'source-registered-domain', + description: + 'The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'source.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered source domain, stripped of the subdomain.', + type: 'keyword', + }, + 'source.subdomain': { + dashed_name: 'source-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'source.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'source.top_level_domain': { + dashed_name: 'source-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'source.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'source.user.domain': { + dashed_name: 'source-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'source.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'source.user.email': { + dashed_name: 'source-user-email', + description: 'User email address.', + flat_name: 'source.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'source.user.full_name': { + dashed_name: 'source-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'source.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'source.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'source.user.group.domain': { + dashed_name: 'source-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'source.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'source.user.group.id': { + dashed_name: 'source-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'source.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'source.user.group.name': { + dashed_name: 'source-user-group-name', + description: 'Name of the group.', + flat_name: 'source.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'source.user.hash': { + dashed_name: 'source-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'source.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'source.user.id': { + dashed_name: 'source-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'source.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'source.user.name': { + dashed_name: 'source-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'source.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'source.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'source.user.roles': { + dashed_name: 'source-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'source.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'span.id': { + dashed_name: 'span-id', + description: + 'Unique identifier of the span within the scope of its trace.\nA span represents an operation within a transaction, such as a request to another service, or a database query.', + example: '3ff9a8981b7ccd5a', + flat_name: 'span.id', + ignore_above: 1024, + level: 'extended', + name: 'span.id', + normalize: [], + short: 'Unique identifier of the span within the scope of its trace.', + type: 'keyword', + }, + tags: { + dashed_name: 'tags', + description: 'List of keywords used to tag each event.', + example: '["production", "env2"]', + flat_name: 'tags', + ignore_above: 1024, + level: 'core', + name: 'tags', + normalize: ['array'], + short: 'List of keywords used to tag each event.', + type: 'keyword', + }, + 'threat.enrichments': { + dashed_name: 'threat-enrichments', + description: + 'A list of associated indicators objects enriching the event, and the context of that association/enrichment.', + flat_name: 'threat.enrichments', + level: 'extended', + name: 'enrichments', + normalize: ['array'], + short: 'List of objects containing indicators enriching the event.', + type: 'nested', + }, + 'threat.enrichments.indicator': { + dashed_name: 'threat-enrichments-indicator', + description: 'Object containing associated indicators enriching the event.', + flat_name: 'threat.enrichments.indicator', + level: 'extended', + name: 'enrichments.indicator', + normalize: [], + short: 'Object containing indicators enriching the event.', + type: 'object', + }, + 'threat.enrichments.indicator.as.number': { + dashed_name: 'threat-enrichments-indicator-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'threat.enrichments.indicator.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'threat.enrichments.indicator.as.organization.name': { + dashed_name: 'threat-enrichments-indicator-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'threat.enrichments.indicator.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.confidence': { + dashed_name: 'threat-enrichments-indicator-confidence', + description: + 'Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.', + example: 'Medium', + expected_values: ['Not Specified', 'None', 'Low', 'Medium', 'High'], + flat_name: 'threat.enrichments.indicator.confidence', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.confidence', + normalize: [], + short: 'Indicator confidence rating', + type: 'keyword', + }, + 'threat.enrichments.indicator.description': { + dashed_name: 'threat-enrichments-indicator-description', + description: 'Describes the type of action conducted by the threat.', + example: 'IP x.x.x.x was observed delivering the Angler EK.', + flat_name: 'threat.enrichments.indicator.description', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.description', + normalize: [], + short: 'Indicator description', + type: 'keyword', + }, + 'threat.enrichments.indicator.email.address': { + dashed_name: 'threat-enrichments-indicator-email-address', + description: 'Identifies a threat indicator as an email address (irrespective of direction).', + example: 'phish@example.com', + flat_name: 'threat.enrichments.indicator.email.address', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.email.address', + normalize: [], + short: 'Indicator email address', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.accessed': { + dashed_name: 'threat-enrichments-indicator-file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'threat.enrichments.indicator.file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file was accessed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.attributes': { + dashed_name: 'threat-enrichments-indicator-file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'threat.enrichments.indicator.file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + original_fieldset: 'file', + short: 'Array of file attributes.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.digest_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'threat.enrichments.indicator.file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.exists': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.code_signature.signing_id': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'threat.enrichments.indicator.file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.status': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'threat.enrichments.indicator.file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.subject_name': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'threat.enrichments.indicator.file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.team_id': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'threat.enrichments.indicator.file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.timestamp': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'threat.enrichments.indicator.file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.code_signature.trusted': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.code_signature.valid': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.created': { + dashed_name: 'threat-enrichments-indicator-file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'threat.enrichments.indicator.file.created', + level: 'extended', + name: 'created', + normalize: [], + original_fieldset: 'file', + short: 'File creation time.', + type: 'date', + }, + 'threat.enrichments.indicator.file.ctime': { + dashed_name: 'threat-enrichments-indicator-file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'threat.enrichments.indicator.file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.device': { + dashed_name: 'threat-enrichments-indicator-file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'threat.enrichments.indicator.file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + original_fieldset: 'file', + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.directory': { + dashed_name: 'threat-enrichments-indicator-file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'threat.enrichments.indicator.file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + original_fieldset: 'file', + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.drive_letter': { + dashed_name: 'threat-enrichments-indicator-file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'threat.enrichments.indicator.file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + original_fieldset: 'file', + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.architecture': { + dashed_name: 'threat-enrichments-indicator-file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'threat.enrichments.indicator.file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.byte_order': { + dashed_name: 'threat-enrichments-indicator-file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'threat.enrichments.indicator.file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.cpu_type': { + dashed_name: 'threat-enrichments-indicator-file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'threat.enrichments.indicator.file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.creation_date': { + dashed_name: 'threat-enrichments-indicator-file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'threat.enrichments.indicator.file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'threat.enrichments.indicator.file.elf.exports': { + dashed_name: 'threat-enrichments-indicator-file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'threat.enrichments.indicator.file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'threat.enrichments.indicator.file.elf.header.abi_version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'threat.enrichments.indicator.file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.class': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.data': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'threat.enrichments.indicator.file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.entrypoint': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.header.object_version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'threat.enrichments.indicator.file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.os_abi': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'threat.enrichments.indicator.file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'threat.enrichments.indicator.file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.imports': { + dashed_name: 'threat-enrichments-indicator-file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'threat.enrichments.indicator.file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'threat.enrichments.indicator.file.elf.sections': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'threat.enrichments.indicator.file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'threat.enrichments.indicator.file.elf.sections.chi2': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.entropy': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.flags': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.name': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.physical_offset': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.physical_size': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.virtual_address': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.virtual_size': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.segments': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'threat.enrichments.indicator.file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'threat.enrichments.indicator.file.elf.segments.sections': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'threat.enrichments.indicator.file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.segments.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'threat.enrichments.indicator.file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.shared_libraries': { + dashed_name: 'threat-enrichments-indicator-file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'threat.enrichments.indicator.file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.telfhash': { + dashed_name: 'threat-enrichments-indicator-file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.extension': { + dashed_name: 'threat-enrichments-indicator-file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.enrichments.indicator.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'file', + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.fork_name': { + dashed_name: 'threat-enrichments-indicator-file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'threat.enrichments.indicator.file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + original_fieldset: 'file', + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.gid': { + dashed_name: 'threat-enrichments-indicator-file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'threat.enrichments.indicator.file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + original_fieldset: 'file', + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.group': { + dashed_name: 'threat-enrichments-indicator-file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'threat.enrichments.indicator.file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + original_fieldset: 'file', + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.md5': { + dashed_name: 'threat-enrichments-indicator-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha1': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha256': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha384': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha512': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.ssdeep': { + dashed_name: 'threat-enrichments-indicator-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'threat.enrichments.indicator.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.tlsh': { + dashed_name: 'threat-enrichments-indicator-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'threat.enrichments.indicator.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.inode': { + dashed_name: 'threat-enrichments-indicator-file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'threat.enrichments.indicator.file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + original_fieldset: 'file', + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mime_type': { + dashed_name: 'threat-enrichments-indicator-file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'threat.enrichments.indicator.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + original_fieldset: 'file', + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mode': { + dashed_name: 'threat-enrichments-indicator-file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'threat.enrichments.indicator.file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + original_fieldset: 'file', + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mtime': { + dashed_name: 'threat-enrichments-indicator-file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'threat.enrichments.indicator.file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file content was modified.', + type: 'date', + }, + 'threat.enrichments.indicator.file.name': { + dashed_name: 'threat-enrichments-indicator-file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'threat.enrichments.indicator.file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'file', + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.owner': { + dashed_name: 'threat-enrichments-indicator-file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'threat.enrichments.indicator.file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + original_fieldset: 'file', + short: "File owner's username.", + type: 'keyword', + }, + 'threat.enrichments.indicator.file.path': { + dashed_name: 'threat-enrichments-indicator-file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'threat.enrichments.indicator.file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + original_fieldset: 'file', + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.architecture': { + dashed_name: 'threat-enrichments-indicator-file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'threat.enrichments.indicator.file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.company': { + dashed_name: 'threat-enrichments-indicator-file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'threat.enrichments.indicator.file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.description': { + dashed_name: 'threat-enrichments-indicator-file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'threat.enrichments.indicator.file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.file_version': { + dashed_name: 'threat-enrichments-indicator-file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'threat.enrichments.indicator.file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.imphash': { + dashed_name: 'threat-enrichments-indicator-file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'threat.enrichments.indicator.file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.original_file_name': { + dashed_name: 'threat-enrichments-indicator-file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'threat.enrichments.indicator.file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.pehash': { + dashed_name: 'threat-enrichments-indicator-file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'threat.enrichments.indicator.file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.product': { + dashed_name: 'threat-enrichments-indicator-file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'threat.enrichments.indicator.file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.size': { + dashed_name: 'threat-enrichments-indicator-file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'threat.enrichments.indicator.file.size', + level: 'extended', + name: 'size', + normalize: [], + original_fieldset: 'file', + short: 'File size in bytes.', + type: 'long', + }, + 'threat.enrichments.indicator.file.target_path': { + dashed_name: 'threat-enrichments-indicator-file-target-path', + description: 'Target path for symlinks.', + flat_name: 'threat.enrichments.indicator.file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + original_fieldset: 'file', + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.type': { + dashed_name: 'threat-enrichments-indicator-file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'threat.enrichments.indicator.file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'file', + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.uid': { + dashed_name: 'threat-enrichments-indicator-file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'threat.enrichments.indicator.file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + original_fieldset: 'file', + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.alternative_names': { + dashed_name: 'threat-enrichments-indicator-file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.enrichments.indicator.file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.common_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.country': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.locality': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.organization': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.state_or_province': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.not_after': { + dashed_name: 'threat-enrichments-indicator-file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.enrichments.indicator.file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.file.x509.not_before': { + dashed_name: 'threat-enrichments-indicator-file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.enrichments.indicator.file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.file.x509.public_key_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.enrichments.indicator.file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.public_key_curve': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.enrichments.indicator.file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.public_key_exponent': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.enrichments.indicator.file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.enrichments.indicator.file.x509.public_key_size': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.enrichments.indicator.file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.enrichments.indicator.file.x509.serial_number': { + dashed_name: 'threat-enrichments-indicator-file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.enrichments.indicator.file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.signature_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.enrichments.indicator.file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.common_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.enrichments.indicator.file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.country': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.enrichments.indicator.file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.enrichments.indicator.file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.locality': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.enrichments.indicator.file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.organization': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.enrichments.indicator.file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.enrichments.indicator.file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.state_or_province': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.version_number': { + dashed_name: 'threat-enrichments-indicator-file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.enrichments.indicator.file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.enrichments.indicator.first_seen': { + dashed_name: 'threat-enrichments-indicator-first-seen', + description: + 'The date and time when intelligence source first reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.first_seen', + level: 'extended', + name: 'enrichments.indicator.first_seen', + normalize: [], + short: 'Date/time indicator was first reported.', + type: 'date', + }, + 'threat.enrichments.indicator.geo.city_name': { + dashed_name: 'threat-enrichments-indicator-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'threat.enrichments.indicator.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.continent_code': { + dashed_name: 'threat-enrichments-indicator-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'threat.enrichments.indicator.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.continent_name': { + dashed_name: 'threat-enrichments-indicator-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'threat.enrichments.indicator.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.country_iso_code': { + dashed_name: 'threat-enrichments-indicator-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'threat.enrichments.indicator.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.country_name': { + dashed_name: 'threat-enrichments-indicator-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'threat.enrichments.indicator.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.location': { + dashed_name: 'threat-enrichments-indicator-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'threat.enrichments.indicator.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'threat.enrichments.indicator.geo.name': { + dashed_name: 'threat-enrichments-indicator-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'threat.enrichments.indicator.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.postal_code': { + dashed_name: 'threat-enrichments-indicator-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'threat.enrichments.indicator.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.region_iso_code': { + dashed_name: 'threat-enrichments-indicator-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'threat.enrichments.indicator.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.region_name': { + dashed_name: 'threat-enrichments-indicator-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'threat.enrichments.indicator.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.timezone': { + dashed_name: 'threat-enrichments-indicator-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'threat.enrichments.indicator.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'threat.enrichments.indicator.ip': { + dashed_name: 'threat-enrichments-indicator-ip', + description: 'Identifies a threat indicator as an IP address (irrespective of direction).', + example: '1.2.3.4', + flat_name: 'threat.enrichments.indicator.ip', + level: 'extended', + name: 'enrichments.indicator.ip', + normalize: [], + short: 'Indicator IP address', + type: 'ip', + }, + 'threat.enrichments.indicator.last_seen': { + dashed_name: 'threat-enrichments-indicator-last-seen', + description: + 'The date and time when intelligence source last reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.last_seen', + level: 'extended', + name: 'enrichments.indicator.last_seen', + normalize: [], + short: 'Date/time indicator was last reported.', + type: 'date', + }, + 'threat.enrichments.indicator.marking.tlp.version': { + dashed_name: 'threat-enrichments-indicator-marking-tlp-version', + description: 'Traffic Light Protocol version.', + example: 2, + flat_name: 'threat.enrichments.indicator.marking.tlp.version', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.marking.tlp.version', + normalize: [], + short: 'Indicator TLP version', + type: 'keyword', + }, + 'threat.enrichments.indicator.modified_at': { + dashed_name: 'threat-enrichments-indicator-modified-at', + description: + 'The date and time when intelligence source last modified information for this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.modified_at', + level: 'extended', + name: 'enrichments.indicator.modified_at', + normalize: [], + short: 'Date/time indicator was last updated.', + type: 'date', + }, + 'threat.enrichments.indicator.port': { + dashed_name: 'threat-enrichments-indicator-port', + description: 'Identifies a threat indicator as a port number (irrespective of direction).', + example: 443, + flat_name: 'threat.enrichments.indicator.port', + level: 'extended', + name: 'enrichments.indicator.port', + normalize: [], + short: 'Indicator port', + type: 'long', + }, + 'threat.enrichments.indicator.provider': { + dashed_name: 'threat-enrichments-indicator-provider', + description: "The name of the indicator's provider.", + example: 'lrz_urlhaus', + flat_name: 'threat.enrichments.indicator.provider', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.provider', + normalize: [], + short: 'Indicator provider', + type: 'keyword', + }, + 'threat.enrichments.indicator.reference': { + dashed_name: 'threat-enrichments-indicator-reference', + description: 'Reference URL linking to additional information about this indicator.', + example: 'https://system.example.com/indicator/0001234', + flat_name: 'threat.enrichments.indicator.reference', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.reference', + normalize: [], + short: 'Indicator reference URL', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.data.bytes': { + dashed_name: 'threat-enrichments-indicator-registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'threat.enrichments.indicator.registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + original_fieldset: 'registry', + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.data.strings': { + dashed_name: 'threat-enrichments-indicator-registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'threat.enrichments.indicator.registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + original_fieldset: 'registry', + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.registry.data.type': { + dashed_name: 'threat-enrichments-indicator-registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'threat.enrichments.indicator.registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + original_fieldset: 'registry', + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.hive': { + dashed_name: 'threat-enrichments-indicator-registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'threat.enrichments.indicator.registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + original_fieldset: 'registry', + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.key': { + dashed_name: 'threat-enrichments-indicator-registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'threat.enrichments.indicator.registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + original_fieldset: 'registry', + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.path': { + dashed_name: 'threat-enrichments-indicator-registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'threat.enrichments.indicator.registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + original_fieldset: 'registry', + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.value': { + dashed_name: 'threat-enrichments-indicator-registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'threat.enrichments.indicator.registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + original_fieldset: 'registry', + short: 'Name of the value written.', + type: 'keyword', + }, + 'threat.enrichments.indicator.scanner_stats': { + dashed_name: 'threat-enrichments-indicator-scanner-stats', + description: 'Count of AV/EDR vendors that successfully detected malicious file or URL.', + example: 4, + flat_name: 'threat.enrichments.indicator.scanner_stats', + level: 'extended', + name: 'enrichments.indicator.scanner_stats', + normalize: [], + short: 'Scanner statistics', + type: 'long', + }, + 'threat.enrichments.indicator.sightings': { + dashed_name: 'threat-enrichments-indicator-sightings', + description: 'Number of times this indicator was observed conducting threat activity.', + example: 20, + flat_name: 'threat.enrichments.indicator.sightings', + level: 'extended', + name: 'enrichments.indicator.sightings', + normalize: [], + short: 'Number of times indicator observed', + type: 'long', + }, + 'threat.enrichments.indicator.type': { + dashed_name: 'threat-enrichments-indicator-type', + description: 'Type of indicator as represented by Cyber Observable in STIX 2.0.', + example: 'ipv4-addr', + expected_values: [ + 'autonomous-system', + 'artifact', + 'directory', + 'domain-name', + 'email-addr', + 'file', + 'ipv4-addr', + 'ipv6-addr', + 'mac-addr', + 'mutex', + 'port', + 'process', + 'software', + 'url', + 'user-account', + 'windows-registry-key', + 'x509-certificate', + ], + flat_name: 'threat.enrichments.indicator.type', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.type', + normalize: [], + short: 'Type of indicator', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.domain': { + dashed_name: 'threat-enrichments-indicator-url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'threat.enrichments.indicator.url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'url', + short: 'Domain of the url.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.extension': { + dashed_name: 'threat-enrichments-indicator-url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.enrichments.indicator.url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'url', + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.fragment': { + dashed_name: 'threat-enrichments-indicator-url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'threat.enrichments.indicator.url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + original_fieldset: 'url', + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.full': { + dashed_name: 'threat-enrichments-indicator-url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'threat.enrichments.indicator.url.full', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.url.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'url', + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.original': { + dashed_name: 'threat-enrichments-indicator-url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'threat.enrichments.indicator.url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + original_fieldset: 'url', + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.password': { + dashed_name: 'threat-enrichments-indicator-url-password', + description: 'Password of the request.', + flat_name: 'threat.enrichments.indicator.url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + original_fieldset: 'url', + short: 'Password of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.path': { + dashed_name: 'threat-enrichments-indicator-url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'threat.enrichments.indicator.url.path', + level: 'extended', + name: 'path', + normalize: [], + original_fieldset: 'url', + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.port': { + dashed_name: 'threat-enrichments-indicator-url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'threat.enrichments.indicator.url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + original_fieldset: 'url', + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'threat.enrichments.indicator.url.query': { + dashed_name: 'threat-enrichments-indicator-url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'threat.enrichments.indicator.url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + original_fieldset: 'url', + short: 'Query string of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.registered_domain': { + dashed_name: 'threat-enrichments-indicator-url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'threat.enrichments.indicator.url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + original_fieldset: 'url', + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.scheme': { + dashed_name: 'threat-enrichments-indicator-url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'threat.enrichments.indicator.url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + original_fieldset: 'url', + short: 'Scheme of the url.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.subdomain': { + dashed_name: 'threat-enrichments-indicator-url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'threat.enrichments.indicator.url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + original_fieldset: 'url', + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.top_level_domain': { + dashed_name: 'threat-enrichments-indicator-url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'threat.enrichments.indicator.url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + original_fieldset: 'url', + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.username': { + dashed_name: 'threat-enrichments-indicator-url-username', + description: 'Username of the request.', + flat_name: 'threat.enrichments.indicator.url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + original_fieldset: 'url', + short: 'Username of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.alternative_names': { + dashed_name: 'threat-enrichments-indicator-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.enrichments.indicator.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.common_name': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.country': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.enrichments.indicator.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.locality': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.enrichments.indicator.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.organization': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.enrichments.indicator.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.enrichments.indicator.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.state_or_province': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.not_after': { + dashed_name: 'threat-enrichments-indicator-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.enrichments.indicator.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.x509.not_before': { + dashed_name: 'threat-enrichments-indicator-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.enrichments.indicator.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.x509.public_key_algorithm': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.enrichments.indicator.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.public_key_curve': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.enrichments.indicator.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.public_key_exponent': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.enrichments.indicator.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.enrichments.indicator.x509.public_key_size': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.enrichments.indicator.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.enrichments.indicator.x509.serial_number': { + dashed_name: 'threat-enrichments-indicator-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.enrichments.indicator.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.signature_algorithm': { + dashed_name: 'threat-enrichments-indicator-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.enrichments.indicator.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.common_name': { + dashed_name: 'threat-enrichments-indicator-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.enrichments.indicator.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.country': { + dashed_name: 'threat-enrichments-indicator-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.enrichments.indicator.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.enrichments.indicator.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.locality': { + dashed_name: 'threat-enrichments-indicator-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.enrichments.indicator.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.organization': { + dashed_name: 'threat-enrichments-indicator-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.enrichments.indicator.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.enrichments.indicator.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.state_or_province': { + dashed_name: 'threat-enrichments-indicator-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.version_number': { + dashed_name: 'threat-enrichments-indicator-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.enrichments.indicator.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.enrichments.matched.atomic': { + dashed_name: 'threat-enrichments-matched-atomic', + description: + 'Identifies the atomic indicator value that matched a local environment endpoint or network event.', + example: 'bad-domain.com', + flat_name: 'threat.enrichments.matched.atomic', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.atomic', + normalize: [], + short: 'Matched indicator value', + type: 'keyword', + }, + 'threat.enrichments.matched.field': { + dashed_name: 'threat-enrichments-matched-field', + description: + 'Identifies the field of the atomic indicator that matched a local environment endpoint or network event.', + example: 'file.hash.sha256', + flat_name: 'threat.enrichments.matched.field', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.field', + normalize: [], + short: 'Matched indicator field', + type: 'keyword', + }, + 'threat.enrichments.matched.id': { + dashed_name: 'threat-enrichments-matched-id', + description: 'Identifies the _id of the indicator document enriching the event.', + example: 'ff93aee5-86a1-4a61-b0e6-0cdc313d01b5', + flat_name: 'threat.enrichments.matched.id', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.id', + normalize: [], + short: 'Matched indicator identifier', + type: 'keyword', + }, + 'threat.enrichments.matched.index': { + dashed_name: 'threat-enrichments-matched-index', + description: 'Identifies the _index of the indicator document enriching the event.', + example: 'filebeat-8.0.0-2021.05.23-000011', + flat_name: 'threat.enrichments.matched.index', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.index', + normalize: [], + short: 'Matched indicator index', + type: 'keyword', + }, + 'threat.enrichments.matched.occurred': { + dashed_name: 'threat-enrichments-matched-occurred', + description: 'Indicates when the indicator match was generated', + example: '2021-10-05T17:00:58.326Z', + flat_name: 'threat.enrichments.matched.occurred', + level: 'extended', + name: 'enrichments.matched.occurred', + normalize: [], + short: 'Date of match', + type: 'date', + }, + 'threat.enrichments.matched.type': { + dashed_name: 'threat-enrichments-matched-type', + description: + 'Identifies the type of match that caused the event to be enriched with the given indicator', + example: 'indicator_match_rule', + flat_name: 'threat.enrichments.matched.type', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.type', + normalize: [], + short: 'Type of indicator match', + type: 'keyword', + }, + 'threat.feed.dashboard_id': { + dashed_name: 'threat-feed-dashboard-id', + description: + 'The saved object ID of the dashboard belonging to the threat feed for displaying dashboard links to threat feeds in Kibana.', + example: '5ba16340-72e6-11eb-a3e3-b3cc7c78a70f', + flat_name: 'threat.feed.dashboard_id', + ignore_above: 1024, + level: 'extended', + name: 'feed.dashboard_id', + normalize: [], + short: 'Feed dashboard ID.', + type: 'keyword', + }, + 'threat.feed.description': { + dashed_name: 'threat-feed-description', + description: 'Description of the threat feed in a UI friendly format.', + example: 'Threat feed from the AlienVault Open Threat eXchange network.', + flat_name: 'threat.feed.description', + ignore_above: 1024, + level: 'extended', + name: 'feed.description', + normalize: [], + short: 'Description of the threat feed.', + type: 'keyword', + }, + 'threat.feed.name': { + dashed_name: 'threat-feed-name', + description: 'The name of the threat feed in UI friendly format.', + example: 'AlienVault OTX', + flat_name: 'threat.feed.name', + ignore_above: 1024, + level: 'extended', + name: 'feed.name', + normalize: [], + short: 'Name of the threat feed.', + type: 'keyword', + }, + 'threat.feed.reference': { + dashed_name: 'threat-feed-reference', + description: 'Reference information for the threat feed in a UI friendly format.', + example: 'https://otx.alienvault.com', + flat_name: 'threat.feed.reference', + ignore_above: 1024, + level: 'extended', + name: 'feed.reference', + normalize: [], + short: 'Reference for the threat feed.', + type: 'keyword', + }, + 'threat.framework': { + dashed_name: 'threat-framework', + description: + 'Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.', + example: 'MITRE ATT&CK', + flat_name: 'threat.framework', + ignore_above: 1024, + level: 'extended', + name: 'framework', + normalize: [], + short: 'Threat classification framework.', + type: 'keyword', + }, + 'threat.group.alias': { + dashed_name: 'threat-group-alias', + description: + 'The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).', + example: '[ "Magecart Group 6" ]', + flat_name: 'threat.group.alias', + ignore_above: 1024, + level: 'extended', + name: 'group.alias', + normalize: ['array'], + short: 'Alias of the group.', + type: 'keyword', + }, + 'threat.group.id': { + dashed_name: 'threat-group-id', + description: + 'The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.', + example: 'G0037', + flat_name: 'threat.group.id', + ignore_above: 1024, + level: 'extended', + name: 'group.id', + normalize: [], + short: 'ID of the group.', + type: 'keyword', + }, + 'threat.group.name': { + dashed_name: 'threat-group-name', + description: + 'The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.', + example: 'FIN6', + flat_name: 'threat.group.name', + ignore_above: 1024, + level: 'extended', + name: 'group.name', + normalize: [], + short: 'Name of the group.', + type: 'keyword', + }, + 'threat.group.reference': { + dashed_name: 'threat-group-reference', + description: + 'The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.', + example: 'https://attack.mitre.org/groups/G0037/', + flat_name: 'threat.group.reference', + ignore_above: 1024, + level: 'extended', + name: 'group.reference', + normalize: [], + short: 'Reference URL of the group.', + type: 'keyword', + }, + 'threat.indicator.as.number': { + dashed_name: 'threat-indicator-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'threat.indicator.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'threat.indicator.as.organization.name': { + dashed_name: 'threat-indicator-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'threat.indicator.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'threat.indicator.confidence': { + dashed_name: 'threat-indicator-confidence', + description: + 'Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.', + example: 'Medium', + expected_values: ['Not Specified', 'None', 'Low', 'Medium', 'High'], + flat_name: 'threat.indicator.confidence', + ignore_above: 1024, + level: 'extended', + name: 'indicator.confidence', + normalize: [], + short: 'Indicator confidence rating', + type: 'keyword', + }, + 'threat.indicator.description': { + dashed_name: 'threat-indicator-description', + description: 'Describes the type of action conducted by the threat.', + example: 'IP x.x.x.x was observed delivering the Angler EK.', + flat_name: 'threat.indicator.description', + ignore_above: 1024, + level: 'extended', + name: 'indicator.description', + normalize: [], + short: 'Indicator description', + type: 'keyword', + }, + 'threat.indicator.email.address': { + dashed_name: 'threat-indicator-email-address', + description: 'Identifies a threat indicator as an email address (irrespective of direction).', + example: 'phish@example.com', + flat_name: 'threat.indicator.email.address', + ignore_above: 1024, + level: 'extended', + name: 'indicator.email.address', + normalize: [], + short: 'Indicator email address', + type: 'keyword', + }, + 'threat.indicator.file.accessed': { + dashed_name: 'threat-indicator-file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'threat.indicator.file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file was accessed.', + type: 'date', + }, + 'threat.indicator.file.attributes': { + dashed_name: 'threat-indicator-file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'threat.indicator.file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + original_fieldset: 'file', + short: 'Array of file attributes.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.digest_algorithm': { + dashed_name: 'threat-indicator-file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'threat.indicator.file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.exists': { + dashed_name: 'threat-indicator-file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'threat.indicator.file.code_signature.signing_id': { + dashed_name: 'threat-indicator-file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'threat.indicator.file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.status': { + dashed_name: 'threat-indicator-file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'threat.indicator.file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.subject_name': { + dashed_name: 'threat-indicator-file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'threat.indicator.file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.team_id': { + dashed_name: 'threat-indicator-file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'threat.indicator.file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.timestamp': { + dashed_name: 'threat-indicator-file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'threat.indicator.file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'threat.indicator.file.code_signature.trusted': { + dashed_name: 'threat-indicator-file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'threat.indicator.file.code_signature.valid': { + dashed_name: 'threat-indicator-file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'threat.indicator.file.created': { + dashed_name: 'threat-indicator-file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'threat.indicator.file.created', + level: 'extended', + name: 'created', + normalize: [], + original_fieldset: 'file', + short: 'File creation time.', + type: 'date', + }, + 'threat.indicator.file.ctime': { + dashed_name: 'threat-indicator-file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'threat.indicator.file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'threat.indicator.file.device': { + dashed_name: 'threat-indicator-file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'threat.indicator.file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + original_fieldset: 'file', + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'threat.indicator.file.directory': { + dashed_name: 'threat-indicator-file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'threat.indicator.file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + original_fieldset: 'file', + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'threat.indicator.file.drive_letter': { + dashed_name: 'threat-indicator-file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'threat.indicator.file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + original_fieldset: 'file', + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'threat.indicator.file.elf.architecture': { + dashed_name: 'threat-indicator-file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'threat.indicator.file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.byte_order': { + dashed_name: 'threat-indicator-file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'threat.indicator.file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.cpu_type': { + dashed_name: 'threat-indicator-file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'threat.indicator.file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.creation_date': { + dashed_name: 'threat-indicator-file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'threat.indicator.file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'threat.indicator.file.elf.exports': { + dashed_name: 'threat-indicator-file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'threat.indicator.file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'threat.indicator.file.elf.header.abi_version': { + dashed_name: 'threat-indicator-file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'threat.indicator.file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.class': { + dashed_name: 'threat-indicator-file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.data': { + dashed_name: 'threat-indicator-file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'threat.indicator.file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.entrypoint': { + dashed_name: 'threat-indicator-file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'threat.indicator.file.elf.header.object_version': { + dashed_name: 'threat-indicator-file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'threat.indicator.file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.os_abi': { + dashed_name: 'threat-indicator-file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'threat.indicator.file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.type': { + dashed_name: 'threat-indicator-file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.version': { + dashed_name: 'threat-indicator-file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'threat.indicator.file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'threat.indicator.file.elf.imports': { + dashed_name: 'threat-indicator-file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'threat.indicator.file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'threat.indicator.file.elf.sections': { + dashed_name: 'threat-indicator-file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'threat.indicator.file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'threat.indicator.file.elf.sections.chi2': { + dashed_name: 'threat-indicator-file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'threat.indicator.file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.entropy': { + dashed_name: 'threat-indicator-file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'threat.indicator.file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.flags': { + dashed_name: 'threat-indicator-file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'threat.indicator.file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.name': { + dashed_name: 'threat-indicator-file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'threat.indicator.file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.physical_offset': { + dashed_name: 'threat-indicator-file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'threat.indicator.file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.physical_size': { + dashed_name: 'threat-indicator-file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'threat.indicator.file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.type': { + dashed_name: 'threat-indicator-file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'threat.indicator.file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.virtual_address': { + dashed_name: 'threat-indicator-file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'threat.indicator.file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.virtual_size': { + dashed_name: 'threat-indicator-file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'threat.indicator.file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'threat.indicator.file.elf.segments': { + dashed_name: 'threat-indicator-file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'threat.indicator.file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'threat.indicator.file.elf.segments.sections': { + dashed_name: 'threat-indicator-file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'threat.indicator.file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'threat.indicator.file.elf.segments.type': { + dashed_name: 'threat-indicator-file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'threat.indicator.file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'threat.indicator.file.elf.shared_libraries': { + dashed_name: 'threat-indicator-file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'threat.indicator.file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'threat.indicator.file.elf.telfhash': { + dashed_name: 'threat-indicator-file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'threat.indicator.file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.extension': { + dashed_name: 'threat-indicator-file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.indicator.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'file', + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'threat.indicator.file.fork_name': { + dashed_name: 'threat-indicator-file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'threat.indicator.file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + original_fieldset: 'file', + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'threat.indicator.file.gid': { + dashed_name: 'threat-indicator-file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'threat.indicator.file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + original_fieldset: 'file', + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'threat.indicator.file.group': { + dashed_name: 'threat-indicator-file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'threat.indicator.file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + original_fieldset: 'file', + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'threat.indicator.file.hash.md5': { + dashed_name: 'threat-indicator-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'threat.indicator.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha1': { + dashed_name: 'threat-indicator-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'threat.indicator.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha256': { + dashed_name: 'threat-indicator-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'threat.indicator.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha384': { + dashed_name: 'threat-indicator-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'threat.indicator.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha512': { + dashed_name: 'threat-indicator-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'threat.indicator.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.ssdeep': { + dashed_name: 'threat-indicator-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'threat.indicator.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.tlsh': { + dashed_name: 'threat-indicator-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'threat.indicator.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'threat.indicator.file.inode': { + dashed_name: 'threat-indicator-file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'threat.indicator.file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + original_fieldset: 'file', + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'threat.indicator.file.mime_type': { + dashed_name: 'threat-indicator-file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'threat.indicator.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + original_fieldset: 'file', + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'threat.indicator.file.mode': { + dashed_name: 'threat-indicator-file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'threat.indicator.file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + original_fieldset: 'file', + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'threat.indicator.file.mtime': { + dashed_name: 'threat-indicator-file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'threat.indicator.file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file content was modified.', + type: 'date', + }, + 'threat.indicator.file.name': { + dashed_name: 'threat-indicator-file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'threat.indicator.file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'file', + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'threat.indicator.file.owner': { + dashed_name: 'threat-indicator-file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'threat.indicator.file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + original_fieldset: 'file', + short: "File owner's username.", + type: 'keyword', + }, + 'threat.indicator.file.path': { + dashed_name: 'threat-indicator-file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'threat.indicator.file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + original_fieldset: 'file', + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'threat.indicator.file.pe.architecture': { + dashed_name: 'threat-indicator-file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'threat.indicator.file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'threat.indicator.file.pe.company': { + dashed_name: 'threat-indicator-file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'threat.indicator.file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.description': { + dashed_name: 'threat-indicator-file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'threat.indicator.file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.file_version': { + dashed_name: 'threat-indicator-file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'threat.indicator.file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'threat.indicator.file.pe.imphash': { + dashed_name: 'threat-indicator-file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'threat.indicator.file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'threat.indicator.file.pe.original_file_name': { + dashed_name: 'threat-indicator-file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'threat.indicator.file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.pehash': { + dashed_name: 'threat-indicator-file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'threat.indicator.file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'threat.indicator.file.pe.product': { + dashed_name: 'threat-indicator-file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'threat.indicator.file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.size': { + dashed_name: 'threat-indicator-file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'threat.indicator.file.size', + level: 'extended', + name: 'size', + normalize: [], + original_fieldset: 'file', + short: 'File size in bytes.', + type: 'long', + }, + 'threat.indicator.file.target_path': { + dashed_name: 'threat-indicator-file-target-path', + description: 'Target path for symlinks.', + flat_name: 'threat.indicator.file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + original_fieldset: 'file', + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'threat.indicator.file.type': { + dashed_name: 'threat-indicator-file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'threat.indicator.file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'file', + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'threat.indicator.file.uid': { + dashed_name: 'threat-indicator-file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'threat.indicator.file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + original_fieldset: 'file', + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'threat.indicator.file.x509.alternative_names': { + dashed_name: 'threat-indicator-file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.indicator.file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.common_name': { + dashed_name: 'threat-indicator-file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.country': { + dashed_name: 'threat-indicator-file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.indicator.file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.distinguished_name': { + dashed_name: 'threat-indicator-file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.locality': { + dashed_name: 'threat-indicator-file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.indicator.file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.organization': { + dashed_name: 'threat-indicator-file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.indicator.file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.organizational_unit': { + dashed_name: 'threat-indicator-file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.indicator.file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.state_or_province': { + dashed_name: 'threat-indicator-file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.file.x509.not_after': { + dashed_name: 'threat-indicator-file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.indicator.file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.indicator.file.x509.not_before': { + dashed_name: 'threat-indicator-file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.indicator.file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.indicator.file.x509.public_key_algorithm': { + dashed_name: 'threat-indicator-file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.indicator.file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.indicator.file.x509.public_key_curve': { + dashed_name: 'threat-indicator-file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.indicator.file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.indicator.file.x509.public_key_exponent': { + dashed_name: 'threat-indicator-file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.indicator.file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.indicator.file.x509.public_key_size': { + dashed_name: 'threat-indicator-file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.indicator.file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.indicator.file.x509.serial_number': { + dashed_name: 'threat-indicator-file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.indicator.file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.signature_algorithm': { + dashed_name: 'threat-indicator-file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.indicator.file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.common_name': { + dashed_name: 'threat-indicator-file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.indicator.file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.country': { + dashed_name: 'threat-indicator-file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.indicator.file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.distinguished_name': { + dashed_name: 'threat-indicator-file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.indicator.file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.locality': { + dashed_name: 'threat-indicator-file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.indicator.file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.organization': { + dashed_name: 'threat-indicator-file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.indicator.file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.organizational_unit': { + dashed_name: 'threat-indicator-file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.indicator.file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.state_or_province': { + dashed_name: 'threat-indicator-file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.file.x509.version_number': { + dashed_name: 'threat-indicator-file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.indicator.file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.indicator.first_seen': { + dashed_name: 'threat-indicator-first-seen', + description: + 'The date and time when intelligence source first reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.first_seen', + level: 'extended', + name: 'indicator.first_seen', + normalize: [], + short: 'Date/time indicator was first reported.', + type: 'date', + }, + 'threat.indicator.geo.city_name': { + dashed_name: 'threat-indicator-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'threat.indicator.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'threat.indicator.geo.continent_code': { + dashed_name: 'threat-indicator-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'threat.indicator.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'threat.indicator.geo.continent_name': { + dashed_name: 'threat-indicator-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'threat.indicator.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'threat.indicator.geo.country_iso_code': { + dashed_name: 'threat-indicator-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'threat.indicator.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'threat.indicator.geo.country_name': { + dashed_name: 'threat-indicator-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'threat.indicator.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'threat.indicator.geo.location': { + dashed_name: 'threat-indicator-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'threat.indicator.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'threat.indicator.geo.name': { + dashed_name: 'threat-indicator-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'threat.indicator.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'threat.indicator.geo.postal_code': { + dashed_name: 'threat-indicator-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'threat.indicator.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'threat.indicator.geo.region_iso_code': { + dashed_name: 'threat-indicator-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'threat.indicator.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'threat.indicator.geo.region_name': { + dashed_name: 'threat-indicator-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'threat.indicator.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'threat.indicator.geo.timezone': { + dashed_name: 'threat-indicator-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'threat.indicator.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'threat.indicator.ip': { + dashed_name: 'threat-indicator-ip', + description: 'Identifies a threat indicator as an IP address (irrespective of direction).', + example: '1.2.3.4', + flat_name: 'threat.indicator.ip', + level: 'extended', + name: 'indicator.ip', + normalize: [], + short: 'Indicator IP address', + type: 'ip', + }, + 'threat.indicator.last_seen': { + dashed_name: 'threat-indicator-last-seen', + description: + 'The date and time when intelligence source last reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.last_seen', + level: 'extended', + name: 'indicator.last_seen', + normalize: [], + short: 'Date/time indicator was last reported.', + type: 'date', + }, + 'threat.indicator.marking.tlp': { + dashed_name: 'threat-indicator-marking-tlp', + description: 'Traffic Light Protocol sharing markings.', + example: 'CLEAR', + expected_values: ['WHITE', 'CLEAR', 'GREEN', 'AMBER', 'AMBER+STRICT', 'RED'], + flat_name: 'threat.indicator.marking.tlp', + ignore_above: 1024, + level: 'extended', + name: 'indicator.marking.tlp', + normalize: [], + short: 'Indicator TLP marking', + type: 'keyword', + }, + 'threat.indicator.modified_at': { + dashed_name: 'threat-indicator-modified-at', + description: + 'The date and time when intelligence source last modified information for this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.modified_at', + level: 'extended', + name: 'indicator.modified_at', + normalize: [], + short: 'Date/time indicator was last updated.', + type: 'date', + }, + 'threat.indicator.port': { + dashed_name: 'threat-indicator-port', + description: 'Identifies a threat indicator as a port number (irrespective of direction).', + example: 443, + flat_name: 'threat.indicator.port', + level: 'extended', + name: 'indicator.port', + normalize: [], + short: 'Indicator port', + type: 'long', + }, + 'threat.indicator.provider': { + dashed_name: 'threat-indicator-provider', + description: "The name of the indicator's provider.", + example: 'lrz_urlhaus', + flat_name: 'threat.indicator.provider', + ignore_above: 1024, + level: 'extended', + name: 'indicator.provider', + normalize: [], + short: 'Indicator provider', + type: 'keyword', + }, + 'threat.indicator.reference': { + dashed_name: 'threat-indicator-reference', + description: 'Reference URL linking to additional information about this indicator.', + example: 'https://system.example.com/indicator/0001234', + flat_name: 'threat.indicator.reference', + ignore_above: 1024, + level: 'extended', + name: 'indicator.reference', + normalize: [], + short: 'Indicator reference URL', + type: 'keyword', + }, + 'threat.indicator.registry.data.bytes': { + dashed_name: 'threat-indicator-registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'threat.indicator.registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + original_fieldset: 'registry', + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'threat.indicator.registry.data.strings': { + dashed_name: 'threat-indicator-registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'threat.indicator.registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + original_fieldset: 'registry', + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'threat.indicator.registry.data.type': { + dashed_name: 'threat-indicator-registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'threat.indicator.registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + original_fieldset: 'registry', + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'threat.indicator.registry.hive': { + dashed_name: 'threat-indicator-registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'threat.indicator.registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + original_fieldset: 'registry', + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'threat.indicator.registry.key': { + dashed_name: 'threat-indicator-registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'threat.indicator.registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + original_fieldset: 'registry', + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'threat.indicator.registry.path': { + dashed_name: 'threat-indicator-registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'threat.indicator.registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + original_fieldset: 'registry', + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'threat.indicator.registry.value': { + dashed_name: 'threat-indicator-registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'threat.indicator.registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + original_fieldset: 'registry', + short: 'Name of the value written.', + type: 'keyword', + }, + 'threat.indicator.scanner_stats': { + dashed_name: 'threat-indicator-scanner-stats', + description: 'Count of AV/EDR vendors that successfully detected malicious file or URL.', + example: 4, + flat_name: 'threat.indicator.scanner_stats', + level: 'extended', + name: 'indicator.scanner_stats', + normalize: [], + short: 'Scanner statistics', + type: 'long', + }, + 'threat.indicator.sightings': { + dashed_name: 'threat-indicator-sightings', + description: 'Number of times this indicator was observed conducting threat activity.', + example: 20, + flat_name: 'threat.indicator.sightings', + level: 'extended', + name: 'indicator.sightings', + normalize: [], + short: 'Number of times indicator observed', + type: 'long', + }, + 'threat.indicator.type': { + dashed_name: 'threat-indicator-type', + description: 'Type of indicator as represented by Cyber Observable in STIX 2.0.', + example: 'ipv4-addr', + expected_values: [ + 'autonomous-system', + 'artifact', + 'directory', + 'domain-name', + 'email-addr', + 'file', + 'ipv4-addr', + 'ipv6-addr', + 'mac-addr', + 'mutex', + 'port', + 'process', + 'software', + 'url', + 'user-account', + 'windows-registry-key', + 'x509-certificate', + ], + flat_name: 'threat.indicator.type', + ignore_above: 1024, + level: 'extended', + name: 'indicator.type', + normalize: [], + short: 'Type of indicator', + type: 'keyword', + }, + 'threat.indicator.url.domain': { + dashed_name: 'threat-indicator-url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'threat.indicator.url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'url', + short: 'Domain of the url.', + type: 'keyword', + }, + 'threat.indicator.url.extension': { + dashed_name: 'threat-indicator-url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.indicator.url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'url', + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'threat.indicator.url.fragment': { + dashed_name: 'threat-indicator-url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'threat.indicator.url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + original_fieldset: 'url', + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'threat.indicator.url.full': { + dashed_name: 'threat-indicator-url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'threat.indicator.url.full', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.url.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'url', + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'threat.indicator.url.original': { + dashed_name: 'threat-indicator-url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'threat.indicator.url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + original_fieldset: 'url', + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'threat.indicator.url.password': { + dashed_name: 'threat-indicator-url-password', + description: 'Password of the request.', + flat_name: 'threat.indicator.url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + original_fieldset: 'url', + short: 'Password of the request.', + type: 'keyword', + }, + 'threat.indicator.url.path': { + dashed_name: 'threat-indicator-url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'threat.indicator.url.path', + level: 'extended', + name: 'path', + normalize: [], + original_fieldset: 'url', + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'threat.indicator.url.port': { + dashed_name: 'threat-indicator-url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'threat.indicator.url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + original_fieldset: 'url', + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'threat.indicator.url.query': { + dashed_name: 'threat-indicator-url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'threat.indicator.url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + original_fieldset: 'url', + short: 'Query string of the request.', + type: 'keyword', + }, + 'threat.indicator.url.registered_domain': { + dashed_name: 'threat-indicator-url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'threat.indicator.url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + original_fieldset: 'url', + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'threat.indicator.url.scheme': { + dashed_name: 'threat-indicator-url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'threat.indicator.url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + original_fieldset: 'url', + short: 'Scheme of the url.', + type: 'keyword', + }, + 'threat.indicator.url.subdomain': { + dashed_name: 'threat-indicator-url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'threat.indicator.url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + original_fieldset: 'url', + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'threat.indicator.url.top_level_domain': { + dashed_name: 'threat-indicator-url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'threat.indicator.url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + original_fieldset: 'url', + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'threat.indicator.url.username': { + dashed_name: 'threat-indicator-url-username', + description: 'Username of the request.', + flat_name: 'threat.indicator.url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + original_fieldset: 'url', + short: 'Username of the request.', + type: 'keyword', + }, + 'threat.indicator.x509.alternative_names': { + dashed_name: 'threat-indicator-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.indicator.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.common_name': { + dashed_name: 'threat-indicator-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.country': { + dashed_name: 'threat-indicator-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.indicator.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.distinguished_name': { + dashed_name: 'threat-indicator-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.locality': { + dashed_name: 'threat-indicator-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.indicator.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.organization': { + dashed_name: 'threat-indicator-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.indicator.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.organizational_unit': { + dashed_name: 'threat-indicator-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.indicator.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.state_or_province': { + dashed_name: 'threat-indicator-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.x509.not_after': { + dashed_name: 'threat-indicator-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.indicator.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.indicator.x509.not_before': { + dashed_name: 'threat-indicator-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.indicator.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.indicator.x509.public_key_algorithm': { + dashed_name: 'threat-indicator-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.indicator.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.indicator.x509.public_key_curve': { + dashed_name: 'threat-indicator-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.indicator.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.indicator.x509.public_key_exponent': { + dashed_name: 'threat-indicator-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.indicator.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.indicator.x509.public_key_size': { + dashed_name: 'threat-indicator-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.indicator.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.indicator.x509.serial_number': { + dashed_name: 'threat-indicator-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.indicator.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.signature_algorithm': { + dashed_name: 'threat-indicator-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.indicator.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.common_name': { + dashed_name: 'threat-indicator-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.indicator.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.country': { + dashed_name: 'threat-indicator-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.indicator.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.indicator.x509.subject.distinguished_name': { + dashed_name: 'threat-indicator-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.indicator.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.locality': { + dashed_name: 'threat-indicator-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.indicator.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.x509.subject.organization': { + dashed_name: 'threat-indicator-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.indicator.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.organizational_unit': { + dashed_name: 'threat-indicator-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.indicator.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.state_or_province': { + dashed_name: 'threat-indicator-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.x509.version_number': { + dashed_name: 'threat-indicator-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.indicator.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.software.alias': { + dashed_name: 'threat-software-alias', + description: + 'The alias(es) of the software for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® associated software description.', + example: '[ "X-Agent" ]', + flat_name: 'threat.software.alias', + ignore_above: 1024, + level: 'extended', + name: 'software.alias', + normalize: ['array'], + short: 'Alias of the software', + type: 'keyword', + }, + 'threat.software.id': { + dashed_name: 'threat-software-id', + description: + 'The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.', + example: 'S0552', + flat_name: 'threat.software.id', + ignore_above: 1024, + level: 'extended', + name: 'software.id', + normalize: [], + short: 'ID of the software', + type: 'keyword', + }, + 'threat.software.name': { + dashed_name: 'threat-software-name', + description: + 'The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.', + example: 'AdFind', + flat_name: 'threat.software.name', + ignore_above: 1024, + level: 'extended', + name: 'software.name', + normalize: [], + short: 'Name of the software.', + type: 'keyword', + }, + 'threat.software.platforms': { + dashed_name: 'threat-software-platforms', + description: + 'The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.', + example: '[ "Windows" ]', + expected_values: [ + 'AWS', + 'Azure', + 'Azure AD', + 'GCP', + 'Linux', + 'macOS', + 'Network', + 'Office 365', + 'SaaS', + 'Windows', + ], + flat_name: 'threat.software.platforms', + ignore_above: 1024, + level: 'extended', + name: 'software.platforms', + normalize: ['array'], + short: 'Platforms of the software.', + type: 'keyword', + }, + 'threat.software.reference': { + dashed_name: 'threat-software-reference', + description: + 'The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.', + example: 'https://attack.mitre.org/software/S0552/', + flat_name: 'threat.software.reference', + ignore_above: 1024, + level: 'extended', + name: 'software.reference', + normalize: [], + short: 'Software reference URL.', + type: 'keyword', + }, + 'threat.software.type': { + dashed_name: 'threat-software-type', + description: + 'The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.', + example: 'Tool', + expected_values: ['Malware', 'Tool'], + flat_name: 'threat.software.type', + ignore_above: 1024, + level: 'extended', + name: 'software.type', + normalize: [], + short: 'Software type.', + type: 'keyword', + }, + 'threat.tactic.id': { + dashed_name: 'threat-tactic-id', + description: + 'The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )', + example: 'TA0002', + flat_name: 'threat.tactic.id', + ignore_above: 1024, + level: 'extended', + name: 'tactic.id', + normalize: ['array'], + short: 'Threat tactic id.', + type: 'keyword', + }, + 'threat.tactic.name': { + dashed_name: 'threat-tactic-name', + description: + 'Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)', + example: 'Execution', + flat_name: 'threat.tactic.name', + ignore_above: 1024, + level: 'extended', + name: 'tactic.name', + normalize: ['array'], + short: 'Threat tactic.', + type: 'keyword', + }, + 'threat.tactic.reference': { + dashed_name: 'threat-tactic-reference', + description: + 'The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )', + example: 'https://attack.mitre.org/tactics/TA0002/', + flat_name: 'threat.tactic.reference', + ignore_above: 1024, + level: 'extended', + name: 'tactic.reference', + normalize: ['array'], + short: 'Threat tactic URL reference.', + type: 'keyword', + }, + 'threat.technique.id': { + dashed_name: 'threat-technique-id', + description: + 'The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'T1059', + flat_name: 'threat.technique.id', + ignore_above: 1024, + level: 'extended', + name: 'technique.id', + normalize: ['array'], + short: 'Threat technique id.', + type: 'keyword', + }, + 'threat.technique.name': { + dashed_name: 'threat-technique-name', + description: + 'The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'Command and Scripting Interpreter', + flat_name: 'threat.technique.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.technique.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'technique.name', + normalize: ['array'], + short: 'Threat technique name.', + type: 'keyword', + }, + 'threat.technique.reference': { + dashed_name: 'threat-technique-reference', + description: + 'The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'https://attack.mitre.org/techniques/T1059/', + flat_name: 'threat.technique.reference', + ignore_above: 1024, + level: 'extended', + name: 'technique.reference', + normalize: ['array'], + short: 'Threat technique URL reference.', + type: 'keyword', + }, + 'threat.technique.subtechnique.id': { + dashed_name: 'threat-technique-subtechnique-id', + description: + 'The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'T1059.001', + flat_name: 'threat.technique.subtechnique.id', + ignore_above: 1024, + level: 'extended', + name: 'technique.subtechnique.id', + normalize: ['array'], + short: 'Threat subtechnique id.', + type: 'keyword', + }, + 'threat.technique.subtechnique.name': { + dashed_name: 'threat-technique-subtechnique-name', + description: + 'The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'PowerShell', + flat_name: 'threat.technique.subtechnique.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.technique.subtechnique.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'technique.subtechnique.name', + normalize: ['array'], + short: 'Threat subtechnique name.', + type: 'keyword', + }, + 'threat.technique.subtechnique.reference': { + dashed_name: 'threat-technique-subtechnique-reference', + description: + 'The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'https://attack.mitre.org/techniques/T1059/001/', + flat_name: 'threat.technique.subtechnique.reference', + ignore_above: 1024, + level: 'extended', + name: 'technique.subtechnique.reference', + normalize: ['array'], + short: 'Threat subtechnique URL reference.', + type: 'keyword', + }, + 'threat.threat.indicator.marking.tlp.version': { + dashed_name: 'threat-threat-indicator-marking-tlp-version', + description: 'Traffic Light Protocol version.', + example: 2, + flat_name: 'threat.threat.indicator.marking.tlp.version', + ignore_above: 1024, + level: 'extended', + name: 'threat.indicator.marking.tlp.version', + normalize: [], + short: 'Indicator TLP version', + type: 'keyword', + }, + 'tls.cipher': { + dashed_name: 'tls-cipher', + description: 'String indicating the cipher used during the current connection.', + example: 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256', + flat_name: 'tls.cipher', + ignore_above: 1024, + level: 'extended', + name: 'cipher', + normalize: [], + short: 'String indicating the cipher used during the current connection.', + type: 'keyword', + }, + 'tls.client.certificate': { + dashed_name: 'tls-client-certificate', + description: + 'PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list.', + example: 'MII...', + flat_name: 'tls.client.certificate', + ignore_above: 1024, + level: 'extended', + name: 'client.certificate', + normalize: [], + short: 'PEM-encoded stand-alone certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.certificate_chain': { + dashed_name: 'tls-client-certificate-chain', + description: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain.', + example: '["MII...", "MII..."]', + flat_name: 'tls.client.certificate_chain', + ignore_above: 1024, + level: 'extended', + name: 'client.certificate_chain', + normalize: ['array'], + short: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.md5': { + dashed_name: 'tls-client-hash-md5', + description: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC', + flat_name: 'tls.client.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.md5', + normalize: [], + short: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.sha1': { + dashed_name: 'tls-client-hash-sha1', + description: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '9E393D93138888D288266C2D915214D1D1CCEB2A', + flat_name: 'tls.client.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.sha1', + normalize: [], + short: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.sha256': { + dashed_name: 'tls-client-hash-sha256', + description: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0', + flat_name: 'tls.client.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.sha256', + normalize: [], + short: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.issuer': { + dashed_name: 'tls-client-issuer', + description: + 'Distinguished name of subject of the issuer of the x.509 certificate presented by the client.', + example: 'CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.client.issuer', + ignore_above: 1024, + level: 'extended', + name: 'client.issuer', + normalize: [], + short: + 'Distinguished name of subject of the issuer of the x.509 certificate presented by the client.', + type: 'keyword', + }, + 'tls.client.ja3': { + dashed_name: 'tls-client-ja3', + description: 'A hash that identifies clients based on how they perform an SSL/TLS handshake.', + example: 'd4e5b18d6b55c71272893221c96ba240', + flat_name: 'tls.client.ja3', + ignore_above: 1024, + level: 'extended', + name: 'client.ja3', + normalize: [], + short: 'A hash that identifies clients based on how they perform an SSL/TLS handshake.', + type: 'keyword', + }, + 'tls.client.not_after': { + dashed_name: 'tls-client-not-after', + description: 'Date/Time indicating when client certificate is no longer considered valid.', + example: '2021-01-01T00:00:00.000Z', + flat_name: 'tls.client.not_after', + level: 'extended', + name: 'client.not_after', + normalize: [], + short: 'Date/Time indicating when client certificate is no longer considered valid.', + type: 'date', + }, + 'tls.client.not_before': { + dashed_name: 'tls-client-not-before', + description: 'Date/Time indicating when client certificate is first considered valid.', + example: '1970-01-01T00:00:00.000Z', + flat_name: 'tls.client.not_before', + level: 'extended', + name: 'client.not_before', + normalize: [], + short: 'Date/Time indicating when client certificate is first considered valid.', + type: 'date', + }, + 'tls.client.server_name': { + dashed_name: 'tls-client-server-name', + description: + 'Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`.', + example: 'www.elastic.co', + flat_name: 'tls.client.server_name', + ignore_above: 1024, + level: 'extended', + name: 'client.server_name', + normalize: [], + short: 'Hostname the client is trying to connect to. Also called the SNI.', + type: 'keyword', + }, + 'tls.client.subject': { + dashed_name: 'tls-client-subject', + description: 'Distinguished name of subject of the x.509 certificate presented by the client.', + example: 'CN=myclient, OU=Documentation Team, DC=example, DC=com', + flat_name: 'tls.client.subject', + ignore_above: 1024, + level: 'extended', + name: 'client.subject', + normalize: [], + short: 'Distinguished name of subject of the x.509 certificate presented by the client.', + type: 'keyword', + }, + 'tls.client.supported_ciphers': { + dashed_name: 'tls-client-supported-ciphers', + description: 'Array of ciphers offered by the client during the client hello.', + example: + '["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]', + flat_name: 'tls.client.supported_ciphers', + ignore_above: 1024, + level: 'extended', + name: 'client.supported_ciphers', + normalize: ['array'], + short: 'Array of ciphers offered by the client during the client hello.', + type: 'keyword', + }, + 'tls.client.x509.alternative_names': { + dashed_name: 'tls-client-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'tls.client.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'tls.client.x509.issuer.common_name': { + dashed_name: 'tls-client-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'tls.client.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.country': { + dashed_name: 'tls-client-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'tls.client.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'tls.client.x509.issuer.distinguished_name': { + dashed_name: 'tls-client-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'tls.client.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.locality': { + dashed_name: 'tls-client-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'tls.client.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.client.x509.issuer.organization': { + dashed_name: 'tls-client-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'tls.client.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.organizational_unit': { + dashed_name: 'tls-client-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'tls.client.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.state_or_province': { + dashed_name: 'tls-client-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.client.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.client.x509.not_after': { + dashed_name: 'tls-client-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'tls.client.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'tls.client.x509.not_before': { + dashed_name: 'tls-client-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'tls.client.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'tls.client.x509.public_key_algorithm': { + dashed_name: 'tls-client-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'tls.client.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'tls.client.x509.public_key_curve': { + dashed_name: 'tls-client-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'tls.client.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'tls.client.x509.public_key_exponent': { + dashed_name: 'tls-client-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'tls.client.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'tls.client.x509.public_key_size': { + dashed_name: 'tls-client-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'tls.client.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'tls.client.x509.serial_number': { + dashed_name: 'tls-client-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'tls.client.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.signature_algorithm': { + dashed_name: 'tls-client-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'tls.client.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'tls.client.x509.subject.common_name': { + dashed_name: 'tls-client-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'tls.client.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.country': { + dashed_name: 'tls-client-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'tls.client.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'tls.client.x509.subject.distinguished_name': { + dashed_name: 'tls-client-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'tls.client.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'tls.client.x509.subject.locality': { + dashed_name: 'tls-client-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'tls.client.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.client.x509.subject.organization': { + dashed_name: 'tls-client-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'tls.client.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.organizational_unit': { + dashed_name: 'tls-client-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'tls.client.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.state_or_province': { + dashed_name: 'tls-client-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.client.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.client.x509.version_number': { + dashed_name: 'tls-client-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'tls.client.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'tls.curve': { + dashed_name: 'tls-curve', + description: 'String indicating the curve used for the given cipher, when applicable.', + example: 'secp256r1', + flat_name: 'tls.curve', + ignore_above: 1024, + level: 'extended', + name: 'curve', + normalize: [], + short: 'String indicating the curve used for the given cipher, when applicable.', + type: 'keyword', + }, + 'tls.established': { + dashed_name: 'tls-established', + description: + 'Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.', + flat_name: 'tls.established', + level: 'extended', + name: 'established', + normalize: [], + short: + 'Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.', + type: 'boolean', + }, + 'tls.next_protocol': { + dashed_name: 'tls-next-protocol', + description: + 'String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case.', + example: 'http/1.1', + flat_name: 'tls.next_protocol', + ignore_above: 1024, + level: 'extended', + name: 'next_protocol', + normalize: [], + short: 'String indicating the protocol being tunneled.', + type: 'keyword', + }, + 'tls.resumed': { + dashed_name: 'tls-resumed', + description: + 'Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.', + flat_name: 'tls.resumed', + level: 'extended', + name: 'resumed', + normalize: [], + short: + 'Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.', + type: 'boolean', + }, + 'tls.server.certificate': { + dashed_name: 'tls-server-certificate', + description: + 'PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list.', + example: 'MII...', + flat_name: 'tls.server.certificate', + ignore_above: 1024, + level: 'extended', + name: 'server.certificate', + normalize: [], + short: 'PEM-encoded stand-alone certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.certificate_chain': { + dashed_name: 'tls-server-certificate-chain', + description: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain.', + example: '["MII...", "MII..."]', + flat_name: 'tls.server.certificate_chain', + ignore_above: 1024, + level: 'extended', + name: 'server.certificate_chain', + normalize: ['array'], + short: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.md5': { + dashed_name: 'tls-server-hash-md5', + description: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC', + flat_name: 'tls.server.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.md5', + normalize: [], + short: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.sha1': { + dashed_name: 'tls-server-hash-sha1', + description: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '9E393D93138888D288266C2D915214D1D1CCEB2A', + flat_name: 'tls.server.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.sha1', + normalize: [], + short: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.sha256': { + dashed_name: 'tls-server-hash-sha256', + description: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0', + flat_name: 'tls.server.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.sha256', + normalize: [], + short: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.issuer': { + dashed_name: 'tls-server-issuer', + description: 'Subject of the issuer of the x.509 certificate presented by the server.', + example: 'CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.server.issuer', + ignore_above: 1024, + level: 'extended', + name: 'server.issuer', + normalize: [], + short: 'Subject of the issuer of the x.509 certificate presented by the server.', + type: 'keyword', + }, + 'tls.server.ja3s': { + dashed_name: 'tls-server-ja3s', + description: 'A hash that identifies servers based on how they perform an SSL/TLS handshake.', + example: '394441ab65754e2207b1e1b457b3641d', + flat_name: 'tls.server.ja3s', + ignore_above: 1024, + level: 'extended', + name: 'server.ja3s', + normalize: [], + short: 'A hash that identifies servers based on how they perform an SSL/TLS handshake.', + type: 'keyword', + }, + 'tls.server.not_after': { + dashed_name: 'tls-server-not-after', + description: 'Timestamp indicating when server certificate is no longer considered valid.', + example: '2021-01-01T00:00:00.000Z', + flat_name: 'tls.server.not_after', + level: 'extended', + name: 'server.not_after', + normalize: [], + short: 'Timestamp indicating when server certificate is no longer considered valid.', + type: 'date', + }, + 'tls.server.not_before': { + dashed_name: 'tls-server-not-before', + description: 'Timestamp indicating when server certificate is first considered valid.', + example: '1970-01-01T00:00:00.000Z', + flat_name: 'tls.server.not_before', + level: 'extended', + name: 'server.not_before', + normalize: [], + short: 'Timestamp indicating when server certificate is first considered valid.', + type: 'date', + }, + 'tls.server.subject': { + dashed_name: 'tls-server-subject', + description: 'Subject of the x.509 certificate presented by the server.', + example: 'CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.server.subject', + ignore_above: 1024, + level: 'extended', + name: 'server.subject', + normalize: [], + short: 'Subject of the x.509 certificate presented by the server.', + type: 'keyword', + }, + 'tls.server.x509.alternative_names': { + dashed_name: 'tls-server-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'tls.server.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'tls.server.x509.issuer.common_name': { + dashed_name: 'tls-server-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'tls.server.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.country': { + dashed_name: 'tls-server-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'tls.server.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'tls.server.x509.issuer.distinguished_name': { + dashed_name: 'tls-server-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'tls.server.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.locality': { + dashed_name: 'tls-server-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'tls.server.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.server.x509.issuer.organization': { + dashed_name: 'tls-server-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'tls.server.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.organizational_unit': { + dashed_name: 'tls-server-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'tls.server.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.state_or_province': { + dashed_name: 'tls-server-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.server.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.server.x509.not_after': { + dashed_name: 'tls-server-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'tls.server.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'tls.server.x509.not_before': { + dashed_name: 'tls-server-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'tls.server.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'tls.server.x509.public_key_algorithm': { + dashed_name: 'tls-server-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'tls.server.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'tls.server.x509.public_key_curve': { + dashed_name: 'tls-server-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'tls.server.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'tls.server.x509.public_key_exponent': { + dashed_name: 'tls-server-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'tls.server.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'tls.server.x509.public_key_size': { + dashed_name: 'tls-server-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'tls.server.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'tls.server.x509.serial_number': { + dashed_name: 'tls-server-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'tls.server.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.signature_algorithm': { + dashed_name: 'tls-server-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'tls.server.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'tls.server.x509.subject.common_name': { + dashed_name: 'tls-server-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'tls.server.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.country': { + dashed_name: 'tls-server-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'tls.server.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'tls.server.x509.subject.distinguished_name': { + dashed_name: 'tls-server-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'tls.server.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'tls.server.x509.subject.locality': { + dashed_name: 'tls-server-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'tls.server.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.server.x509.subject.organization': { + dashed_name: 'tls-server-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'tls.server.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.organizational_unit': { + dashed_name: 'tls-server-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'tls.server.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.state_or_province': { + dashed_name: 'tls-server-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.server.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.server.x509.version_number': { + dashed_name: 'tls-server-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'tls.server.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'tls.version': { + dashed_name: 'tls-version', + description: 'Numeric part of the version parsed from the original string.', + example: '1.2', + flat_name: 'tls.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Numeric part of the version parsed from the original string.', + type: 'keyword', + }, + 'tls.version_protocol': { + dashed_name: 'tls-version-protocol', + description: 'Normalized lowercase protocol name parsed from original string.', + example: 'tls', + flat_name: 'tls.version_protocol', + ignore_above: 1024, + level: 'extended', + name: 'version_protocol', + normalize: [], + short: 'Normalized lowercase protocol name parsed from original string.', + type: 'keyword', + }, + 'trace.id': { + dashed_name: 'trace-id', + description: + 'Unique identifier of the trace.\nA trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services.', + example: '4bf92f3577b34da6a3ce929d0e0e4736', + flat_name: 'trace.id', + ignore_above: 1024, + level: 'extended', + name: 'trace.id', + normalize: [], + short: 'Unique identifier of the trace.', + type: 'keyword', + }, + 'transaction.id': { + dashed_name: 'transaction-id', + description: + 'Unique identifier of the transaction within the scope of its trace.\nA transaction is the highest level of work measured within a service, such as a request to a server.', + example: '00f067aa0ba902b7', + flat_name: 'transaction.id', + ignore_above: 1024, + level: 'extended', + name: 'transaction.id', + normalize: [], + short: 'Unique identifier of the transaction within the scope of its trace.', + type: 'keyword', + }, + 'url.domain': { + dashed_name: 'url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Domain of the url.', + type: 'keyword', + }, + 'url.extension': { + dashed_name: 'url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'url.fragment': { + dashed_name: 'url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'url.full': { + dashed_name: 'url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'url.full', + level: 'extended', + multi_fields: [{ flat_name: 'url.full.text', name: 'text', type: 'match_only_text' }], + name: 'full', + normalize: [], + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'url.original': { + dashed_name: 'url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'url.original', + level: 'extended', + multi_fields: [{ flat_name: 'url.original.text', name: 'text', type: 'match_only_text' }], + name: 'original', + normalize: [], + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'url.password': { + dashed_name: 'url-password', + description: 'Password of the request.', + flat_name: 'url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + short: 'Password of the request.', + type: 'keyword', + }, + 'url.path': { + dashed_name: 'url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'url.path', + level: 'extended', + name: 'path', + normalize: [], + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'url.port': { + dashed_name: 'url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'url.query': { + dashed_name: 'url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + short: 'Query string of the request.', + type: 'keyword', + }, + 'url.registered_domain': { + dashed_name: 'url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'url.scheme': { + dashed_name: 'url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + short: 'Scheme of the url.', + type: 'keyword', + }, + 'url.subdomain': { + dashed_name: 'url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'url.top_level_domain': { + dashed_name: 'url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'url.username': { + dashed_name: 'url-username', + description: 'Username of the request.', + flat_name: 'url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + short: 'Username of the request.', + type: 'keyword', + }, + 'user.changes.domain': { + dashed_name: 'user-changes-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.changes.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.changes.email': { + dashed_name: 'user-changes-email', + description: 'User email address.', + flat_name: 'user.changes.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.changes.full_name': { + dashed_name: 'user-changes-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.changes.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.changes.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.changes.group.domain': { + dashed_name: 'user-changes-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.changes.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.changes.group.id': { + dashed_name: 'user-changes-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.changes.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.changes.group.name': { + dashed_name: 'user-changes-group-name', + description: 'Name of the group.', + flat_name: 'user.changes.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.changes.hash': { + dashed_name: 'user-changes-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.changes.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.changes.id': { + dashed_name: 'user-changes-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.changes.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.changes.name': { + dashed_name: 'user-changes-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.changes.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.changes.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.changes.roles': { + dashed_name: 'user-changes-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.changes.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.domain': { + dashed_name: 'user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.effective.domain': { + dashed_name: 'user-effective-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.effective.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.effective.email': { + dashed_name: 'user-effective-email', + description: 'User email address.', + flat_name: 'user.effective.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.effective.full_name': { + dashed_name: 'user-effective-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.effective.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.effective.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.effective.group.domain': { + dashed_name: 'user-effective-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.effective.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.effective.group.id': { + dashed_name: 'user-effective-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.effective.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.effective.group.name': { + dashed_name: 'user-effective-group-name', + description: 'Name of the group.', + flat_name: 'user.effective.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.effective.hash': { + dashed_name: 'user-effective-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.effective.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.effective.id': { + dashed_name: 'user-effective-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.effective.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.effective.name': { + dashed_name: 'user-effective-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.effective.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.effective.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.effective.roles': { + dashed_name: 'user-effective-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.effective.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.email': { + dashed_name: 'user-email', + description: 'User email address.', + flat_name: 'user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + short: 'User email address.', + type: 'keyword', + }, + 'user.full_name': { + dashed_name: 'user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.group.domain': { + dashed_name: 'user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.group.id': { + dashed_name: 'user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.group.name': { + dashed_name: 'user-group-name', + description: 'Name of the group.', + flat_name: 'user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.hash': { + dashed_name: 'user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.id': { + dashed_name: 'user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.name': { + dashed_name: 'user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [{ flat_name: 'user.name.text', name: 'text', type: 'match_only_text' }], + name: 'name', + normalize: [], + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.risk.calculated_level': { + dashed_name: 'user-risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'user.risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'user.risk.calculated_score': { + dashed_name: 'user-risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'user.risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'user.risk.calculated_score_norm': { + dashed_name: 'user-risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'user.risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'user.risk.static_level': { + dashed_name: 'user-risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'user.risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'user.risk.static_score': { + dashed_name: 'user-risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'user.risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'user.risk.static_score_norm': { + dashed_name: 'user-risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'user.risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + 'user.roles': { + dashed_name: 'user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.target.domain': { + dashed_name: 'user-target-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.target.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.target.email': { + dashed_name: 'user-target-email', + description: 'User email address.', + flat_name: 'user.target.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.target.full_name': { + dashed_name: 'user-target-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.target.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.target.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.target.group.domain': { + dashed_name: 'user-target-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.target.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.target.group.id': { + dashed_name: 'user-target-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.target.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.target.group.name': { + dashed_name: 'user-target-group-name', + description: 'Name of the group.', + flat_name: 'user.target.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.target.hash': { + dashed_name: 'user-target-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.target.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.target.id': { + dashed_name: 'user-target-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.target.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.target.name': { + dashed_name: 'user-target-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.target.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.target.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.target.roles': { + dashed_name: 'user-target-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.target.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user_agent.device.name': { + dashed_name: 'user-agent-device-name', + description: 'Name of the device.', + example: 'iPhone', + flat_name: 'user_agent.device.name', + ignore_above: 1024, + level: 'extended', + name: 'device.name', + normalize: [], + short: 'Name of the device.', + type: 'keyword', + }, + 'user_agent.name': { + dashed_name: 'user-agent-name', + description: 'Name of the user agent.', + example: 'Safari', + flat_name: 'user_agent.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the user agent.', + type: 'keyword', + }, + 'user_agent.original': { + dashed_name: 'user-agent-original', + description: 'Unparsed user_agent string.', + example: + 'Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1', + flat_name: 'user_agent.original', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + short: 'Unparsed user_agent string.', + type: 'keyword', + }, + 'user_agent.os.family': { + dashed_name: 'user-agent-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'user_agent.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'user_agent.os.full': { + dashed_name: 'user-agent-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'user_agent.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'user_agent.os.kernel': { + dashed_name: 'user-agent-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'user_agent.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'user_agent.os.name': { + dashed_name: 'user-agent-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'user_agent.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'user_agent.os.platform': { + dashed_name: 'user-agent-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'user_agent.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'user_agent.os.type': { + dashed_name: 'user-agent-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'user_agent.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'user_agent.os.version': { + dashed_name: 'user-agent-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'user_agent.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'user_agent.version': { + dashed_name: 'user-agent-version', + description: 'Version of the user agent.', + example: 12, + flat_name: 'user_agent.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Version of the user agent.', + type: 'keyword', + }, + 'vulnerability.category': { + dashed_name: 'vulnerability-category', + description: + 'The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories])\nThis field must be an array.', + example: '["Firewall"]', + flat_name: 'vulnerability.category', + ignore_above: 1024, + level: 'extended', + name: 'category', + normalize: ['array'], + short: 'Category of a vulnerability.', + type: 'keyword', + }, + 'vulnerability.classification': { + dashed_name: 'vulnerability-classification', + description: + 'The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/)', + example: 'CVSS', + flat_name: 'vulnerability.classification', + ignore_above: 1024, + level: 'extended', + name: 'classification', + normalize: [], + short: 'Classification of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.description': { + dashed_name: 'vulnerability-description', + description: + 'The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description])', + example: 'In macOS before 2.12.6, there is a vulnerability in the RPC...', + flat_name: 'vulnerability.description', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'vulnerability.description.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'description', + normalize: [], + short: 'Description of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.enumeration': { + dashed_name: 'vulnerability-enumeration', + description: + 'The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/)', + example: 'CVE', + flat_name: 'vulnerability.enumeration', + ignore_above: 1024, + level: 'extended', + name: 'enumeration', + normalize: [], + short: 'Identifier of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.id': { + dashed_name: 'vulnerability-id', + description: + 'The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID]', + example: 'CVE-2019-00001', + flat_name: 'vulnerability.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'ID of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.reference': { + dashed_name: 'vulnerability-reference', + description: + 'A resource that provides additional information, context, and mitigations for the identified vulnerability.', + example: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111', + flat_name: 'vulnerability.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Reference of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.report_id': { + dashed_name: 'vulnerability-report-id', + description: 'The report or scan identification number.', + example: 20191018.0001, + flat_name: 'vulnerability.report_id', + ignore_above: 1024, + level: 'extended', + name: 'report_id', + normalize: [], + short: 'Scan identification number.', + type: 'keyword', + }, + 'vulnerability.scanner.vendor': { + dashed_name: 'vulnerability-scanner-vendor', + description: 'The name of the vulnerability scanner vendor.', + example: 'Tenable', + flat_name: 'vulnerability.scanner.vendor', + ignore_above: 1024, + level: 'extended', + name: 'scanner.vendor', + normalize: [], + short: 'Name of the scanner vendor.', + type: 'keyword', + }, + 'vulnerability.score.base': { + dashed_name: 'vulnerability-score-base', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nBase scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document)', + example: 5.5, + flat_name: 'vulnerability.score.base', + level: 'extended', + name: 'score.base', + normalize: [], + short: 'Vulnerability Base score.', + type: 'float', + }, + 'vulnerability.score.environmental': { + dashed_name: 'vulnerability-score-environmental', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nEnvironmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document)', + example: 5.5, + flat_name: 'vulnerability.score.environmental', + level: 'extended', + name: 'score.environmental', + normalize: [], + short: 'Vulnerability Environmental score.', + type: 'float', + }, + 'vulnerability.score.temporal': { + dashed_name: 'vulnerability-score-temporal', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nTemporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document)', + flat_name: 'vulnerability.score.temporal', + level: 'extended', + name: 'score.temporal', + normalize: [], + short: 'Vulnerability Temporal score.', + type: 'float', + }, + 'vulnerability.score.version': { + dashed_name: 'vulnerability-score-version', + description: + 'The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.\nCVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss)', + example: 2, + flat_name: 'vulnerability.score.version', + ignore_above: 1024, + level: 'extended', + name: 'score.version', + normalize: [], + short: 'CVSS version.', + type: 'keyword', + }, + 'vulnerability.severity': { + dashed_name: 'vulnerability-severity', + description: + 'The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)', + example: 'Critical', + flat_name: 'vulnerability.severity', + ignore_above: 1024, + level: 'extended', + name: 'severity', + normalize: [], + short: 'Severity of the vulnerability.', + type: 'keyword', + }, +}; diff --git a/packages/kbn-ecs/generated/ecs_nested.ts b/packages/kbn-ecs/generated/ecs_nested.ts new file mode 100644 index 0000000000000..761b4b4643049 --- /dev/null +++ b/packages/kbn-ecs/generated/ecs_nested.ts @@ -0,0 +1,22185 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export const EcsNested = { + agent: { + description: + 'The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.', + fields: { + 'agent.build.original': { + dashed_name: 'agent-build-original', + description: + 'Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.', + example: + 'metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]', + flat_name: 'agent.build.original', + ignore_above: 1024, + level: 'core', + name: 'build.original', + normalize: [], + short: 'Extended build information for the agent.', + type: 'keyword', + }, + 'agent.ephemeral_id': { + dashed_name: 'agent-ephemeral-id', + description: + 'Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.', + example: '8a4f500f', + flat_name: 'agent.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + short: 'Ephemeral identifier of this agent.', + type: 'keyword', + }, + 'agent.id': { + dashed_name: 'agent-id', + description: + 'Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.', + example: '8a4f500d', + flat_name: 'agent.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of this agent.', + type: 'keyword', + }, + 'agent.name': { + dashed_name: 'agent-name', + description: + 'Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.', + example: 'foo', + flat_name: 'agent.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Custom name of the agent.', + type: 'keyword', + }, + 'agent.type': { + dashed_name: 'agent-type', + description: + 'Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.', + example: 'filebeat', + flat_name: 'agent.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'Type of the agent.', + type: 'keyword', + }, + 'agent.version': { + dashed_name: 'agent-version', + description: 'Version of the agent.', + example: '6.0.0-rc2', + flat_name: 'agent.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Version of the agent.', + type: 'keyword', + }, + }, + footnote: + 'Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server.', + group: 2, + name: 'agent', + prefix: 'agent.', + short: 'Fields about the monitoring agent.', + title: 'Agent', + type: 'group', + }, + as: { + description: + 'An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.', + fields: { + 'as.number': { + dashed_name: 'as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'as.number', + level: 'extended', + name: 'number', + normalize: [], + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'as.organization.name': { + dashed_name: 'as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + short: 'Organization name.', + type: 'keyword', + }, + }, + group: 2, + name: 'as', + prefix: 'as.', + reusable: { + expected: [ + { as: 'as', at: 'client', full: 'client.as' }, + { as: 'as', at: 'destination', full: 'destination.as' }, + { as: 'as', at: 'server', full: 'server.as' }, + { as: 'as', at: 'source', full: 'source.as' }, + { as: 'as', at: 'threat.indicator', full: 'threat.indicator.as' }, + { + as: 'as', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.as', + }, + ], + top_level: false, + }, + short: 'Fields describing an Autonomous System (Internet routing prefix).', + title: 'Autonomous System', + type: 'group', + }, + base: { + description: + 'The `base` field set contains all fields which are at the root of the events. These fields are common across all types of events.', + fields: { + '@timestamp': { + dashed_name: 'timestamp', + description: + 'Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.', + example: '2016-05-23T08:05:34.853Z', + flat_name: '@timestamp', + level: 'core', + name: '@timestamp', + normalize: [], + required: true, + short: 'Date/time when the event originated.', + type: 'date', + }, + labels: { + dashed_name: 'labels', + description: + 'Custom key/value pairs.\nCan be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.\nExample: `docker` and `k8s` labels.', + example: '{"application": "foo-bar", "env": "production"}', + flat_name: 'labels', + level: 'core', + name: 'labels', + normalize: [], + object_type: 'keyword', + short: 'Custom key/value pairs.', + type: 'object', + }, + message: { + dashed_name: 'message', + description: + 'For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.', + example: 'Hello World', + flat_name: 'message', + level: 'core', + name: 'message', + normalize: [], + short: 'Log message optimized for viewing in a log viewer.', + type: 'match_only_text', + }, + tags: { + dashed_name: 'tags', + description: 'List of keywords used to tag each event.', + example: '["production", "env2"]', + flat_name: 'tags', + ignore_above: 1024, + level: 'core', + name: 'tags', + normalize: ['array'], + short: 'List of keywords used to tag each event.', + type: 'keyword', + }, + }, + group: 1, + name: 'base', + prefix: '', + root: true, + short: 'All fields defined directly at the root of the events.', + title: 'Base', + type: 'group', + }, + client: { + description: + 'A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records.\nFor TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events.\nClient / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.', + fields: { + 'client.address': { + dashed_name: 'client-address', + description: + 'Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'client.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Client network address.', + type: 'keyword', + }, + 'client.as.number': { + dashed_name: 'client-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'client.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'client.as.organization.name': { + dashed_name: 'client-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'client.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'client.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'client.bytes': { + dashed_name: 'client-bytes', + description: 'Bytes sent from the client to the server.', + example: 184, + flat_name: 'client.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the client to the server.', + type: 'long', + }, + 'client.domain': { + dashed_name: 'client-domain', + description: + 'The domain name of the client system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'client.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the client.', + type: 'keyword', + }, + 'client.geo.city_name': { + dashed_name: 'client-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'client.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'client.geo.continent_code': { + dashed_name: 'client-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'client.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'client.geo.continent_name': { + dashed_name: 'client-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'client.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'client.geo.country_iso_code': { + dashed_name: 'client-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'client.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'client.geo.country_name': { + dashed_name: 'client-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'client.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'client.geo.location': { + dashed_name: 'client-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'client.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'client.geo.name': { + dashed_name: 'client-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'client.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'client.geo.postal_code': { + dashed_name: 'client-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'client.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'client.geo.region_iso_code': { + dashed_name: 'client-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'client.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'client.geo.region_name': { + dashed_name: 'client-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'client.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'client.geo.timezone': { + dashed_name: 'client-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'client.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'client.ip': { + dashed_name: 'client-ip', + description: 'IP address of the client (IPv4 or IPv6).', + flat_name: 'client.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the client.', + type: 'ip', + }, + 'client.mac': { + dashed_name: 'client-mac', + description: + 'MAC address of the client.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'client.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the client.', + type: 'keyword', + }, + 'client.nat.ip': { + dashed_name: 'client-nat-ip', + description: + 'Translated IP of source based NAT sessions (e.g. internal client to internet).\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'client.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Client NAT ip address', + type: 'ip', + }, + 'client.nat.port': { + dashed_name: 'client-nat-port', + description: + 'Translated port of source based NAT sessions (e.g. internal client to internet).\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'client.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Client NAT port', + type: 'long', + }, + 'client.packets': { + dashed_name: 'client-packets', + description: 'Packets sent from the client to the server.', + example: 12, + flat_name: 'client.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the client to the server.', + type: 'long', + }, + 'client.port': { + dashed_name: 'client-port', + description: 'Port of the client.', + flat_name: 'client.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the client.', + type: 'long', + }, + 'client.registered_domain': { + dashed_name: 'client-registered-domain', + description: + 'The highest registered client domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'client.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered client domain, stripped of the subdomain.', + type: 'keyword', + }, + 'client.subdomain': { + dashed_name: 'client-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'client.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'client.top_level_domain': { + dashed_name: 'client-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'client.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'client.user.domain': { + dashed_name: 'client-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'client.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'client.user.email': { + dashed_name: 'client-user-email', + description: 'User email address.', + flat_name: 'client.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'client.user.full_name': { + dashed_name: 'client-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'client.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'client.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'client.user.group.domain': { + dashed_name: 'client-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'client.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'client.user.group.id': { + dashed_name: 'client-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'client.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'client.user.group.name': { + dashed_name: 'client-user-group-name', + description: 'Name of the group.', + flat_name: 'client.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'client.user.hash': { + dashed_name: 'client-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'client.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'client.user.id': { + dashed_name: 'client-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'client.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'client.user.name': { + dashed_name: 'client-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'client.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'client.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'client.user.roles': { + dashed_name: 'client-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'client.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'client', + nestings: ['client.as', 'client.geo', 'client.user'], + prefix: 'client.', + reused_here: [ + { + full: 'client.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'client.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'client.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the client side of a network connection, used with server.', + title: 'Client', + type: 'group', + }, + cloud: { + description: 'Fields related to the cloud or infrastructure the events are coming from.', + fields: { + 'cloud.account.id': { + dashed_name: 'cloud-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.account.name': { + dashed_name: 'cloud-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.availability_zone': { + dashed_name: 'cloud-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.instance.id': { + dashed_name: 'cloud-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.instance.name': { + dashed_name: 'cloud-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.machine.type': { + dashed_name: 'cloud-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.origin.account.id': { + dashed_name: 'cloud-origin-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.origin.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.origin.account.name': { + dashed_name: 'cloud-origin-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.origin.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.origin.availability_zone': { + dashed_name: 'cloud-origin-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.origin.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + original_fieldset: 'cloud', + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.origin.instance.id': { + dashed_name: 'cloud-origin-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.origin.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.origin.instance.name': { + dashed_name: 'cloud-origin-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.origin.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.origin.machine.type': { + dashed_name: 'cloud-origin-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.origin.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + original_fieldset: 'cloud', + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.origin.project.id': { + dashed_name: 'cloud-origin-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.origin.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.origin.project.name': { + dashed_name: 'cloud-origin-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.origin.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.origin.provider': { + dashed_name: 'cloud-origin-provider', + description: + 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.origin.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + original_fieldset: 'cloud', + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.origin.region': { + dashed_name: 'cloud-origin-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.origin.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + original_fieldset: 'cloud', + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.origin.service.name': { + dashed_name: 'cloud-origin-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.origin.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud service name.', + type: 'keyword', + }, + 'cloud.project.id': { + dashed_name: 'cloud-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.project.name': { + dashed_name: 'cloud-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.provider': { + dashed_name: 'cloud-provider', + description: + 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.region': { + dashed_name: 'cloud-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.service.name': { + dashed_name: 'cloud-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + short: 'The cloud service name.', + type: 'keyword', + }, + 'cloud.target.account.id': { + dashed_name: 'cloud-target-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.target.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.target.account.name': { + dashed_name: 'cloud-target-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.target.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.target.availability_zone': { + dashed_name: 'cloud-target-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.target.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + original_fieldset: 'cloud', + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.target.instance.id': { + dashed_name: 'cloud-target-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.target.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.target.instance.name': { + dashed_name: 'cloud-target-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.target.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.target.machine.type': { + dashed_name: 'cloud-target-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.target.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + original_fieldset: 'cloud', + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.target.project.id': { + dashed_name: 'cloud-target-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.target.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.target.project.name': { + dashed_name: 'cloud-target-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.target.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.target.provider': { + dashed_name: 'cloud-target-provider', + description: + 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.target.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + original_fieldset: 'cloud', + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.target.region': { + dashed_name: 'cloud-target-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.target.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + original_fieldset: 'cloud', + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.target.service.name': { + dashed_name: 'cloud-target-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.target.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud service name.', + type: 'keyword', + }, + }, + footnote: + "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information.", + group: 2, + name: 'cloud', + nestings: ['cloud.origin', 'cloud.target'], + prefix: 'cloud.', + reusable: { + expected: [ + { + as: 'origin', + at: 'cloud', + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.origin', + short_override: + 'Provides the cloud information of the origin entity in case of an incoming request or event.', + }, + { + as: 'target', + at: 'cloud', + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.target', + short_override: + 'Provides the cloud information of the target entity in case of an outgoing request or event.', + }, + ], + top_level: true, + }, + reused_here: [ + { + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.origin', + schema_name: 'cloud', + short: + 'Provides the cloud information of the origin entity in case of an incoming request or event.', + }, + { + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.target', + schema_name: 'cloud', + short: + 'Provides the cloud information of the target entity in case of an outgoing request or event.', + }, + ], + short: 'Fields about the cloud resource.', + title: 'Cloud', + type: 'group', + }, + code_signature: { + description: 'These fields contain information about binary code signatures.', + fields: { + 'code_signature.digest_algorithm': { + dashed_name: 'code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'code_signature.exists': { + dashed_name: 'code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'code_signature.signing_id': { + dashed_name: 'code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'code_signature.status': { + dashed_name: 'code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'code_signature.subject_name': { + dashed_name: 'code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'code_signature.team_id': { + dashed_name: 'code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'code_signature.timestamp': { + dashed_name: 'code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'code_signature.trusted': { + dashed_name: 'code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'code_signature.valid': { + dashed_name: 'code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + }, + group: 2, + name: 'code_signature', + prefix: 'code_signature.', + reusable: { + expected: [ + { as: 'code_signature', at: 'file', full: 'file.code_signature' }, + { as: 'code_signature', at: 'process', full: 'process.code_signature' }, + { as: 'code_signature', at: 'dll', full: 'dll.code_signature' }, + ], + top_level: false, + }, + short: 'These fields contain information about binary code signatures.', + title: 'Code Signature', + type: 'group', + }, + container: { + description: + 'Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.', + fields: { + 'container.cpu.usage': { + dashed_name: 'container-cpu-usage', + description: + 'Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000.', + flat_name: 'container.cpu.usage', + level: 'extended', + name: 'cpu.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent CPU used, between 0 and 1.', + type: 'scaled_float', + }, + 'container.disk.read.bytes': { + dashed_name: 'container-disk-read-bytes', + description: + 'The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'container.disk.read.bytes', + level: 'extended', + name: 'disk.read.bytes', + normalize: [], + short: 'The number of bytes read by all disks.', + type: 'long', + }, + 'container.disk.write.bytes': { + dashed_name: 'container-disk-write-bytes', + description: + 'The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'container.disk.write.bytes', + level: 'extended', + name: 'disk.write.bytes', + normalize: [], + short: 'The number of bytes written on all disks.', + type: 'long', + }, + 'container.id': { + dashed_name: 'container-id', + description: 'Unique container id.', + flat_name: 'container.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique container id.', + type: 'keyword', + }, + 'container.image.hash.all': { + dashed_name: 'container-image-hash-all', + description: + 'An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.', + example: '[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]', + flat_name: 'container.image.hash.all', + ignore_above: 1024, + level: 'extended', + name: 'image.hash.all', + normalize: ['array'], + short: 'An array of digests of the image the container was built on.', + type: 'keyword', + }, + 'container.image.name': { + dashed_name: 'container-image-name', + description: 'Name of the image the container was built on.', + flat_name: 'container.image.name', + ignore_above: 1024, + level: 'extended', + name: 'image.name', + normalize: [], + short: 'Name of the image the container was built on.', + type: 'keyword', + }, + 'container.image.tag': { + dashed_name: 'container-image-tag', + description: 'Container image tags.', + flat_name: 'container.image.tag', + ignore_above: 1024, + level: 'extended', + name: 'image.tag', + normalize: ['array'], + short: 'Container image tags.', + type: 'keyword', + }, + 'container.labels': { + dashed_name: 'container-labels', + description: 'Image labels.', + flat_name: 'container.labels', + level: 'extended', + name: 'labels', + normalize: [], + object_type: 'keyword', + short: 'Image labels.', + type: 'object', + }, + 'container.memory.usage': { + dashed_name: 'container-memory-usage', + description: 'Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000.', + flat_name: 'container.memory.usage', + level: 'extended', + name: 'memory.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent memory used, between 0 and 1.', + type: 'scaled_float', + }, + 'container.name': { + dashed_name: 'container-name', + description: 'Container name.', + flat_name: 'container.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Container name.', + type: 'keyword', + }, + 'container.network.egress.bytes': { + dashed_name: 'container-network-egress-bytes', + description: + 'The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection.', + flat_name: 'container.network.egress.bytes', + level: 'extended', + name: 'network.egress.bytes', + normalize: [], + short: 'The number of bytes sent on all network interfaces.', + type: 'long', + }, + 'container.network.ingress.bytes': { + dashed_name: 'container-network-ingress-bytes', + description: + 'The number of bytes received (gauge) on all network interfaces by the container since the last metric collection.', + flat_name: 'container.network.ingress.bytes', + level: 'extended', + name: 'network.ingress.bytes', + normalize: [], + short: 'The number of bytes received on all network interfaces.', + type: 'long', + }, + 'container.runtime': { + dashed_name: 'container-runtime', + description: 'Runtime managing this container.', + example: 'docker', + flat_name: 'container.runtime', + ignore_above: 1024, + level: 'extended', + name: 'runtime', + normalize: [], + short: 'Runtime managing this container.', + type: 'keyword', + }, + }, + group: 2, + name: 'container', + prefix: 'container.', + short: 'Fields describing the container that generated this event.', + title: 'Container', + type: 'group', + }, + data_stream: { + beta: 'These fields are in beta and are subject to change.', + description: + 'The data_stream fields take part in defining the new data stream naming scheme.\nIn the new data stream naming scheme the value of the data stream fields combine to the name of the actual data stream in the following manner: `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`. This means the fields can only contain characters that are valid as part of names of data streams. More details about this can be found in this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog post].\nAn Elasticsearch data stream consists of one or more backing indices, and a data stream name forms part of the backing indices names. Due to this convention, data streams must also follow index naming restrictions. For example, data stream names cannot include `\\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, ` ` (space character), `,`, or `#`. Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions].', + fields: { + 'data_stream.dataset': { + dashed_name: 'data-stream-dataset', + description: + 'The field can contain anything that makes sense to signify the source of the data.\nExamples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`.\nBeyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters', + example: 'nginx.access', + flat_name: 'data_stream.dataset', + level: 'extended', + name: 'dataset', + normalize: [], + short: 'The field can contain anything that makes sense to signify the source of the data.', + type: 'constant_keyword', + }, + 'data_stream.namespace': { + dashed_name: 'data-stream-namespace', + description: + 'A user defined namespace. Namespaces are useful to allow grouping of data.\nMany users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`.\nBeyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters', + example: 'production', + flat_name: 'data_stream.namespace', + level: 'extended', + name: 'namespace', + normalize: [], + short: 'A user defined namespace. Namespaces are useful to allow grouping of data.', + type: 'constant_keyword', + }, + 'data_stream.type': { + dashed_name: 'data-stream-type', + description: + 'An overarching type for the data stream.\nCurrently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future.', + example: 'logs', + flat_name: 'data_stream.type', + level: 'extended', + name: 'type', + normalize: [], + short: 'An overarching type for the data stream.', + type: 'constant_keyword', + }, + }, + group: 2, + name: 'data_stream', + prefix: 'data_stream.', + short: 'The data_stream fields take part in defining the new data stream naming scheme.', + title: 'Data Stream', + type: 'group', + }, + destination: { + description: + 'Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.', + fields: { + 'destination.address': { + dashed_name: 'destination-address', + description: + 'Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'destination.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Destination network address.', + type: 'keyword', + }, + 'destination.as.number': { + dashed_name: 'destination-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'destination.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'destination.as.organization.name': { + dashed_name: 'destination-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'destination.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'destination.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'destination.bytes': { + dashed_name: 'destination-bytes', + description: 'Bytes sent from the destination to the source.', + example: 184, + flat_name: 'destination.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the destination to the source.', + type: 'long', + }, + 'destination.domain': { + dashed_name: 'destination-domain', + description: + 'The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'destination.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the destination.', + type: 'keyword', + }, + 'destination.geo.city_name': { + dashed_name: 'destination-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'destination.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'destination.geo.continent_code': { + dashed_name: 'destination-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'destination.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'destination.geo.continent_name': { + dashed_name: 'destination-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'destination.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'destination.geo.country_iso_code': { + dashed_name: 'destination-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'destination.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'destination.geo.country_name': { + dashed_name: 'destination-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'destination.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'destination.geo.location': { + dashed_name: 'destination-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'destination.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'destination.geo.name': { + dashed_name: 'destination-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'destination.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'destination.geo.postal_code': { + dashed_name: 'destination-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'destination.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'destination.geo.region_iso_code': { + dashed_name: 'destination-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'destination.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'destination.geo.region_name': { + dashed_name: 'destination-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'destination.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'destination.geo.timezone': { + dashed_name: 'destination-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'destination.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'destination.ip': { + dashed_name: 'destination-ip', + description: 'IP address of the destination (IPv4 or IPv6).', + flat_name: 'destination.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the destination.', + type: 'ip', + }, + 'destination.mac': { + dashed_name: 'destination-mac', + description: + 'MAC address of the destination.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'destination.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the destination.', + type: 'keyword', + }, + 'destination.nat.ip': { + dashed_name: 'destination-nat-ip', + description: + 'Translated ip of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'destination.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Destination NAT ip', + type: 'ip', + }, + 'destination.nat.port': { + dashed_name: 'destination-nat-port', + description: + 'Port the source session is translated to by NAT Device.\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'destination.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Destination NAT Port', + type: 'long', + }, + 'destination.packets': { + dashed_name: 'destination-packets', + description: 'Packets sent from the destination to the source.', + example: 12, + flat_name: 'destination.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the destination to the source.', + type: 'long', + }, + 'destination.port': { + dashed_name: 'destination-port', + description: 'Port of the destination.', + flat_name: 'destination.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the destination.', + type: 'long', + }, + 'destination.registered_domain': { + dashed_name: 'destination-registered-domain', + description: + 'The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'destination.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered destination domain, stripped of the subdomain.', + type: 'keyword', + }, + 'destination.subdomain': { + dashed_name: 'destination-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'destination.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'destination.top_level_domain': { + dashed_name: 'destination-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'destination.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'destination.user.domain': { + dashed_name: 'destination-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'destination.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'destination.user.email': { + dashed_name: 'destination-user-email', + description: 'User email address.', + flat_name: 'destination.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'destination.user.full_name': { + dashed_name: 'destination-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'destination.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'destination.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'destination.user.group.domain': { + dashed_name: 'destination-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'destination.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'destination.user.group.id': { + dashed_name: 'destination-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'destination.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'destination.user.group.name': { + dashed_name: 'destination-user-group-name', + description: 'Name of the group.', + flat_name: 'destination.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'destination.user.hash': { + dashed_name: 'destination-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'destination.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'destination.user.id': { + dashed_name: 'destination-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'destination.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'destination.user.name': { + dashed_name: 'destination-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'destination.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'destination.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'destination.user.roles': { + dashed_name: 'destination-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'destination.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'destination', + nestings: ['destination.as', 'destination.geo', 'destination.user'], + prefix: 'destination.', + reused_here: [ + { + full: 'destination.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'destination.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'destination.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the destination side of a network connection, used with source.', + title: 'Destination', + type: 'group', + }, + device: { + beta: 'These fields are in beta and are subject to change.', + description: + 'Fields that describe a device instance and its characteristics. Data collected for applications and processes running on a (mobile) device can be enriched with these fields to describe the identity, type and other characteristics of the device.\nThis field group definition is based on the Device namespace of the OpenTelemetry Semantic Conventions (https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/device/).', + fields: { + 'device.id': { + dashed_name: 'device-id', + description: + 'The unique identifier of a device. The identifier must not change across application sessions but stay fixex for an instance of a (mobile) device. \nOn iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application.\nFor GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user.', + example: '00000000-54b3-e7c7-0000-000046bffd97', + flat_name: 'device.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'The unique identifier of a device.', + type: 'keyword', + }, + 'device.manufacturer': { + dashed_name: 'device-manufacturer', + description: 'The vendor name of the device manufacturer.', + example: 'Samsung', + flat_name: 'device.manufacturer', + ignore_above: 1024, + level: 'extended', + name: 'manufacturer', + normalize: [], + short: 'The vendor name of the device manufacturer.', + type: 'keyword', + }, + 'device.model.identifier': { + dashed_name: 'device-model-identifier', + description: 'The machine readable identifier of the device model.', + example: 'SM-G920F', + flat_name: 'device.model.identifier', + ignore_above: 1024, + level: 'extended', + name: 'model.identifier', + normalize: [], + short: 'The machine readable identifier of the device model.', + type: 'keyword', + }, + 'device.model.name': { + dashed_name: 'device-model-name', + description: 'The human readable marketing name of the device model.', + example: 'Samsung Galaxy S6', + flat_name: 'device.model.name', + ignore_above: 1024, + level: 'extended', + name: 'model.name', + normalize: [], + short: 'The human readable marketing name of the device model.', + type: 'keyword', + }, + }, + group: 2, + name: 'device', + prefix: 'device.', + short: 'Fields characterizing a (mobile) device a process or application is running on.', + title: 'Device', + type: 'group', + }, + dll: { + description: + 'These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS', + fields: { + 'dll.code_signature.digest_algorithm': { + dashed_name: 'dll-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'dll.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.exists': { + dashed_name: 'dll-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'dll.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'dll.code_signature.signing_id': { + dashed_name: 'dll-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'dll.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.status': { + dashed_name: 'dll-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'dll.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'dll.code_signature.subject_name': { + dashed_name: 'dll-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'dll.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'dll.code_signature.team_id': { + dashed_name: 'dll-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'dll.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.timestamp': { + dashed_name: 'dll-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'dll.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'dll.code_signature.trusted': { + dashed_name: 'dll-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'dll.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'dll.code_signature.valid': { + dashed_name: 'dll-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'dll.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'dll.hash.md5': { + dashed_name: 'dll-hash-md5', + description: 'MD5 hash.', + flat_name: 'dll.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'dll.hash.sha1': { + dashed_name: 'dll-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'dll.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'dll.hash.sha256': { + dashed_name: 'dll-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'dll.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'dll.hash.sha384': { + dashed_name: 'dll-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'dll.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'dll.hash.sha512': { + dashed_name: 'dll-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'dll.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'dll.hash.ssdeep': { + dashed_name: 'dll-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'dll.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'dll.hash.tlsh': { + dashed_name: 'dll-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'dll.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'dll.name': { + dashed_name: 'dll-name', + description: 'Name of the library.\nThis generally maps to the name of the file on disk.', + example: 'kernel32.dll', + flat_name: 'dll.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the library.', + type: 'keyword', + }, + 'dll.path': { + dashed_name: 'dll-path', + description: 'Full file path of the library.', + example: 'C:\\Windows\\System32\\kernel32.dll', + flat_name: 'dll.path', + ignore_above: 1024, + level: 'extended', + name: 'path', + normalize: [], + short: 'Full file path of the library.', + type: 'keyword', + }, + 'dll.pe.architecture': { + dashed_name: 'dll-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'dll.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'dll.pe.company': { + dashed_name: 'dll-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'dll.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.description': { + dashed_name: 'dll-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'dll.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.file_version': { + dashed_name: 'dll-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'dll.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'dll.pe.imphash': { + dashed_name: 'dll-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'dll.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'dll.pe.original_file_name': { + dashed_name: 'dll-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'dll.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.pehash': { + dashed_name: 'dll-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'dll.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'dll.pe.product': { + dashed_name: 'dll-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'dll.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + }, + group: 2, + name: 'dll', + nestings: ['dll.code_signature', 'dll.hash', 'dll.pe'], + prefix: 'dll.', + reused_here: [ + { + full: 'dll.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + { + full: 'dll.pe', + schema_name: 'pe', + short: 'These fields contain Windows Portable Executable (PE) metadata.', + }, + { + full: 'dll.code_signature', + schema_name: 'code_signature', + short: 'These fields contain information about binary code signatures.', + }, + ], + short: + 'These fields contain information about code libraries dynamically loaded into processes.', + title: 'DLL', + type: 'group', + }, + dns: { + description: + 'Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).', + fields: { + 'dns.answers': { + dashed_name: 'dns-answers', + description: + 'An array containing an object for each answer section returned by the server.\nThe main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.\nNot all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields.', + flat_name: 'dns.answers', + level: 'extended', + name: 'answers', + normalize: ['array'], + short: 'Array of DNS answers.', + type: 'object', + }, + 'dns.answers.class': { + dashed_name: 'dns-answers-class', + description: 'The class of DNS data contained in this resource record.', + example: 'IN', + flat_name: 'dns.answers.class', + ignore_above: 1024, + level: 'extended', + name: 'answers.class', + normalize: [], + short: 'The class of DNS data contained in this resource record.', + type: 'keyword', + }, + 'dns.answers.data': { + dashed_name: 'dns-answers-data', + description: + 'The data describing the resource.\nThe meaning of this data depends on the type and class of the resource record.', + example: '10.10.10.10', + flat_name: 'dns.answers.data', + ignore_above: 1024, + level: 'extended', + name: 'answers.data', + normalize: [], + short: 'The data describing the resource.', + type: 'keyword', + }, + 'dns.answers.name': { + dashed_name: 'dns-answers-name', + description: + "The domain name to which this resource record pertains.\nIf a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated.", + example: 'www.example.com', + flat_name: 'dns.answers.name', + ignore_above: 1024, + level: 'extended', + name: 'answers.name', + normalize: [], + short: 'The domain name to which this resource record pertains.', + type: 'keyword', + }, + 'dns.answers.ttl': { + dashed_name: 'dns-answers-ttl', + description: + 'The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.', + example: 180, + flat_name: 'dns.answers.ttl', + level: 'extended', + name: 'answers.ttl', + normalize: [], + short: + 'The time interval in seconds that this resource record may be cached before it should be discarded.', + type: 'long', + }, + 'dns.answers.type': { + dashed_name: 'dns-answers-type', + description: 'The type of data contained in this resource record.', + example: 'CNAME', + flat_name: 'dns.answers.type', + ignore_above: 1024, + level: 'extended', + name: 'answers.type', + normalize: [], + short: 'The type of data contained in this resource record.', + type: 'keyword', + }, + 'dns.header_flags': { + dashed_name: 'dns-header-flags', + description: 'Array of 2 letter DNS header flags.', + example: '["RD", "RA"]', + expected_values: ['AA', 'TC', 'RD', 'RA', 'AD', 'CD', 'DO'], + flat_name: 'dns.header_flags', + ignore_above: 1024, + level: 'extended', + name: 'header_flags', + normalize: ['array'], + short: 'Array of DNS header flags.', + type: 'keyword', + }, + 'dns.id': { + dashed_name: 'dns-id', + description: + 'The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.', + example: 62111, + flat_name: 'dns.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: + 'The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.', + type: 'keyword', + }, + 'dns.op_code': { + dashed_name: 'dns-op-code', + description: + 'The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.', + example: 'QUERY', + flat_name: 'dns.op_code', + ignore_above: 1024, + level: 'extended', + name: 'op_code', + normalize: [], + short: 'The DNS operation code that specifies the kind of query in the message.', + type: 'keyword', + }, + 'dns.question.class': { + dashed_name: 'dns-question-class', + description: 'The class of records being queried.', + example: 'IN', + flat_name: 'dns.question.class', + ignore_above: 1024, + level: 'extended', + name: 'question.class', + normalize: [], + short: 'The class of records being queried.', + type: 'keyword', + }, + 'dns.question.name': { + dashed_name: 'dns-question-name', + description: + 'The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.', + example: 'www.example.com', + flat_name: 'dns.question.name', + ignore_above: 1024, + level: 'extended', + name: 'question.name', + normalize: [], + short: 'The name being queried.', + type: 'keyword', + }, + 'dns.question.registered_domain': { + dashed_name: 'dns-question-registered-domain', + description: + 'The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'dns.question.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'question.registered_domain', + normalize: [], + short: 'The highest registered domain, stripped of the subdomain.', + type: 'keyword', + }, + 'dns.question.subdomain': { + dashed_name: 'dns-question-subdomain', + description: + 'The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'www', + flat_name: 'dns.question.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'question.subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'dns.question.top_level_domain': { + dashed_name: 'dns-question-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'dns.question.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'question.top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'dns.question.type': { + dashed_name: 'dns-question-type', + description: 'The type of record being queried.', + example: 'AAAA', + flat_name: 'dns.question.type', + ignore_above: 1024, + level: 'extended', + name: 'question.type', + normalize: [], + short: 'The type of record being queried.', + type: 'keyword', + }, + 'dns.resolved_ip': { + dashed_name: 'dns-resolved-ip', + description: + 'Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.', + example: '["10.10.10.10", "10.10.10.11"]', + flat_name: 'dns.resolved_ip', + level: 'extended', + name: 'resolved_ip', + normalize: ['array'], + short: 'Array containing all IPs seen in answers.data', + type: 'ip', + }, + 'dns.response_code': { + dashed_name: 'dns-response-code', + description: 'The DNS response code.', + example: 'NOERROR', + flat_name: 'dns.response_code', + ignore_above: 1024, + level: 'extended', + name: 'response_code', + normalize: [], + short: 'The DNS response code.', + type: 'keyword', + }, + 'dns.type': { + dashed_name: 'dns-type', + description: + 'The type of DNS event captured, query or answer.\nIf your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`.\nIf your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers.', + example: 'answer', + flat_name: 'dns.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'The type of DNS event captured, query or answer.', + type: 'keyword', + }, + }, + group: 2, + name: 'dns', + prefix: 'dns.', + short: 'Fields describing DNS queries and answers.', + title: 'DNS', + type: 'group', + }, + ecs: { + description: 'Meta-information specific to ECS.', + fields: { + 'ecs.version': { + dashed_name: 'ecs-version', + description: + 'ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.', + example: '1.0.0', + flat_name: 'ecs.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + required: true, + short: 'ECS version this event conforms to.', + type: 'keyword', + }, + }, + group: 2, + name: 'ecs', + prefix: 'ecs.', + short: 'Meta-information specific to ECS.', + title: 'ECS', + type: 'group', + }, + elf: { + beta: 'These fields are in beta and are subject to change.', + description: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + fields: { + 'elf.architecture': { + dashed_name: 'elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'elf.byte_order': { + dashed_name: 'elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'elf.cpu_type': { + dashed_name: 'elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'elf.creation_date': { + dashed_name: 'elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + short: 'Build or compile date.', + type: 'date', + }, + 'elf.exports': { + dashed_name: 'elf-exports', + description: 'List of exported element names and types.', + flat_name: 'elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'elf.header.abi_version': { + dashed_name: 'elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'elf.header.class': { + dashed_name: 'elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'elf.header.data': { + dashed_name: 'elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'elf.header.entrypoint': { + dashed_name: 'elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'elf.header.object_version': { + dashed_name: 'elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'elf.header.os_abi': { + dashed_name: 'elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'elf.header.type': { + dashed_name: 'elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'elf.header.version': { + dashed_name: 'elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'elf.imports': { + dashed_name: 'elf-imports', + description: 'List of imported element names and types.', + flat_name: 'elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'elf.sections': { + dashed_name: 'elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'elf.sections.chi2': { + dashed_name: 'elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'elf.sections.entropy': { + dashed_name: 'elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'elf.sections.flags': { + dashed_name: 'elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'elf.sections.name': { + dashed_name: 'elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + short: 'ELF Section List name.', + type: 'keyword', + }, + 'elf.sections.physical_offset': { + dashed_name: 'elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'elf.sections.physical_size': { + dashed_name: 'elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + short: 'ELF Section List physical size.', + type: 'long', + }, + 'elf.sections.type': { + dashed_name: 'elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + short: 'ELF Section List type.', + type: 'keyword', + }, + 'elf.sections.virtual_address': { + dashed_name: 'elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'elf.sections.virtual_size': { + dashed_name: 'elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'elf.segments': { + dashed_name: 'elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + short: 'ELF object segment list.', + type: 'nested', + }, + 'elf.segments.sections': { + dashed_name: 'elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'elf.segments.type': { + dashed_name: 'elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + short: 'ELF object segment type.', + type: 'keyword', + }, + 'elf.shared_libraries': { + dashed_name: 'elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'elf.telfhash': { + dashed_name: 'elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + }, + group: 2, + name: 'elf', + prefix: 'elf.', + reusable: { + expected: [ + { + as: 'elf', + at: 'file', + beta: 'This field reuse is beta and subject to change.', + full: 'file.elf', + }, + { + as: 'elf', + at: 'process', + beta: 'This field reuse is beta and subject to change.', + full: 'process.elf', + }, + ], + top_level: false, + }, + short: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + title: 'ELF Header', + type: 'group', + }, + email: { + description: + 'Event details relating to an email transaction.\nThis field set focuses on the email message header, body, and attachments. Network protocols that send and receive email messages such as SMTP are outside the scope of the `email.*` fields.', + fields: { + 'email.attachments': { + dashed_name: 'email-attachments', + description: + 'A list of objects describing the attachment files sent along with an email message.', + flat_name: 'email.attachments', + level: 'extended', + name: 'attachments', + normalize: ['array'], + short: 'List of objects describing the attachments.', + type: 'nested', + }, + 'email.attachments.file.extension': { + dashed_name: 'email-attachments-file-extension', + description: 'Attachment file extension, excluding the leading dot.', + example: 'txt', + flat_name: 'email.attachments.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.extension', + normalize: [], + short: 'Attachment file extension.', + type: 'keyword', + }, + 'email.attachments.file.hash.md5': { + dashed_name: 'email-attachments-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'email.attachments.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha1': { + dashed_name: 'email-attachments-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'email.attachments.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha256': { + dashed_name: 'email-attachments-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'email.attachments.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha384': { + dashed_name: 'email-attachments-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'email.attachments.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha512': { + dashed_name: 'email-attachments-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'email.attachments.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.ssdeep': { + dashed_name: 'email-attachments-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'email.attachments.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.tlsh': { + dashed_name: 'email-attachments-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'email.attachments.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'email.attachments.file.mime_type': { + dashed_name: 'email-attachments-file-mime-type', + description: + 'The MIME media type of the attachment.\nThis value will typically be extracted from the `Content-Type` MIME header field.', + example: 'text/plain', + flat_name: 'email.attachments.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.mime_type', + normalize: [], + short: 'MIME type of the attachment file.', + type: 'keyword', + }, + 'email.attachments.file.name': { + dashed_name: 'email-attachments-file-name', + description: 'Name of the attachment file including the file extension.', + example: 'attachment.txt', + flat_name: 'email.attachments.file.name', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.name', + normalize: [], + short: 'Name of the attachment file.', + type: 'keyword', + }, + 'email.attachments.file.size': { + dashed_name: 'email-attachments-file-size', + description: 'Attachment file size in bytes.', + example: 64329, + flat_name: 'email.attachments.file.size', + level: 'extended', + name: 'attachments.file.size', + normalize: [], + short: 'Attachment file size.', + type: 'long', + }, + 'email.bcc.address': { + dashed_name: 'email-bcc-address', + description: 'The email address of BCC recipient', + example: 'bcc.user1@example.com', + flat_name: 'email.bcc.address', + ignore_above: 1024, + level: 'extended', + name: 'bcc.address', + normalize: ['array'], + short: 'Email address of BCC recipient', + type: 'keyword', + }, + 'email.cc.address': { + dashed_name: 'email-cc-address', + description: 'The email address of CC recipient', + example: 'cc.user1@example.com', + flat_name: 'email.cc.address', + ignore_above: 1024, + level: 'extended', + name: 'cc.address', + normalize: ['array'], + short: 'Email address of CC recipient', + type: 'keyword', + }, + 'email.content_type': { + dashed_name: 'email-content-type', + description: + 'Information about how the message is to be displayed.\nTypically a MIME type.', + example: 'text/plain', + flat_name: 'email.content_type', + ignore_above: 1024, + level: 'extended', + name: 'content_type', + normalize: [], + short: 'MIME type of the email message.', + type: 'keyword', + }, + 'email.delivery_timestamp': { + dashed_name: 'email-delivery-timestamp', + description: + 'The date and time when the email message was received by the service or client.', + example: '2020-11-10T22:12:34.8196921Z', + flat_name: 'email.delivery_timestamp', + level: 'extended', + name: 'delivery_timestamp', + normalize: [], + short: 'Date and time when message was delivered.', + type: 'date', + }, + 'email.direction': { + dashed_name: 'email-direction', + description: 'The direction of the message based on the sending and receiving domains.', + example: 'inbound', + flat_name: 'email.direction', + ignore_above: 1024, + level: 'extended', + name: 'direction', + normalize: [], + short: 'Direction of the message.', + type: 'keyword', + }, + 'email.from.address': { + dashed_name: 'email-from-address', + description: + 'The email address of the sender, typically from the RFC 5322 `From:` header field.', + example: 'sender@example.com', + flat_name: 'email.from.address', + ignore_above: 1024, + level: 'extended', + name: 'from.address', + normalize: ['array'], + short: "The sender's email address.", + type: 'keyword', + }, + 'email.local_id': { + dashed_name: 'email-local-id', + description: + 'Unique identifier given to the email by the source that created the event.\nIdentifier is not persistent across hops.', + example: 'c26dbea0-80d5-463b-b93c-4e8b708219ce', + flat_name: 'email.local_id', + ignore_above: 1024, + level: 'extended', + name: 'local_id', + normalize: [], + short: 'Unique identifier given by the source.', + type: 'keyword', + }, + 'email.message_id': { + dashed_name: 'email-message-id', + description: + 'Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message.', + example: '81ce15$8r2j59@mail01.example.com', + flat_name: 'email.message_id', + level: 'extended', + name: 'message_id', + normalize: [], + short: 'Value from the Message-ID header.', + type: 'wildcard', + }, + 'email.origination_timestamp': { + dashed_name: 'email-origination-timestamp', + description: + 'The date and time the email message was composed. Many email clients will fill in this value automatically when the message is sent by a user.', + example: '2020-11-10T22:12:34.8196921Z', + flat_name: 'email.origination_timestamp', + level: 'extended', + name: 'origination_timestamp', + normalize: [], + short: 'Date and time the email was composed.', + type: 'date', + }, + 'email.reply_to.address': { + dashed_name: 'email-reply-to-address', + description: + 'The address that replies should be delivered to based on the value in the RFC 5322 `Reply-To:` header.', + example: 'reply.here@example.com', + flat_name: 'email.reply_to.address', + ignore_above: 1024, + level: 'extended', + name: 'reply_to.address', + normalize: ['array'], + short: 'Address replies should be delivered to.', + type: 'keyword', + }, + 'email.sender.address': { + dashed_name: 'email-sender-address', + description: + 'Per RFC 5322, specifies the address responsible for the actual transmission of the message.', + flat_name: 'email.sender.address', + ignore_above: 1024, + level: 'extended', + name: 'sender.address', + normalize: [], + short: 'Address of the message sender.', + type: 'keyword', + }, + 'email.subject': { + dashed_name: 'email-subject', + description: 'A brief summary of the topic of the message.', + example: 'Please see this important message.', + flat_name: 'email.subject', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'email.subject.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'subject', + normalize: [], + short: 'The subject of the email message.', + type: 'keyword', + }, + 'email.to.address': { + dashed_name: 'email-to-address', + description: 'The email address of recipient', + example: 'user1@example.com', + flat_name: 'email.to.address', + ignore_above: 1024, + level: 'extended', + name: 'to.address', + normalize: ['array'], + short: 'Email address of recipient', + type: 'keyword', + }, + 'email.x_mailer': { + dashed_name: 'email-x-mailer', + description: + 'The name of the application that was used to draft and send the original email message.', + example: 'Spambot v2.5', + flat_name: 'email.x_mailer', + ignore_above: 1024, + level: 'extended', + name: 'x_mailer', + normalize: [], + short: 'Application that drafted email.', + type: 'keyword', + }, + }, + group: 2, + name: 'email', + nestings: ['email.attachments.file.hash'], + prefix: 'email.', + reused_here: [ + { + full: 'email.attachments.file.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + ], + short: 'Describes an email transaction.', + title: 'Email', + type: 'group', + }, + error: { + description: + 'These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.', + fields: { + 'error.code': { + dashed_name: 'error-code', + description: 'Error code describing the error.', + flat_name: 'error.code', + ignore_above: 1024, + level: 'core', + name: 'code', + normalize: [], + short: 'Error code describing the error.', + type: 'keyword', + }, + 'error.id': { + dashed_name: 'error-id', + description: 'Unique identifier for the error.', + flat_name: 'error.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier for the error.', + type: 'keyword', + }, + 'error.message': { + dashed_name: 'error-message', + description: 'Error message.', + flat_name: 'error.message', + level: 'core', + name: 'message', + normalize: [], + short: 'Error message.', + type: 'match_only_text', + }, + 'error.stack_trace': { + dashed_name: 'error-stack-trace', + description: 'The stack trace of this error in plain text.', + flat_name: 'error.stack_trace', + level: 'extended', + multi_fields: [ + { + flat_name: 'error.stack_trace.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'stack_trace', + normalize: [], + short: 'The stack trace of this error in plain text.', + type: 'wildcard', + }, + 'error.type': { + dashed_name: 'error-type', + description: 'The type of the error, for example the class name of the exception.', + example: 'java.lang.NullPointerException', + flat_name: 'error.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'The type of the error, for example the class name of the exception.', + type: 'keyword', + }, + }, + group: 2, + name: 'error', + prefix: 'error.', + short: 'Fields about errors of any kind.', + title: 'Error', + type: 'group', + }, + event: { + description: + 'The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.', + fields: { + 'event.action': { + dashed_name: 'event-action', + description: + 'The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.', + example: 'user-password-change', + flat_name: 'event.action', + ignore_above: 1024, + level: 'core', + name: 'action', + normalize: [], + short: 'The action captured by the event.', + type: 'keyword', + }, + 'event.agent_id_status': { + dashed_name: 'event-agent-id-status', + description: + "Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation.\nFor example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used.\nIf no validation is performed then the field should be omitted.\nThe allowed values are:\n`verified` - The `agent.id` field value matches expected value obtained from auth metadata.\n`mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata.\n`missing` - There was no `agent.id` field in the event to validate.\n`auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID.", + example: 'verified', + flat_name: 'event.agent_id_status', + ignore_above: 1024, + level: 'extended', + name: 'agent_id_status', + normalize: [], + short: "Validation status of the event's agent.id field.", + type: 'keyword', + }, + 'event.category': { + allowed_values: [ + { + description: + 'Events in this category are related to the challenge and response process in which credentials are supplied and verified to allow the creation of a session. Common sources for these logs are Windows event logs and ssh logs. Visualize and analyze events in this category to look for failed logins, and other authentication-related activity.', + expected_event_types: ['start', 'end', 'info'], + name: 'authentication', + }, + { + description: + 'Events in the configuration category have to deal with creating, modifying, or deleting the settings or parameters of an application, process, or system.\nExample sources include security policy change logs, configuration auditing logging, and system integrity monitoring.', + expected_event_types: ['access', 'change', 'creation', 'deletion', 'info'], + name: 'configuration', + }, + { + description: + 'The database category denotes events and metrics relating to a data storage and retrieval system. Note that use of this category is not limited to relational database systems. Examples include event logs from MS SQL, MySQL, Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database activity such as accesses and changes.', + expected_event_types: ['access', 'change', 'info', 'error'], + name: 'database', + }, + { + description: + 'Events in the driver category have to do with operating system device drivers and similar software entities such as Windows drivers, kernel extensions, kernel modules, etc.\nUse events and metrics in this category to visualize and analyze driver-related activity and status on hosts.', + expected_event_types: ['change', 'end', 'info', 'start'], + name: 'driver', + }, + { + description: + 'This category is used for events relating to email messages, email attachments, and email network or protocol activity.\nEmails events can be produced by email security gateways, mail transfer agents, email cloud service providers, or mail server monitoring applications.', + expected_event_types: ['info'], + name: 'email', + }, + { + description: + 'Relating to a set of information that has been created on, or has existed on a filesystem. Use this category of events to visualize and analyze the creation, access, and deletions of files. Events in this category can come from both host-based and network-based sources. An example source of a network-based detection of a file transfer would be the Zeek file.log.', + expected_event_types: ['change', 'creation', 'deletion', 'info'], + name: 'file', + }, + { + description: + 'Use this category to visualize and analyze information such as host inventory or host lifecycle events.\nMost of the events in this category can usually be observed from the outside, such as from a hypervisor or a control plane\'s point of view. Some can also be seen from within, such as "start" or "end".\nNote that this category is for information about hosts themselves; it is not meant to capture activity "happening on a host".', + expected_event_types: ['access', 'change', 'end', 'info', 'start'], + name: 'host', + }, + { + description: + 'Identity and access management (IAM) events relating to users, groups, and administration. Use this category to visualize and analyze IAM-related logs and data from active directory, LDAP, Okta, Duo, and other IAM systems.', + expected_event_types: [ + 'admin', + 'change', + 'creation', + 'deletion', + 'group', + 'info', + 'user', + ], + name: 'iam', + }, + { + description: + 'Relating to intrusion detections from IDS/IPS systems and functions, both network and host-based. Use this category to visualize and analyze intrusion detection alerts from systems such as Snort, Suricata, and Palo Alto threat detections.', + expected_event_types: ['allowed', 'denied', 'info'], + name: 'intrusion_detection', + }, + { + description: + 'Malware detection events and alerts. Use this category to visualize and analyze malware detections from EDR/EPP systems such as Elastic Endpoint Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems such as Suricata, or other sources of malware-related events such as Palo Alto Networks threat logs and Wildfire logs.', + expected_event_types: ['info'], + name: 'malware', + }, + { + description: + 'Relating to all network activity, including network connection lifecycle, network traffic, and essentially any event that includes an IP address. Many events containing decoded network protocol transactions fit into this category. Use events in this category to visualize or analyze counts of network ports, protocols, addresses, geolocation information, etc.', + expected_event_types: [ + 'access', + 'allowed', + 'connection', + 'denied', + 'end', + 'info', + 'protocol', + 'start', + ], + name: 'network', + }, + { + description: + 'Relating to software packages installed on hosts. Use this category to visualize and analyze inventory of software installed on various hosts, or to determine host vulnerability in the absence of vulnerability scan data.', + expected_event_types: ['access', 'change', 'deletion', 'info', 'installation', 'start'], + name: 'package', + }, + { + description: + 'Use this category of events to visualize and analyze process-specific information such as lifecycle events or process ancestry.', + expected_event_types: ['access', 'change', 'end', 'info', 'start'], + name: 'process', + }, + { + description: + 'Having to do with settings and assets stored in the Windows registry. Use this category to visualize and analyze activity such as registry access and modifications.', + expected_event_types: ['access', 'change', 'creation', 'deletion'], + name: 'registry', + }, + { + description: + 'The session category is applied to events and metrics regarding logical persistent connections to hosts and services. Use this category to visualize and analyze interactive or automated persistent connections between assets. Data for this category may come from Windows Event logs, SSH logs, or stateless sessions such as HTTP cookie-based sessions, etc.', + expected_event_types: ['start', 'end', 'info'], + name: 'session', + }, + { + description: + "Use this category to visualize and analyze events describing threat actors' targets, motives, or behaviors.", + expected_event_types: ['indicator'], + name: 'threat', + }, + { + description: + 'Relating to vulnerability scan results. Use this category to analyze vulnerabilities detected by Tenable, Qualys, internal scanners, and other vulnerability management sources.', + expected_event_types: ['info'], + name: 'vulnerability', + }, + { + description: + 'Relating to web server access. Use this category to create a dashboard of web server/proxy activity from apache, IIS, nginx web servers, etc. Note: events from network observers such as Zeek http log may also be included in this category.', + expected_event_types: ['access', 'error', 'info'], + name: 'web', + }, + ], + dashed_name: 'event-category', + description: + 'This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.', + example: 'authentication', + flat_name: 'event.category', + ignore_above: 1024, + level: 'core', + name: 'category', + normalize: ['array'], + short: 'Event category. The second categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.code': { + dashed_name: 'event-code', + description: + 'Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.', + example: 4648, + flat_name: 'event.code', + ignore_above: 1024, + level: 'extended', + name: 'code', + normalize: [], + short: 'Identification code for this event.', + type: 'keyword', + }, + 'event.created': { + dashed_name: 'event-created', + description: + "event.created contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, @timestamp should be used.", + example: '2016-05-23T08:05:34.857Z', + flat_name: 'event.created', + level: 'core', + name: 'created', + normalize: [], + short: 'Time when the event was first read by an agent or by your pipeline.', + type: 'date', + }, + 'event.dataset': { + dashed_name: 'event-dataset', + description: + "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.", + example: 'apache.access', + flat_name: 'event.dataset', + ignore_above: 1024, + level: 'core', + name: 'dataset', + normalize: [], + short: 'Name of the dataset.', + type: 'keyword', + }, + 'event.duration': { + dashed_name: 'event-duration', + description: + 'Duration of the event in nanoseconds.\nIf event.start and event.end are known this value should be the difference between the end and start time.', + flat_name: 'event.duration', + format: 'duration', + input_format: 'nanoseconds', + level: 'core', + name: 'duration', + normalize: [], + output_format: 'asMilliseconds', + output_precision: 1, + short: 'Duration of the event in nanoseconds.', + type: 'long', + }, + 'event.end': { + dashed_name: 'event-end', + description: + 'event.end contains the date when the event ended or when the activity was last observed.', + flat_name: 'event.end', + level: 'extended', + name: 'end', + normalize: [], + short: + 'event.end contains the date when the event ended or when the activity was last observed.', + type: 'date', + }, + 'event.hash': { + dashed_name: 'event-hash', + description: + 'Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.', + example: '123456789012345678901234567890ABCD', + flat_name: 'event.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + short: + 'Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.', + type: 'keyword', + }, + 'event.id': { + dashed_name: 'event-id', + description: 'Unique ID to describe the event.', + example: '8a4f500d', + flat_name: 'event.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique ID to describe the event.', + type: 'keyword', + }, + 'event.ingested': { + dashed_name: 'event-ingested', + description: + "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.", + example: '2016-05-23T08:05:35.101Z', + flat_name: 'event.ingested', + level: 'core', + name: 'ingested', + normalize: [], + short: 'Timestamp when an event arrived in the central data store.', + type: 'date', + }, + 'event.kind': { + allowed_values: [ + { + description: + 'This value indicates an event such as an alert or notable event, triggered by a detection rule executing externally to the Elastic Stack.\n`event.kind:alert` is often populated for events coming from firewalls, intrusion detection systems, endpoint detection and response systems, and so on.\nThis value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.', + name: 'alert', + }, + { + description: + 'The `enrichment` value indicates an event collected to provide additional context, often to other events.\nAn example is collecting indicators of compromise (IOCs) from a threat intelligence provider with the intent to use those values to enrich other events. The IOC events from the intelligence provider should be categorized as `event.kind:enrichment`.', + name: 'enrichment', + }, + { + description: + 'This value is the most general and most common value for this field. It is used to represent events that indicate that something happened.', + name: 'event', + }, + { + description: + 'This value is used to indicate that this event describes a numeric measurement taken at given point in time.\nExamples include CPU utilization, memory usage, or device temperature.\nMetric events are often collected on a predictable frequency, such as once every few seconds, or once a minute, but can also be used to describe ad-hoc numeric metric queries.', + name: 'metric', + }, + { + description: + "The state value is similar to metric, indicating that this event describes a measurement taken at given point in time, except that the measurement does not result in a numeric value, but rather one of a fixed set of categorical values that represent conditions or states.\nExamples include periodic events reporting Elasticsearch cluster state (green/yellow/red), the state of a TCP connection (open, closed, fin_wait, etc.), the state of a host with respect to a software vulnerability (vulnerable, not vulnerable), and the state of a system regarding compliance with a regulatory standard (compliant, not compliant).\nNote that an event that describes a change of state would not use `event.kind:state`, but instead would use 'event.kind:event' since a state change fits the more general event definition of something that happened.\nState events are often collected on a predictable frequency, such as once every few seconds, once a minute, once an hour, or once a day, but can also be used to describe ad-hoc state queries.", + name: 'state', + }, + { + description: + 'This value indicates that an error occurred during the ingestion of this event, and that event data may be missing, inconsistent, or incorrect. `event.kind:pipeline_error` is often associated with parsing errors.', + name: 'pipeline_error', + }, + { + description: + 'This value is used by Elastic solutions (e.g., Security, Observability) for alert documents that are created by rules executing within the Kibana alerting framework.\nUsage of this value is reserved, and data ingestion pipelines must not populate `event.kind` with the value "signal".', + name: 'signal', + }, + ], + dashed_name: 'event-kind', + description: + 'This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.', + example: 'alert', + flat_name: 'event.kind', + ignore_above: 1024, + level: 'core', + name: 'kind', + normalize: [], + short: 'The kind of the event. The highest categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.module': { + dashed_name: 'event-module', + description: + 'Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.', + example: 'apache', + flat_name: 'event.module', + ignore_above: 1024, + level: 'core', + name: 'module', + normalize: [], + short: 'Name of the module this data is coming from.', + type: 'keyword', + }, + 'event.original': { + dashed_name: 'event-original', + description: + 'Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex.\nThis field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`.', + doc_values: false, + example: + 'Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232', + flat_name: 'event.original', + index: false, + level: 'core', + name: 'original', + normalize: [], + short: 'Raw text message of entire event.', + type: 'keyword', + }, + 'event.outcome': { + allowed_values: [ + { + description: + 'Indicates that this event describes a failed result. A common example is `event.category:file AND event.type:access AND event.outcome:failure` to indicate that a file access was attempted, but was not successful.', + name: 'failure', + }, + { + description: + 'Indicates that this event describes a successful result. A common example is `event.category:file AND event.type:create AND event.outcome:success` to indicate that a file was successfully created.', + name: 'success', + }, + { + description: + "Indicates that this event describes only an attempt for which the result is unknown from the perspective of the event producer. For example, if the event contains information only about the request side of a transaction that results in a response, populating `event.outcome:unknown` in the request event is appropriate. The unknown value should not be used when an outcome doesn't make logical sense for the event. In such cases `event.outcome` should not be populated.", + name: 'unknown', + }, + ], + dashed_name: 'event-outcome', + description: + 'This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.', + example: 'success', + flat_name: 'event.outcome', + ignore_above: 1024, + level: 'core', + name: 'outcome', + normalize: [], + short: 'The outcome of the event. The lowest level categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.provider': { + dashed_name: 'event-provider', + description: + 'Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).', + example: 'kernel', + flat_name: 'event.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + short: 'Source of the event.', + type: 'keyword', + }, + 'event.reason': { + dashed_name: 'event-reason', + description: + 'Reason why this event happened, according to the source.\nThis describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`).', + example: 'Terminated an unexpected process', + flat_name: 'event.reason', + ignore_above: 1024, + level: 'extended', + name: 'reason', + normalize: [], + short: 'Reason why this event happened, according to the source', + type: 'keyword', + }, + 'event.reference': { + dashed_name: 'event-reference', + description: + 'Reference URL linking to additional information about this event.\nThis URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field.', + example: 'https://system.example.com/event/#0001234', + flat_name: 'event.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Event reference URL', + type: 'keyword', + }, + 'event.risk_score': { + dashed_name: 'event-risk-score', + description: + "Risk score or priority of the event (e.g. security solutions). Use your system's original value here.", + flat_name: 'event.risk_score', + level: 'core', + name: 'risk_score', + normalize: [], + short: + "Risk score or priority of the event (e.g. security solutions). Use your system's original value here.", + type: 'float', + }, + 'event.risk_score_norm': { + dashed_name: 'event-risk-score-norm', + description: + 'Normalized risk score or priority of the event, on a scale of 0 to 100.\nThis is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems.', + flat_name: 'event.risk_score_norm', + level: 'extended', + name: 'risk_score_norm', + normalize: [], + short: 'Normalized risk score or priority of the event (0-100).', + type: 'float', + }, + 'event.sequence': { + dashed_name: 'event-sequence', + description: + 'Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.', + flat_name: 'event.sequence', + format: 'string', + level: 'extended', + name: 'sequence', + normalize: [], + short: 'Sequence number of the event.', + type: 'long', + }, + 'event.severity': { + dashed_name: 'event-severity', + description: + "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.", + example: 7, + flat_name: 'event.severity', + format: 'string', + level: 'core', + name: 'severity', + normalize: [], + short: 'Numeric severity of the event.', + type: 'long', + }, + 'event.start': { + dashed_name: 'event-start', + description: + 'event.start contains the date when the event started or when the activity was first observed.', + flat_name: 'event.start', + level: 'extended', + name: 'start', + normalize: [], + short: + 'event.start contains the date when the event started or when the activity was first observed.', + type: 'date', + }, + 'event.timezone': { + dashed_name: 'event-timezone', + description: + 'This field should be populated when the event\'s timestamp does not include timezone information already (e.g. default Syslog timestamps). It\'s optional otherwise.\nAcceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").', + flat_name: 'event.timezone', + ignore_above: 1024, + level: 'extended', + name: 'timezone', + normalize: [], + short: 'Event time zone.', + type: 'keyword', + }, + 'event.type': { + allowed_values: [ + { + description: + 'The access event type is used for the subset of events within a category that indicate that something was accessed. Common examples include `event.category:database AND event.type:access`, or `event.category:file AND event.type:access`. Note for file access, both directory listings and file opens should be included in this subcategory. You can further distinguish access operations using the ECS `event.action` field.', + name: 'access', + }, + { + description: + 'The admin event type is used for the subset of events within a category that are related to admin objects. For example, administrative changes within an IAM framework that do not specifically affect a user or group (e.g., adding new applications to a federation solution or connecting discrete forests in Active Directory) would fall into this subcategory. Common example: `event.category:iam AND event.type:change AND event.type:admin`. You can further distinguish admin operations using the ECS `event.action` field.', + name: 'admin', + }, + { + description: + 'The allowed event type is used for the subset of events within a category that indicate that something was allowed. Common examples include `event.category:network AND event.type:connection AND event.type:allowed` (to indicate a network firewall event for which the firewall disposition was to allow the connection to complete) and `event.category:intrusion_detection AND event.type:allowed` (to indicate a network intrusion prevention system event for which the IPS disposition was to allow the connection to complete). You can further distinguish allowed operations using the ECS `event.action` field, populating with values of your choosing, such as "allow", "detect", or "pass".', + name: 'allowed', + }, + { + description: + 'The change event type is used for the subset of events within a category that indicate that something has changed. If semantics best describe an event as modified, then include them in this subcategory. Common examples include `event.category:process AND event.type:change`, and `event.category:file AND event.type:change`. You can further distinguish change operations using the ECS `event.action` field.', + name: 'change', + }, + { + description: + 'Used primarily with `event.category:network` this value is used for the subset of network traffic that includes sufficient information for the event to be included in flow or connection analysis. Events in this subcategory will contain at least source and destination IP addresses, source and destination TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred. Events in this subcategory may contain unidirectional or bidirectional information, including summary information. Use this subcategory to visualize and analyze network connections. Flow analysis, including Netflow, IPFIX, and other flow-related events fit in this subcategory. Note that firewall events from many Next-Generation Firewall (NGFW) devices will also fit into this subcategory. A common filter for flow/connection information would be `event.category:network AND event.type:connection AND event.type:end` (to view or analyze all completed network connections, ignoring mid-flow reports). You can further distinguish connection events using the ECS `event.action` field, populating with values of your choosing, such as "timeout", or "reset".', + name: 'connection', + }, + { + description: + 'The "creation" event type is used for the subset of events within a category that indicate that something was created. A common example is `event.category:file AND event.type:creation`.', + name: 'creation', + }, + { + description: + 'The deletion event type is used for the subset of events within a category that indicate that something was deleted. A common example is `event.category:file AND event.type:deletion` to indicate that a file has been deleted.', + name: 'deletion', + }, + { + description: + 'The denied event type is used for the subset of events within a category that indicate that something was denied. Common examples include `event.category:network AND event.type:denied` (to indicate a network firewall event for which the firewall disposition was to deny the connection) and `event.category:intrusion_detection AND event.type:denied` (to indicate a network intrusion prevention system event for which the IPS disposition was to deny the connection to complete). You can further distinguish denied operations using the ECS `event.action` field, populating with values of your choosing, such as "blocked", "dropped", or "quarantined".', + name: 'denied', + }, + { + description: + 'The end event type is used for the subset of events within a category that indicate something has ended. A common example is `event.category:process AND event.type:end`.', + name: 'end', + }, + { + description: + 'The error event type is used for the subset of events within a category that indicate or describe an error. A common example is `event.category:database AND event.type:error`. Note that pipeline errors that occur during the event ingestion process should not use this `event.type` value. Instead, they should use `event.kind:pipeline_error`.', + name: 'error', + }, + { + description: + 'The group event type is used for the subset of events within a category that are related to group objects. Common example: `event.category:iam AND event.type:creation AND event.type:group`. You can further distinguish group operations using the ECS `event.action` field.', + name: 'group', + }, + { + description: + 'The indicator event type is used for the subset of events within a category that contain details about indicators of compromise (IOCs).\nA common example is `event.category:threat AND event.type:indicator`.', + name: 'indicator', + }, + { + description: + 'The info event type is used for the subset of events within a category that indicate that they are purely informational, and don\'t report a state change, or any type of action. For example, an initial run of a file integrity monitoring system (FIM), where an agent reports all files under management, would fall into the "info" subcategory. Similarly, an event containing a dump of all currently running processes (as opposed to reporting that a process started/ended) would fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection AND event.type:info`.', + name: 'info', + }, + { + description: + 'The installation event type is used for the subset of events within a category that indicate that something was installed. A common example is `event.category:package` AND `event.type:installation`.', + name: 'installation', + }, + { + description: + 'The protocol event type is used for the subset of events within a category that indicate that they contain protocol details or analysis, beyond simply identifying the protocol. Generally, network events that contain specific protocol details will fall into this subcategory. A common example is `event.category:network AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate that the event is a network connection event sent at the end of a connection that also includes a protocol detail breakdown). Note that events that only indicate the name or id of the protocol should not use the protocol value. Further note that when the protocol subcategory is used, the identified protocol is populated in the ECS `network.protocol` field.', + name: 'protocol', + }, + { + description: + 'The start event type is used for the subset of events within a category that indicate something has started. A common example is `event.category:process AND event.type:start`.', + name: 'start', + }, + { + description: + 'The user event type is used for the subset of events within a category that are related to user objects. Common example: `event.category:iam AND event.type:deletion AND event.type:user`. You can further distinguish user operations using the ECS `event.action` field.', + name: 'user', + }, + ], + dashed_name: 'event-type', + description: + 'This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.', + flat_name: 'event.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: ['array'], + short: 'Event type. The third categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.url': { + dashed_name: 'event-url', + description: + 'URL linking to an external system to continue investigation of this event.\nThis URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field.', + example: 'https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe', + flat_name: 'event.url', + ignore_above: 1024, + level: 'extended', + name: 'url', + normalize: [], + short: 'Event investigation URL', + type: 'keyword', + }, + }, + group: 2, + name: 'event', + prefix: 'event.', + short: 'Fields breaking down the event details.', + title: 'Event', + type: 'group', + }, + faas: { + beta: 'These fields are in beta and are subject to change.', + description: + 'The user fields describe information about the function as a service (FaaS) that is relevant to the event.', + fields: { + 'faas.coldstart': { + dashed_name: 'faas-coldstart', + description: 'Boolean value indicating a cold start of a function.', + flat_name: 'faas.coldstart', + level: 'extended', + name: 'coldstart', + normalize: [], + short: 'Boolean value indicating a cold start of a function.', + type: 'boolean', + }, + 'faas.execution': { + dashed_name: 'faas-execution', + description: 'The execution ID of the current function execution.', + example: 'af9d5aa4-a685-4c5f-a22b-444f80b3cc28', + flat_name: 'faas.execution', + ignore_above: 1024, + level: 'extended', + name: 'execution', + normalize: [], + short: 'The execution ID of the current function execution.', + type: 'keyword', + }, + 'faas.id': { + dashed_name: 'faas-id', + description: + "The unique identifier of a serverless function.\nFor AWS Lambda it's the function ARN (Amazon Resource Name) without a version or alias suffix.", + example: 'arn:aws:lambda:us-west-2:123456789012:function:my-function', + flat_name: 'faas.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'The unique identifier of a serverless function.', + type: 'keyword', + }, + 'faas.name': { + dashed_name: 'faas-name', + description: 'The name of a serverless function.', + example: 'my-function', + flat_name: 'faas.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'The name of a serverless function.', + type: 'keyword', + }, + 'faas.trigger': { + dashed_name: 'faas-trigger', + description: 'Details about the function trigger.', + flat_name: 'faas.trigger', + level: 'extended', + name: 'trigger', + normalize: [], + short: 'Details about the function trigger.', + type: 'nested', + }, + 'faas.trigger.request_id': { + dashed_name: 'faas-trigger-request-id', + description: 'The ID of the trigger request , message, event, etc.', + example: 123456789, + flat_name: 'faas.trigger.request_id', + ignore_above: 1024, + level: 'extended', + name: 'trigger.request_id', + normalize: [], + short: 'The ID of the trigger request , message, event, etc.', + type: 'keyword', + }, + 'faas.trigger.type': { + dashed_name: 'faas-trigger-type', + description: 'The trigger for the function execution.', + example: 'http', + expected_values: ['http', 'pubsub', 'datasource', 'timer', 'other'], + flat_name: 'faas.trigger.type', + ignore_above: 1024, + level: 'extended', + name: 'trigger.type', + normalize: [], + short: 'The trigger for the function execution.', + type: 'keyword', + }, + 'faas.version': { + dashed_name: 'faas-version', + description: 'The version of a serverless function.', + example: '123', + flat_name: 'faas.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'The version of a serverless function.', + type: 'keyword', + }, + }, + group: 2, + name: 'faas', + prefix: 'faas.', + short: 'Fields describing functions as a service.', + title: 'FaaS', + type: 'group', + }, + file: { + description: + 'A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.', + fields: { + 'file.accessed': { + dashed_name: 'file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + short: 'Last time the file was accessed.', + type: 'date', + }, + 'file.attributes': { + dashed_name: 'file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + short: 'Array of file attributes.', + type: 'keyword', + }, + 'file.code_signature.digest_algorithm': { + dashed_name: 'file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.exists': { + dashed_name: 'file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'file.code_signature.signing_id': { + dashed_name: 'file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.status': { + dashed_name: 'file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'file.code_signature.subject_name': { + dashed_name: 'file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'file.code_signature.team_id': { + dashed_name: 'file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.timestamp': { + dashed_name: 'file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'file.code_signature.trusted': { + dashed_name: 'file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'file.code_signature.valid': { + dashed_name: 'file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'file.created': { + dashed_name: 'file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'file.created', + level: 'extended', + name: 'created', + normalize: [], + short: 'File creation time.', + type: 'date', + }, + 'file.ctime': { + dashed_name: 'file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'file.device': { + dashed_name: 'file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'file.directory': { + dashed_name: 'file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'file.drive_letter': { + dashed_name: 'file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'file.elf.architecture': { + dashed_name: 'file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'file.elf.byte_order': { + dashed_name: 'file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'file.elf.cpu_type': { + dashed_name: 'file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'file.elf.creation_date': { + dashed_name: 'file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'file.elf.exports': { + dashed_name: 'file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'file.elf.header.abi_version': { + dashed_name: 'file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'file.elf.header.class': { + dashed_name: 'file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'file.elf.header.data': { + dashed_name: 'file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'file.elf.header.entrypoint': { + dashed_name: 'file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'file.elf.header.object_version': { + dashed_name: 'file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'file.elf.header.os_abi': { + dashed_name: 'file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'file.elf.header.type': { + dashed_name: 'file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'file.elf.header.version': { + dashed_name: 'file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'file.elf.imports': { + dashed_name: 'file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'file.elf.sections': { + dashed_name: 'file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'file.elf.sections.chi2': { + dashed_name: 'file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'file.elf.sections.entropy': { + dashed_name: 'file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'file.elf.sections.flags': { + dashed_name: 'file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'file.elf.sections.name': { + dashed_name: 'file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'file.elf.sections.physical_offset': { + dashed_name: 'file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'file.elf.sections.physical_size': { + dashed_name: 'file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'file.elf.sections.type': { + dashed_name: 'file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'file.elf.sections.virtual_address': { + dashed_name: 'file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'file.elf.sections.virtual_size': { + dashed_name: 'file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'file.elf.segments': { + dashed_name: 'file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'file.elf.segments.sections': { + dashed_name: 'file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'file.elf.segments.type': { + dashed_name: 'file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'file.elf.shared_libraries': { + dashed_name: 'file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'file.elf.telfhash': { + dashed_name: 'file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'file.extension': { + dashed_name: 'file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'file.fork_name': { + dashed_name: 'file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'file.gid': { + dashed_name: 'file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'file.group': { + dashed_name: 'file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'file.hash.md5': { + dashed_name: 'file-hash-md5', + description: 'MD5 hash.', + flat_name: 'file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'file.hash.sha1': { + dashed_name: 'file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'file.hash.sha256': { + dashed_name: 'file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'file.hash.sha384': { + dashed_name: 'file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'file.hash.sha512': { + dashed_name: 'file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'file.hash.ssdeep': { + dashed_name: 'file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'file.hash.tlsh': { + dashed_name: 'file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'file.inode': { + dashed_name: 'file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'file.mime_type': { + dashed_name: 'file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'file.mode': { + dashed_name: 'file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'file.mtime': { + dashed_name: 'file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + short: 'Last time the file content was modified.', + type: 'date', + }, + 'file.name': { + dashed_name: 'file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'file.owner': { + dashed_name: 'file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + short: "File owner's username.", + type: 'keyword', + }, + 'file.path': { + dashed_name: 'file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'file.pe.architecture': { + dashed_name: 'file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'file.pe.company': { + dashed_name: 'file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.description': { + dashed_name: 'file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.file_version': { + dashed_name: 'file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'file.pe.imphash': { + dashed_name: 'file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'file.pe.original_file_name': { + dashed_name: 'file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.pehash': { + dashed_name: 'file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'file.pe.product': { + dashed_name: 'file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.size': { + dashed_name: 'file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'file.size', + level: 'extended', + name: 'size', + normalize: [], + short: 'File size in bytes.', + type: 'long', + }, + 'file.target_path': { + dashed_name: 'file-target-path', + description: 'Target path for symlinks.', + flat_name: 'file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'file.type': { + dashed_name: 'file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'file.uid': { + dashed_name: 'file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'file.x509.alternative_names': { + dashed_name: 'file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'file.x509.issuer.common_name': { + dashed_name: 'file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.country': { + dashed_name: 'file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'file.x509.issuer.distinguished_name': { + dashed_name: 'file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.locality': { + dashed_name: 'file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'file.x509.issuer.organization': { + dashed_name: 'file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.organizational_unit': { + dashed_name: 'file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.state_or_province': { + dashed_name: 'file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'file.x509.not_after': { + dashed_name: 'file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'file.x509.not_before': { + dashed_name: 'file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'file.x509.public_key_algorithm': { + dashed_name: 'file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'file.x509.public_key_curve': { + dashed_name: 'file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'file.x509.public_key_exponent': { + dashed_name: 'file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'file.x509.public_key_size': { + dashed_name: 'file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'file.x509.serial_number': { + dashed_name: 'file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'file.x509.signature_algorithm': { + dashed_name: 'file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'file.x509.subject.common_name': { + dashed_name: 'file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'file.x509.subject.country': { + dashed_name: 'file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'file.x509.subject.distinguished_name': { + dashed_name: 'file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'file.x509.subject.locality': { + dashed_name: 'file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'file.x509.subject.organization': { + dashed_name: 'file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'file.x509.subject.organizational_unit': { + dashed_name: 'file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'file.x509.subject.state_or_province': { + dashed_name: 'file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'file.x509.version_number': { + dashed_name: 'file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + }, + group: 2, + name: 'file', + nestings: ['file.code_signature', 'file.elf', 'file.hash', 'file.pe', 'file.x509'], + prefix: 'file.', + reusable: { + expected: [ + { as: 'file', at: 'threat.indicator', full: 'threat.indicator.file' }, + { + as: 'file', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.file', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'file.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + { + full: 'file.pe', + schema_name: 'pe', + short: 'These fields contain Windows Portable Executable (PE) metadata.', + }, + { + full: 'file.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'file.code_signature', + schema_name: 'code_signature', + short: 'These fields contain information about binary code signatures.', + }, + { + beta: 'This field reuse is beta and subject to change.', + full: 'file.elf', + schema_name: 'elf', + short: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + }, + ], + short: 'Fields describing files.', + title: 'File', + type: 'group', + }, + geo: { + description: + 'Geo fields can carry data about a specific location related to an event.\nThis geolocation information can be derived from techniques such as Geo IP, or be user-supplied.', + fields: { + 'geo.city_name': { + dashed_name: 'geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + short: 'City name.', + type: 'keyword', + }, + 'geo.continent_code': { + dashed_name: 'geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + short: 'Continent code.', + type: 'keyword', + }, + 'geo.continent_name': { + dashed_name: 'geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + short: 'Name of the continent.', + type: 'keyword', + }, + 'geo.country_iso_code': { + dashed_name: 'geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + short: 'Country ISO code.', + type: 'keyword', + }, + 'geo.country_name': { + dashed_name: 'geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + short: 'Country name.', + type: 'keyword', + }, + 'geo.location': { + dashed_name: 'geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'geo.location', + level: 'core', + name: 'location', + normalize: [], + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'geo.name': { + dashed_name: 'geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'geo.postal_code': { + dashed_name: 'geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + short: 'Postal code.', + type: 'keyword', + }, + 'geo.region_iso_code': { + dashed_name: 'geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + short: 'Region ISO code.', + type: 'keyword', + }, + 'geo.region_name': { + dashed_name: 'geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + short: 'Region name.', + type: 'keyword', + }, + 'geo.timezone': { + dashed_name: 'geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + short: 'Time zone.', + type: 'keyword', + }, + }, + group: 2, + name: 'geo', + prefix: 'geo.', + reusable: { + expected: [ + { as: 'geo', at: 'client', full: 'client.geo' }, + { as: 'geo', at: 'destination', full: 'destination.geo' }, + { as: 'geo', at: 'observer', full: 'observer.geo' }, + { as: 'geo', at: 'host', full: 'host.geo' }, + { as: 'geo', at: 'server', full: 'server.geo' }, + { as: 'geo', at: 'source', full: 'source.geo' }, + { as: 'geo', at: 'threat.indicator', full: 'threat.indicator.geo' }, + { + as: 'geo', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.geo', + }, + ], + top_level: false, + }, + short: 'Fields describing a location.', + title: 'Geo', + type: 'group', + }, + group: { + description: 'The group fields are meant to represent groups that are relevant to the event.', + fields: { + 'group.domain': { + dashed_name: 'group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'group.id': { + dashed_name: 'group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'group.name': { + dashed_name: 'group-name', + description: 'Name of the group.', + flat_name: 'group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the group.', + type: 'keyword', + }, + }, + group: 2, + name: 'group', + prefix: 'group.', + reusable: { + expected: [ + { as: 'group', at: 'user', full: 'user.group' }, + { + as: 'group', + at: 'process', + full: 'process.group', + short_override: 'The effective group (egid).', + }, + { + as: 'real_group', + at: 'process', + full: 'process.real_group', + short_override: 'The real group (rgid).', + }, + { + as: 'saved_group', + at: 'process', + full: 'process.saved_group', + short_override: 'The saved group (sgid).', + }, + { + as: 'supplemental_groups', + at: 'process', + full: 'process.supplemental_groups', + normalize: ['array'], + short_override: 'An array of supplemental groups.', + }, + { + as: 'attested_groups', + at: 'process', + beta: 'Reusing the `group` fields in this location is currently considered beta.', + full: 'process.attested_groups', + normalize: ['array'], + short_override: + 'The externally attested groups based on an external source such as the Kube API.', + }, + ], + top_level: true, + }, + short: "User's group relevant to the event.", + title: 'Group', + type: 'group', + }, + hash: { + description: + 'The hash fields represent different bitwise hash algorithms and their values.\nField names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512).\nNote that this fieldset is used for common hashes that may be computed over a range of generic bytes. Entity-specific hashes such as ja3 or imphash are placed in the fieldsets to which they relate (tls and pe, respectively).', + fields: { + 'hash.md5': { + dashed_name: 'hash-md5', + description: 'MD5 hash.', + flat_name: 'hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + short: 'MD5 hash.', + type: 'keyword', + }, + 'hash.sha1': { + dashed_name: 'hash-sha1', + description: 'SHA1 hash.', + flat_name: 'hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + short: 'SHA1 hash.', + type: 'keyword', + }, + 'hash.sha256': { + dashed_name: 'hash-sha256', + description: 'SHA256 hash.', + flat_name: 'hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + short: 'SHA256 hash.', + type: 'keyword', + }, + 'hash.sha384': { + dashed_name: 'hash-sha384', + description: 'SHA384 hash.', + flat_name: 'hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + short: 'SHA384 hash.', + type: 'keyword', + }, + 'hash.sha512': { + dashed_name: 'hash-sha512', + description: 'SHA512 hash.', + flat_name: 'hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + short: 'SHA512 hash.', + type: 'keyword', + }, + 'hash.ssdeep': { + dashed_name: 'hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'hash.tlsh': { + dashed_name: 'hash-tlsh', + description: 'TLSH hash.', + flat_name: 'hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + short: 'TLSH hash.', + type: 'keyword', + }, + }, + group: 2, + name: 'hash', + prefix: 'hash.', + reusable: { + expected: [ + { as: 'hash', at: 'file', full: 'file.hash' }, + { as: 'hash', at: 'process', full: 'process.hash' }, + { as: 'hash', at: 'dll', full: 'dll.hash' }, + { + as: 'hash', + at: 'email.attachments.file', + full: 'email.attachments.file.hash', + }, + ], + top_level: false, + }, + short: 'Hashes, usually file hashes.', + title: 'Hash', + type: 'group', + }, + host: { + description: + 'A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.', + fields: { + 'host.architecture': { + dashed_name: 'host-architecture', + description: 'Operating system architecture.', + example: 'x86_64', + flat_name: 'host.architecture', + ignore_above: 1024, + level: 'core', + name: 'architecture', + normalize: [], + short: 'Operating system architecture.', + type: 'keyword', + }, + 'host.boot.id': { + beta: 'This field is beta and subject to change.', + dashed_name: 'host-boot-id', + description: + 'Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.', + example: '88a1f0ed-5ae5-41ee-af6b-41921c311872', + flat_name: 'host.boot.id', + ignore_above: 1024, + level: 'extended', + name: 'boot.id', + normalize: [], + short: 'Linux boot uuid taken from /proc/sys/kernel/random/boot_id', + type: 'keyword', + }, + 'host.cpu.usage': { + dashed_name: 'host-cpu-usage', + description: + 'Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1.\nScaling factor: 1000.\nFor example: For a two core host, this value should be the average of the two cores, between 0 and 1.', + flat_name: 'host.cpu.usage', + level: 'extended', + name: 'cpu.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent CPU used, between 0 and 1.', + type: 'scaled_float', + }, + 'host.disk.read.bytes': { + dashed_name: 'host-disk-read-bytes', + description: + 'The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'host.disk.read.bytes', + level: 'extended', + name: 'disk.read.bytes', + normalize: [], + short: 'The number of bytes read by all disks.', + type: 'long', + }, + 'host.disk.write.bytes': { + dashed_name: 'host-disk-write-bytes', + description: + 'The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'host.disk.write.bytes', + level: 'extended', + name: 'disk.write.bytes', + normalize: [], + short: 'The number of bytes written on all disks.', + type: 'long', + }, + 'host.domain': { + dashed_name: 'host-domain', + description: + "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.", + example: 'CONTOSO', + flat_name: 'host.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'host.geo.city_name': { + dashed_name: 'host-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'host.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'host.geo.continent_code': { + dashed_name: 'host-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'host.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'host.geo.continent_name': { + dashed_name: 'host-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'host.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'host.geo.country_iso_code': { + dashed_name: 'host-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'host.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'host.geo.country_name': { + dashed_name: 'host-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'host.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'host.geo.location': { + dashed_name: 'host-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'host.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'host.geo.name': { + dashed_name: 'host-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'host.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'host.geo.postal_code': { + dashed_name: 'host-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'host.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'host.geo.region_iso_code': { + dashed_name: 'host-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'host.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'host.geo.region_name': { + dashed_name: 'host-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'host.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'host.geo.timezone': { + dashed_name: 'host-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'host.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'host.hostname': { + dashed_name: 'host-hostname', + description: + 'Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.', + flat_name: 'host.hostname', + ignore_above: 1024, + level: 'core', + name: 'hostname', + normalize: [], + short: 'Hostname of the host.', + type: 'keyword', + }, + 'host.id': { + dashed_name: 'host-id', + description: + 'Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.', + flat_name: 'host.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique host id.', + type: 'keyword', + }, + 'host.ip': { + dashed_name: 'host-ip', + description: 'Host ip addresses.', + flat_name: 'host.ip', + level: 'core', + name: 'ip', + normalize: ['array'], + short: 'Host ip addresses.', + type: 'ip', + }, + 'host.mac': { + dashed_name: 'host-mac', + description: + 'Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]', + flat_name: 'host.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: ['array'], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'Host MAC addresses.', + type: 'keyword', + }, + 'host.name': { + dashed_name: 'host-name', + description: + 'Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.', + flat_name: 'host.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the host.', + type: 'keyword', + }, + 'host.network.egress.bytes': { + dashed_name: 'host-network-egress-bytes', + description: + 'The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.egress.bytes', + level: 'extended', + name: 'network.egress.bytes', + normalize: [], + short: 'The number of bytes sent on all network interfaces.', + type: 'long', + }, + 'host.network.egress.packets': { + dashed_name: 'host-network-egress-packets', + description: + 'The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.egress.packets', + level: 'extended', + name: 'network.egress.packets', + normalize: [], + short: 'The number of packets sent on all network interfaces.', + type: 'long', + }, + 'host.network.ingress.bytes': { + dashed_name: 'host-network-ingress-bytes', + description: + 'The number of bytes received (gauge) on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.ingress.bytes', + level: 'extended', + name: 'network.ingress.bytes', + normalize: [], + short: 'The number of bytes received on all network interfaces.', + type: 'long', + }, + 'host.network.ingress.packets': { + dashed_name: 'host-network-ingress-packets', + description: + 'The number of packets (gauge) received on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.ingress.packets', + level: 'extended', + name: 'network.ingress.packets', + normalize: [], + short: 'The number of packets received on all network interfaces.', + type: 'long', + }, + 'host.os.family': { + dashed_name: 'host-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'host.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'host.os.full': { + dashed_name: 'host-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'host.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'host.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'host.os.kernel': { + dashed_name: 'host-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'host.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'host.os.name': { + dashed_name: 'host-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'host.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'host.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'host.os.platform': { + dashed_name: 'host-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'host.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'host.os.type': { + dashed_name: 'host-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'host.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'host.os.version': { + dashed_name: 'host-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'host.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'host.pid_ns_ino': { + beta: 'This field is beta and subject to change.', + dashed_name: 'host-pid-ns-ino', + description: + 'This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.', + example: 256383, + flat_name: 'host.pid_ns_ino', + ignore_above: 1024, + level: 'extended', + name: 'pid_ns_ino', + normalize: [], + short: 'Pid namespace inode', + type: 'keyword', + }, + 'host.risk.calculated_level': { + dashed_name: 'host-risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'host.risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'host.risk.calculated_score': { + dashed_name: 'host-risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'host.risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'host.risk.calculated_score_norm': { + dashed_name: 'host-risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'host.risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'host.risk.static_level': { + dashed_name: 'host-risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'host.risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'host.risk.static_score': { + dashed_name: 'host-risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'host.risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'host.risk.static_score_norm': { + dashed_name: 'host-risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'host.risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + 'host.type': { + dashed_name: 'host-type', + description: + 'Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.', + flat_name: 'host.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'Type of host.', + type: 'keyword', + }, + 'host.uptime': { + dashed_name: 'host-uptime', + description: 'Seconds the host has been up.', + example: 1325, + flat_name: 'host.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + short: 'Seconds the host has been up.', + type: 'long', + }, + }, + group: 2, + name: 'host', + nestings: ['host.geo', 'host.os', 'host.risk'], + prefix: 'host.', + reused_here: [ + { + full: 'host.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'host.os', + schema_name: 'os', + short: 'OS fields contain information about the operating system.', + }, + { + full: 'host.risk', + schema_name: 'risk', + short: 'Fields for describing risk score and level.', + }, + ], + short: 'Fields describing the relevant computing instance.', + title: 'Host', + type: 'group', + }, + http: { + description: + 'Fields related to HTTP activity. Use the `url` field set to store the url of the request.', + fields: { + 'http.request.body.bytes': { + dashed_name: 'http-request-body-bytes', + description: 'Size in bytes of the request body.', + example: 887, + flat_name: 'http.request.body.bytes', + format: 'bytes', + level: 'extended', + name: 'request.body.bytes', + normalize: [], + short: 'Size in bytes of the request body.', + type: 'long', + }, + 'http.request.body.content': { + dashed_name: 'http-request-body-content', + description: 'The full HTTP request body.', + example: 'Hello world', + flat_name: 'http.request.body.content', + level: 'extended', + multi_fields: [ + { + flat_name: 'http.request.body.content.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'request.body.content', + normalize: [], + short: 'The full HTTP request body.', + type: 'wildcard', + }, + 'http.request.bytes': { + dashed_name: 'http-request-bytes', + description: 'Total size in bytes of the request (body and headers).', + example: 1437, + flat_name: 'http.request.bytes', + format: 'bytes', + level: 'extended', + name: 'request.bytes', + normalize: [], + short: 'Total size in bytes of the request (body and headers).', + type: 'long', + }, + 'http.request.id': { + dashed_name: 'http-request-id', + description: + 'A unique identifier for each HTTP request to correlate logs between clients and servers in transactions.\nThe id may be contained in a non-standard HTTP header, such as `X-Request-ID` or `X-Correlation-ID`.', + example: '123e4567-e89b-12d3-a456-426614174000', + flat_name: 'http.request.id', + ignore_above: 1024, + level: 'extended', + name: 'request.id', + normalize: [], + short: 'HTTP request ID.', + type: 'keyword', + }, + 'http.request.method': { + dashed_name: 'http-request-method', + description: + 'HTTP request method.\nThe value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field.', + example: 'POST', + flat_name: 'http.request.method', + ignore_above: 1024, + level: 'extended', + name: 'request.method', + normalize: [], + short: 'HTTP request method.', + type: 'keyword', + }, + 'http.request.mime_type': { + dashed_name: 'http-request-mime-type', + description: + "Mime type of the body of the request.\nThis value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients.", + example: 'image/gif', + flat_name: 'http.request.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'request.mime_type', + normalize: [], + short: 'Mime type of the body of the request.', + type: 'keyword', + }, + 'http.request.referrer': { + dashed_name: 'http-request-referrer', + description: 'Referrer for this HTTP request.', + example: 'https://blog.example.com/', + flat_name: 'http.request.referrer', + ignore_above: 1024, + level: 'extended', + name: 'request.referrer', + normalize: [], + short: 'Referrer for this HTTP request.', + type: 'keyword', + }, + 'http.response.body.bytes': { + dashed_name: 'http-response-body-bytes', + description: 'Size in bytes of the response body.', + example: 887, + flat_name: 'http.response.body.bytes', + format: 'bytes', + level: 'extended', + name: 'response.body.bytes', + normalize: [], + short: 'Size in bytes of the response body.', + type: 'long', + }, + 'http.response.body.content': { + dashed_name: 'http-response-body-content', + description: 'The full HTTP response body.', + example: 'Hello world', + flat_name: 'http.response.body.content', + level: 'extended', + multi_fields: [ + { + flat_name: 'http.response.body.content.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'response.body.content', + normalize: [], + short: 'The full HTTP response body.', + type: 'wildcard', + }, + 'http.response.bytes': { + dashed_name: 'http-response-bytes', + description: 'Total size in bytes of the response (body and headers).', + example: 1437, + flat_name: 'http.response.bytes', + format: 'bytes', + level: 'extended', + name: 'response.bytes', + normalize: [], + short: 'Total size in bytes of the response (body and headers).', + type: 'long', + }, + 'http.response.mime_type': { + dashed_name: 'http-response-mime-type', + description: + "Mime type of the body of the response.\nThis value must only be populated based on the content of the response body, not on the `Content-Type` header. Comparing the mime type of a response with the response's Content-Type header can be helpful in detecting misconfigured servers.", + example: 'image/gif', + flat_name: 'http.response.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'response.mime_type', + normalize: [], + short: 'Mime type of the body of the response.', + type: 'keyword', + }, + 'http.response.status_code': { + dashed_name: 'http-response-status-code', + description: 'HTTP response status code.', + example: 404, + flat_name: 'http.response.status_code', + format: 'string', + level: 'extended', + name: 'response.status_code', + normalize: [], + short: 'HTTP response status code.', + type: 'long', + }, + 'http.version': { + dashed_name: 'http-version', + description: 'HTTP version.', + example: 1.1, + flat_name: 'http.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'HTTP version.', + type: 'keyword', + }, + }, + group: 2, + name: 'http', + prefix: 'http.', + short: 'Fields describing an HTTP request.', + title: 'HTTP', + type: 'group', + }, + interface: { + description: + 'The interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection. In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated.', + fields: { + 'interface.alias': { + dashed_name: 'interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + short: 'Interface alias', + type: 'keyword', + }, + 'interface.id': { + dashed_name: 'interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Interface ID', + type: 'keyword', + }, + 'interface.name': { + dashed_name: 'interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Interface name', + type: 'keyword', + }, + }, + group: 2, + name: 'interface', + prefix: 'interface.', + reusable: { + expected: [ + { + as: 'interface', + at: 'observer.ingress', + full: 'observer.ingress.interface', + }, + { + as: 'interface', + at: 'observer.egress', + full: 'observer.egress.interface', + }, + ], + top_level: false, + }, + short: 'Fields to describe observer interface information.', + title: 'Interface', + type: 'group', + }, + log: { + description: + "Details about the event's logging mechanism or logging transport.\nThe log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`.\nThe details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields.", + fields: { + 'log.file.path': { + dashed_name: 'log-file-path', + description: + "Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate.\nIf the event wasn't read from a log file, do not populate this field.", + example: '/var/log/fun-times.log', + flat_name: 'log.file.path', + ignore_above: 1024, + level: 'extended', + name: 'file.path', + normalize: [], + short: 'Full path to the log file this event came from.', + type: 'keyword', + }, + 'log.level': { + dashed_name: 'log-level', + description: + "Original log level of the log event.\nIf the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity).\nSome examples are `warn`, `err`, `i`, `informational`.", + example: 'error', + flat_name: 'log.level', + ignore_above: 1024, + level: 'core', + name: 'level', + normalize: [], + short: 'Log level of the log event.', + type: 'keyword', + }, + 'log.logger': { + dashed_name: 'log-logger', + description: + 'The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name.', + example: 'org.elasticsearch.bootstrap.Bootstrap', + flat_name: 'log.logger', + ignore_above: 1024, + level: 'core', + name: 'logger', + normalize: [], + short: 'Name of the logger.', + type: 'keyword', + }, + 'log.origin.file.line': { + dashed_name: 'log-origin-file-line', + description: + 'The line number of the file containing the source code which originated the log event.', + example: 42, + flat_name: 'log.origin.file.line', + level: 'extended', + name: 'origin.file.line', + normalize: [], + short: 'The line number of the file which originated the log event.', + type: 'long', + }, + 'log.origin.file.name': { + dashed_name: 'log-origin-file-name', + description: + 'The name of the file containing the source code which originated the log event.\nNote that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`.', + example: 'Bootstrap.java', + flat_name: 'log.origin.file.name', + ignore_above: 1024, + level: 'extended', + name: 'origin.file.name', + normalize: [], + short: 'The code file which originated the log event.', + type: 'keyword', + }, + 'log.origin.function': { + dashed_name: 'log-origin-function', + description: 'The name of the function or method which originated the log event.', + example: 'init', + flat_name: 'log.origin.function', + ignore_above: 1024, + level: 'extended', + name: 'origin.function', + normalize: [], + short: 'The function which originated the log event.', + type: 'keyword', + }, + 'log.syslog': { + dashed_name: 'log-syslog', + description: + 'The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164.', + flat_name: 'log.syslog', + level: 'extended', + name: 'syslog', + normalize: [], + short: 'Syslog metadata', + type: 'object', + }, + 'log.syslog.appname': { + dashed_name: 'log-syslog-appname', + description: 'The device or application that originated the Syslog message, if available.', + example: 'sshd', + flat_name: 'log.syslog.appname', + ignore_above: 1024, + level: 'extended', + name: 'syslog.appname', + normalize: [], + short: 'The device or application that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.facility.code': { + dashed_name: 'log-syslog-facility-code', + description: + 'The Syslog numeric facility of the log event, if available.\nAccording to RFCs 5424 and 3164, this value should be an integer between 0 and 23.', + example: 23, + flat_name: 'log.syslog.facility.code', + format: 'string', + level: 'extended', + name: 'syslog.facility.code', + normalize: [], + short: 'Syslog numeric facility of the event.', + type: 'long', + }, + 'log.syslog.facility.name': { + dashed_name: 'log-syslog-facility-name', + description: 'The Syslog text-based facility of the log event, if available.', + example: 'local7', + flat_name: 'log.syslog.facility.name', + ignore_above: 1024, + level: 'extended', + name: 'syslog.facility.name', + normalize: [], + short: 'Syslog text-based facility of the event.', + type: 'keyword', + }, + 'log.syslog.hostname': { + dashed_name: 'log-syslog-hostname', + description: + 'The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector.', + example: 'example-host', + flat_name: 'log.syslog.hostname', + ignore_above: 1024, + level: 'extended', + name: 'syslog.hostname', + normalize: [], + short: 'The host that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.msgid': { + dashed_name: 'log-syslog-msgid', + description: + 'An identifier for the type of Syslog message, if available. Only applicable for RFC 5424 messages.', + example: 'ID47', + flat_name: 'log.syslog.msgid', + ignore_above: 1024, + level: 'extended', + name: 'syslog.msgid', + normalize: [], + short: 'An identifier for the type of Syslog message.', + type: 'keyword', + }, + 'log.syslog.priority': { + dashed_name: 'log-syslog-priority', + description: + 'Syslog numeric priority of the event, if available.\nAccording to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.', + example: 135, + flat_name: 'log.syslog.priority', + format: 'string', + level: 'extended', + name: 'syslog.priority', + normalize: [], + short: 'Syslog priority of the event.', + type: 'long', + }, + 'log.syslog.procid': { + dashed_name: 'log-syslog-procid', + description: 'The process name or ID that originated the Syslog message, if available.', + example: 12345, + flat_name: 'log.syslog.procid', + ignore_above: 1024, + level: 'extended', + name: 'syslog.procid', + normalize: [], + short: 'The process name or ID that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.severity.code': { + dashed_name: 'log-syslog-severity-code', + description: + "The Syslog numeric severity of the log event, if available.\nIf the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`.", + example: 3, + flat_name: 'log.syslog.severity.code', + level: 'extended', + name: 'syslog.severity.code', + normalize: [], + short: 'Syslog numeric severity of the event.', + type: 'long', + }, + 'log.syslog.severity.name': { + dashed_name: 'log-syslog-severity-name', + description: + "The Syslog numeric severity of the log event, if available.\nIf the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`.", + example: 'Error', + flat_name: 'log.syslog.severity.name', + ignore_above: 1024, + level: 'extended', + name: 'syslog.severity.name', + normalize: [], + short: 'Syslog text-based severity of the event.', + type: 'keyword', + }, + 'log.syslog.structured_data': { + dashed_name: 'log-syslog-structured-data', + description: + 'Structured data expressed in RFC 5424 messages, if available. These are key-value pairs formed from the structured data portion of the syslog message, as defined in RFC 5424 Section 6.3.', + flat_name: 'log.syslog.structured_data', + level: 'extended', + name: 'syslog.structured_data', + normalize: [], + short: 'Structured data expressed in RFC 5424 messages.', + type: 'flattened', + }, + 'log.syslog.version': { + dashed_name: 'log-syslog-version', + description: + 'The version of the Syslog protocol specification. Only applicable for RFC 5424 messages.', + example: 1, + flat_name: 'log.syslog.version', + ignore_above: 1024, + level: 'extended', + name: 'syslog.version', + normalize: [], + short: 'Syslog protocol version.', + type: 'keyword', + }, + }, + group: 2, + name: 'log', + prefix: 'log.', + short: "Details about the event's logging mechanism.", + title: 'Log', + type: 'group', + }, + network: { + description: + 'The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.', + fields: { + 'network.application': { + dashed_name: 'network-application', + description: + "When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.\nFor example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.\nThe field value must be normalized to lowercase for querying.", + example: 'aim', + flat_name: 'network.application', + ignore_above: 1024, + level: 'extended', + name: 'application', + normalize: [], + short: 'Application level protocol name.', + type: 'keyword', + }, + 'network.bytes': { + dashed_name: 'network-bytes', + description: + 'Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.', + example: 368, + flat_name: 'network.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Total bytes transferred in both directions.', + type: 'long', + }, + 'network.community_id': { + dashed_name: 'network-community-id', + description: + 'A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.', + example: '1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=', + flat_name: 'network.community_id', + ignore_above: 1024, + level: 'extended', + name: 'community_id', + normalize: [], + short: 'A hash of source and destination IPs and ports.', + type: 'keyword', + }, + 'network.direction': { + dashed_name: 'network-direction', + description: + 'Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host\'s point of view, using the values "ingress" or "egress".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".\nNote that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.', + example: 'inbound', + expected_values: [ + 'ingress', + 'egress', + 'inbound', + 'outbound', + 'internal', + 'external', + 'unknown', + ], + flat_name: 'network.direction', + ignore_above: 1024, + level: 'core', + name: 'direction', + normalize: [], + short: 'Direction of the network traffic.', + type: 'keyword', + }, + 'network.forwarded_ip': { + dashed_name: 'network-forwarded-ip', + description: 'Host IP address when the source IP address is the proxy.', + example: '192.1.1.2', + flat_name: 'network.forwarded_ip', + level: 'core', + name: 'forwarded_ip', + normalize: [], + short: 'Host IP address when the source IP address is the proxy.', + type: 'ip', + }, + 'network.iana_number': { + dashed_name: 'network-iana-number', + description: + 'IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.', + example: 6, + flat_name: 'network.iana_number', + ignore_above: 1024, + level: 'extended', + name: 'iana_number', + normalize: [], + short: 'IANA Protocol Number.', + type: 'keyword', + }, + 'network.inner': { + dashed_name: 'network-inner', + description: + 'Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)', + flat_name: 'network.inner', + level: 'extended', + name: 'inner', + normalize: [], + short: 'Inner VLAN tag information', + type: 'object', + }, + 'network.inner.vlan.id': { + dashed_name: 'network-inner-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'network.inner.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'network.inner.vlan.name': { + dashed_name: 'network-inner-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'network.inner.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'network.name': { + dashed_name: 'network-name', + description: 'Name given by operators to sections of their network.', + example: 'Guest Wifi', + flat_name: 'network.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name given by operators to sections of their network.', + type: 'keyword', + }, + 'network.packets': { + dashed_name: 'network-packets', + description: + 'Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.', + example: 24, + flat_name: 'network.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Total packets transferred in both directions.', + type: 'long', + }, + 'network.protocol': { + dashed_name: 'network-protocol', + description: + 'In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.', + example: 'http', + flat_name: 'network.protocol', + ignore_above: 1024, + level: 'core', + name: 'protocol', + normalize: [], + short: 'Application protocol name.', + type: 'keyword', + }, + 'network.transport': { + dashed_name: 'network-transport', + description: + 'Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.', + example: 'tcp', + flat_name: 'network.transport', + ignore_above: 1024, + level: 'core', + name: 'transport', + normalize: [], + short: 'Protocol Name corresponding to the field `iana_number`.', + type: 'keyword', + }, + 'network.type': { + dashed_name: 'network-type', + description: + 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.', + example: 'ipv4', + flat_name: 'network.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc', + type: 'keyword', + }, + 'network.vlan.id': { + dashed_name: 'network-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'network.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'network.vlan.name': { + dashed_name: 'network-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'network.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + }, + group: 2, + name: 'network', + nestings: ['network.inner.vlan', 'network.vlan'], + prefix: 'network.', + reused_here: [ + { + full: 'network.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + { + full: 'network.inner.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + ], + short: 'Fields describing the communication path over which the event happened.', + title: 'Network', + type: 'group', + }, + observer: { + description: + 'An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics.\nThis could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS.', + fields: { + 'observer.egress': { + dashed_name: 'observer-egress', + description: + 'Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.', + flat_name: 'observer.egress', + level: 'extended', + name: 'egress', + normalize: [], + short: 'Object field for egress information', + type: 'object', + }, + 'observer.egress.interface.alias': { + dashed_name: 'observer-egress-interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'observer.egress.interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + original_fieldset: 'interface', + short: 'Interface alias', + type: 'keyword', + }, + 'observer.egress.interface.id': { + dashed_name: 'observer-egress-interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'observer.egress.interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'interface', + short: 'Interface ID', + type: 'keyword', + }, + 'observer.egress.interface.name': { + dashed_name: 'observer-egress-interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'observer.egress.interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'interface', + short: 'Interface name', + type: 'keyword', + }, + 'observer.egress.vlan.id': { + dashed_name: 'observer-egress-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'observer.egress.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'observer.egress.vlan.name': { + dashed_name: 'observer-egress-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'observer.egress.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.egress.zone': { + dashed_name: 'observer-egress-zone', + description: + 'Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.', + example: 'Public_Internet', + flat_name: 'observer.egress.zone', + ignore_above: 1024, + level: 'extended', + name: 'egress.zone', + normalize: [], + short: 'Observer Egress zone', + type: 'keyword', + }, + 'observer.geo.city_name': { + dashed_name: 'observer-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'observer.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'observer.geo.continent_code': { + dashed_name: 'observer-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'observer.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'observer.geo.continent_name': { + dashed_name: 'observer-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'observer.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'observer.geo.country_iso_code': { + dashed_name: 'observer-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'observer.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'observer.geo.country_name': { + dashed_name: 'observer-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'observer.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'observer.geo.location': { + dashed_name: 'observer-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'observer.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'observer.geo.name': { + dashed_name: 'observer-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'observer.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'observer.geo.postal_code': { + dashed_name: 'observer-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'observer.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'observer.geo.region_iso_code': { + dashed_name: 'observer-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'observer.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'observer.geo.region_name': { + dashed_name: 'observer-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'observer.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'observer.geo.timezone': { + dashed_name: 'observer-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'observer.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'observer.hostname': { + dashed_name: 'observer-hostname', + description: 'Hostname of the observer.', + flat_name: 'observer.hostname', + ignore_above: 1024, + level: 'core', + name: 'hostname', + normalize: [], + short: 'Hostname of the observer.', + type: 'keyword', + }, + 'observer.ingress': { + dashed_name: 'observer-ingress', + description: + 'Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.', + flat_name: 'observer.ingress', + level: 'extended', + name: 'ingress', + normalize: [], + short: 'Object field for ingress information', + type: 'object', + }, + 'observer.ingress.interface.alias': { + dashed_name: 'observer-ingress-interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'observer.ingress.interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + original_fieldset: 'interface', + short: 'Interface alias', + type: 'keyword', + }, + 'observer.ingress.interface.id': { + dashed_name: 'observer-ingress-interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'observer.ingress.interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'interface', + short: 'Interface ID', + type: 'keyword', + }, + 'observer.ingress.interface.name': { + dashed_name: 'observer-ingress-interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'observer.ingress.interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'interface', + short: 'Interface name', + type: 'keyword', + }, + 'observer.ingress.vlan.id': { + dashed_name: 'observer-ingress-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'observer.ingress.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'observer.ingress.vlan.name': { + dashed_name: 'observer-ingress-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'observer.ingress.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.ingress.zone': { + dashed_name: 'observer-ingress-zone', + description: + 'Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.', + example: 'DMZ', + flat_name: 'observer.ingress.zone', + ignore_above: 1024, + level: 'extended', + name: 'ingress.zone', + normalize: [], + short: 'Observer ingress zone', + type: 'keyword', + }, + 'observer.ip': { + dashed_name: 'observer-ip', + description: 'IP addresses of the observer.', + flat_name: 'observer.ip', + level: 'core', + name: 'ip', + normalize: ['array'], + short: 'IP addresses of the observer.', + type: 'ip', + }, + 'observer.mac': { + dashed_name: 'observer-mac', + description: + 'MAC addresses of the observer.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]', + flat_name: 'observer.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: ['array'], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC addresses of the observer.', + type: 'keyword', + }, + 'observer.name': { + dashed_name: 'observer-name', + description: + 'Custom name of the observer.\nThis is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization.\nIf no custom name is needed, the field can be left empty.', + example: '1_proxySG', + flat_name: 'observer.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Custom name of the observer.', + type: 'keyword', + }, + 'observer.os.family': { + dashed_name: 'observer-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'observer.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'observer.os.full': { + dashed_name: 'observer-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'observer.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'observer.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'observer.os.kernel': { + dashed_name: 'observer-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'observer.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'observer.os.name': { + dashed_name: 'observer-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'observer.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'observer.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'observer.os.platform': { + dashed_name: 'observer-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'observer.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'observer.os.type': { + dashed_name: 'observer-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'observer.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'observer.os.version': { + dashed_name: 'observer-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'observer.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'observer.product': { + dashed_name: 'observer-product', + description: 'The product name of the observer.', + example: 's200', + flat_name: 'observer.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + short: 'The product name of the observer.', + type: 'keyword', + }, + 'observer.serial_number': { + dashed_name: 'observer-serial-number', + description: 'Observer serial number.', + flat_name: 'observer.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + short: 'Observer serial number.', + type: 'keyword', + }, + 'observer.type': { + dashed_name: 'observer-type', + description: + 'The type of the observer the data is coming from.\nThere is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.', + example: 'firewall', + flat_name: 'observer.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'The type of the observer the data is coming from.', + type: 'keyword', + }, + 'observer.vendor': { + dashed_name: 'observer-vendor', + description: 'Vendor name of the observer.', + example: 'Symantec', + flat_name: 'observer.vendor', + ignore_above: 1024, + level: 'core', + name: 'vendor', + normalize: [], + short: 'Vendor name of the observer.', + type: 'keyword', + }, + 'observer.version': { + dashed_name: 'observer-version', + description: 'Observer version.', + flat_name: 'observer.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Observer version.', + type: 'keyword', + }, + }, + group: 2, + name: 'observer', + nestings: [ + 'observer.egress.interface', + 'observer.egress.vlan', + 'observer.geo', + 'observer.ingress.interface', + 'observer.ingress.vlan', + 'observer.os', + ], + prefix: 'observer.', + reused_here: [ + { + full: 'observer.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'observer.ingress.interface', + schema_name: 'interface', + short: 'Fields to describe observer interface information.', + }, + { + full: 'observer.egress.interface', + schema_name: 'interface', + short: 'Fields to describe observer interface information.', + }, + { + full: 'observer.os', + schema_name: 'os', + short: 'OS fields contain information about the operating system.', + }, + { + full: 'observer.ingress.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + { + full: 'observer.egress.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + ], + short: 'Fields describing an entity observing the event from outside the host.', + title: 'Observer', + type: 'group', + }, + orchestrator: { + description: + 'Fields that describe the resources which container orchestrators manage or act upon.', + fields: { + 'orchestrator.api_version': { + dashed_name: 'orchestrator-api-version', + description: 'API version being used to carry out the action', + example: 'v1beta1', + flat_name: 'orchestrator.api_version', + ignore_above: 1024, + level: 'extended', + name: 'api_version', + normalize: [], + short: 'API version being used to carry out the action', + type: 'keyword', + }, + 'orchestrator.cluster.id': { + dashed_name: 'orchestrator-cluster-id', + description: 'Unique ID of the cluster.', + flat_name: 'orchestrator.cluster.id', + ignore_above: 1024, + level: 'extended', + name: 'cluster.id', + normalize: [], + short: 'Unique ID of the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.name': { + dashed_name: 'orchestrator-cluster-name', + description: 'Name of the cluster.', + flat_name: 'orchestrator.cluster.name', + ignore_above: 1024, + level: 'extended', + name: 'cluster.name', + normalize: [], + short: 'Name of the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.url': { + dashed_name: 'orchestrator-cluster-url', + description: 'URL of the API used to manage the cluster.', + flat_name: 'orchestrator.cluster.url', + ignore_above: 1024, + level: 'extended', + name: 'cluster.url', + normalize: [], + short: 'URL of the API used to manage the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.version': { + dashed_name: 'orchestrator-cluster-version', + description: 'The version of the cluster.', + flat_name: 'orchestrator.cluster.version', + ignore_above: 1024, + level: 'extended', + name: 'cluster.version', + normalize: [], + short: 'The version of the cluster.', + type: 'keyword', + }, + 'orchestrator.namespace': { + dashed_name: 'orchestrator-namespace', + description: 'Namespace in which the action is taking place.', + example: 'kube-system', + flat_name: 'orchestrator.namespace', + ignore_above: 1024, + level: 'extended', + name: 'namespace', + normalize: [], + short: 'Namespace in which the action is taking place.', + type: 'keyword', + }, + 'orchestrator.organization': { + dashed_name: 'orchestrator-organization', + description: 'Organization affected by the event (for multi-tenant orchestrator setups).', + example: 'elastic', + flat_name: 'orchestrator.organization', + ignore_above: 1024, + level: 'extended', + name: 'organization', + normalize: [], + short: 'Organization affected by the event (for multi-tenant orchestrator setups).', + type: 'keyword', + }, + 'orchestrator.resource.id': { + dashed_name: 'orchestrator-resource-id', + description: 'Unique ID of the resource being acted upon.', + flat_name: 'orchestrator.resource.id', + ignore_above: 1024, + level: 'extended', + name: 'resource.id', + normalize: [], + short: 'Unique ID of the resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.resource.ip': { + dashed_name: 'orchestrator-resource-ip', + description: + 'IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).', + flat_name: 'orchestrator.resource.ip', + level: 'extended', + name: 'resource.ip', + normalize: ['array'], + short: 'IP address assigned to the resource associated with the event being observed.', + type: 'ip', + }, + 'orchestrator.resource.name': { + dashed_name: 'orchestrator-resource-name', + description: 'Name of the resource being acted upon.', + example: 'test-pod-cdcws', + flat_name: 'orchestrator.resource.name', + ignore_above: 1024, + level: 'extended', + name: 'resource.name', + normalize: [], + short: 'Name of the resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.resource.parent.type': { + dashed_name: 'orchestrator-resource-parent-type', + description: + 'Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).', + example: 'DaemonSet', + flat_name: 'orchestrator.resource.parent.type', + ignore_above: 1024, + level: 'extended', + name: 'resource.parent.type', + normalize: [], + short: 'Type or kind of the parent resource associated with the event being observed.', + type: 'keyword', + }, + 'orchestrator.resource.type': { + dashed_name: 'orchestrator-resource-type', + description: 'Type of resource being acted upon.', + example: 'service', + flat_name: 'orchestrator.resource.type', + ignore_above: 1024, + level: 'extended', + name: 'resource.type', + normalize: [], + short: 'Type of resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.type': { + dashed_name: 'orchestrator-type', + description: 'Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).', + example: 'kubernetes', + flat_name: 'orchestrator.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).', + type: 'keyword', + }, + }, + group: 2, + name: 'orchestrator', + prefix: 'orchestrator.', + short: 'Fields relevant to container orchestrators.', + title: 'Orchestrator', + type: 'group', + }, + organization: { + description: + 'The organization fields enrich data with information about the company or entity the data is associated with.\nThese fields help you arrange or filter data stored in an index by one or multiple organizations.', + fields: { + 'organization.id': { + dashed_name: 'organization-id', + description: 'Unique identifier for the organization.', + flat_name: 'organization.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Unique identifier for the organization.', + type: 'keyword', + }, + 'organization.name': { + dashed_name: 'organization-name', + description: 'Organization name.', + flat_name: 'organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Organization name.', + type: 'keyword', + }, + }, + group: 2, + name: 'organization', + prefix: 'organization.', + short: 'Fields describing the organization or company the event is associated with.', + title: 'Organization', + type: 'group', + }, + os: { + description: 'The OS fields contain information about the operating system.', + fields: { + 'os.family': { + dashed_name: 'os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'os.full': { + dashed_name: 'os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'os.full.text', name: 'text', type: 'match_only_text' }], + name: 'full', + normalize: [], + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'os.kernel': { + dashed_name: 'os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'os.name': { + dashed_name: 'os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'os.name.text', name: 'text', type: 'match_only_text' }], + name: 'name', + normalize: [], + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'os.platform': { + dashed_name: 'os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'os.type': { + dashed_name: 'os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'os.version': { + dashed_name: 'os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + }, + group: 2, + name: 'os', + prefix: 'os.', + reusable: { + expected: [ + { as: 'os', at: 'observer', full: 'observer.os' }, + { as: 'os', at: 'host', full: 'host.os' }, + { as: 'os', at: 'user_agent', full: 'user_agent.os' }, + ], + top_level: false, + }, + short: 'OS fields contain information about the operating system.', + title: 'Operating System', + type: 'group', + }, + package: { + description: + 'These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.', + fields: { + 'package.architecture': { + dashed_name: 'package-architecture', + description: 'Package architecture.', + example: 'x86_64', + flat_name: 'package.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'Package architecture.', + type: 'keyword', + }, + 'package.build_version': { + dashed_name: 'package-build-version', + description: + 'Additional information about the build version of the installed package.\nFor example use the commit SHA of a non-released package.', + example: '36f4f7e89dd61b0988b12ee000b98966867710cd', + flat_name: 'package.build_version', + ignore_above: 1024, + level: 'extended', + name: 'build_version', + normalize: [], + short: 'Build version information', + type: 'keyword', + }, + 'package.checksum': { + dashed_name: 'package-checksum', + description: 'Checksum of the installed package for verification.', + example: '68b329da9893e34099c7d8ad5cb9c940', + flat_name: 'package.checksum', + ignore_above: 1024, + level: 'extended', + name: 'checksum', + normalize: [], + short: 'Checksum of the installed package for verification.', + type: 'keyword', + }, + 'package.description': { + dashed_name: 'package-description', + description: 'Description of the package.', + example: 'Open source programming language to build simple/reliable/efficient software.', + flat_name: 'package.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Description of the package.', + type: 'keyword', + }, + 'package.install_scope': { + dashed_name: 'package-install-scope', + description: 'Indicating how the package was installed, e.g. user-local, global.', + example: 'global', + flat_name: 'package.install_scope', + ignore_above: 1024, + level: 'extended', + name: 'install_scope', + normalize: [], + short: 'Indicating how the package was installed, e.g. user-local, global.', + type: 'keyword', + }, + 'package.installed': { + dashed_name: 'package-installed', + description: 'Time when package was installed.', + flat_name: 'package.installed', + level: 'extended', + name: 'installed', + normalize: [], + short: 'Time when package was installed.', + type: 'date', + }, + 'package.license': { + dashed_name: 'package-license', + description: + 'License under which the package was released.\nUse a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/).', + example: 'Apache License 2.0', + flat_name: 'package.license', + ignore_above: 1024, + level: 'extended', + name: 'license', + normalize: [], + short: 'Package license', + type: 'keyword', + }, + 'package.name': { + dashed_name: 'package-name', + description: 'Package name', + example: 'go', + flat_name: 'package.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Package name', + type: 'keyword', + }, + 'package.path': { + dashed_name: 'package-path', + description: 'Path where the package is installed.', + example: '/usr/local/Cellar/go/1.12.9/', + flat_name: 'package.path', + ignore_above: 1024, + level: 'extended', + name: 'path', + normalize: [], + short: 'Path where the package is installed.', + type: 'keyword', + }, + 'package.reference': { + dashed_name: 'package-reference', + description: 'Home page or reference URL of the software in this package, if available.', + example: 'https://golang.org', + flat_name: 'package.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Package home page or reference URL', + type: 'keyword', + }, + 'package.size': { + dashed_name: 'package-size', + description: 'Package size in bytes.', + example: 62231, + flat_name: 'package.size', + format: 'string', + level: 'extended', + name: 'size', + normalize: [], + short: 'Package size in bytes.', + type: 'long', + }, + 'package.type': { + dashed_name: 'package-type', + description: + 'Type of package.\nThis should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.', + example: 'rpm', + flat_name: 'package.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Package type', + type: 'keyword', + }, + 'package.version': { + dashed_name: 'package-version', + description: 'Package version', + example: '1.12.9', + flat_name: 'package.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Package version', + type: 'keyword', + }, + }, + group: 2, + name: 'package', + prefix: 'package.', + short: 'These fields contain information about an installed software package.', + title: 'Package', + type: 'group', + }, + pe: { + description: 'These fields contain Windows Portable Executable (PE) metadata.', + fields: { + 'pe.architecture': { + dashed_name: 'pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'pe.company': { + dashed_name: 'pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'pe.description': { + dashed_name: 'pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'pe.file_version': { + dashed_name: 'pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + short: 'Process name.', + type: 'keyword', + }, + 'pe.imphash': { + dashed_name: 'pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'pe.original_file_name': { + dashed_name: 'pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'pe.pehash': { + dashed_name: 'pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'pe.product': { + dashed_name: 'pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + }, + group: 2, + name: 'pe', + prefix: 'pe.', + reusable: { + expected: [ + { as: 'pe', at: 'file', full: 'file.pe' }, + { as: 'pe', at: 'dll', full: 'dll.pe' }, + { as: 'pe', at: 'process', full: 'process.pe' }, + ], + top_level: false, + }, + short: 'These fields contain Windows Portable Executable (PE) metadata.', + title: 'PE Header', + type: 'group', + }, + process: { + description: + 'These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation.', + fields: { + 'process.args': { + dashed_name: 'process-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.args_count': { + dashed_name: 'process-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.code_signature.digest_algorithm': { + dashed_name: 'process-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'process.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.exists': { + dashed_name: 'process-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'process.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'process.code_signature.signing_id': { + dashed_name: 'process-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'process.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.status': { + dashed_name: 'process-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'process.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'process.code_signature.subject_name': { + dashed_name: 'process-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'process.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'process.code_signature.team_id': { + dashed_name: 'process-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'process.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.timestamp': { + dashed_name: 'process-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'process.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'process.code_signature.trusted': { + dashed_name: 'process-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'process.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'process.code_signature.valid': { + dashed_name: 'process-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'process.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'process.command_line': { + dashed_name: 'process-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.elf.architecture': { + dashed_name: 'process-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'process.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'process.elf.byte_order': { + dashed_name: 'process-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'process.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'process.elf.cpu_type': { + dashed_name: 'process-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'process.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'process.elf.creation_date': { + dashed_name: 'process-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'process.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'process.elf.exports': { + dashed_name: 'process-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'process.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'process.elf.header.abi_version': { + dashed_name: 'process-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'process.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'process.elf.header.class': { + dashed_name: 'process-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'process.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'process.elf.header.data': { + dashed_name: 'process-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'process.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'process.elf.header.entrypoint': { + dashed_name: 'process-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'process.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'process.elf.header.object_version': { + dashed_name: 'process-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'process.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'process.elf.header.os_abi': { + dashed_name: 'process-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'process.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'process.elf.header.type': { + dashed_name: 'process-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'process.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'process.elf.header.version': { + dashed_name: 'process-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'process.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'process.elf.imports': { + dashed_name: 'process-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'process.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'process.elf.sections': { + dashed_name: 'process-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'process.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'process.elf.sections.chi2': { + dashed_name: 'process-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'process.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'process.elf.sections.entropy': { + dashed_name: 'process-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'process.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'process.elf.sections.flags': { + dashed_name: 'process-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'process.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'process.elf.sections.name': { + dashed_name: 'process-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'process.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'process.elf.sections.physical_offset': { + dashed_name: 'process-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'process.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'process.elf.sections.physical_size': { + dashed_name: 'process-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'process.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'process.elf.sections.type': { + dashed_name: 'process-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'process.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'process.elf.sections.virtual_address': { + dashed_name: 'process-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'process.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'process.elf.sections.virtual_size': { + dashed_name: 'process-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'process.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'process.elf.segments': { + dashed_name: 'process-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'process.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'process.elf.segments.sections': { + dashed_name: 'process-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'process.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'process.elf.segments.type': { + dashed_name: 'process-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'process.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'process.elf.shared_libraries': { + dashed_name: 'process-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'process.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'process.elf.telfhash': { + dashed_name: 'process-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'process.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'process.end': { + dashed_name: 'process-end', + description: 'The time the process ended.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.end', + level: 'extended', + name: 'end', + normalize: [], + short: 'The time the process ended.', + type: 'date', + }, + 'process.entity_id': { + dashed_name: 'process-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.args': { + dashed_name: 'process-entry-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.entry_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.entry_leader.args_count': { + dashed_name: 'process-entry-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.entry_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.entry_leader.attested_groups.name': { + dashed_name: 'process-entry-leader-attested-groups-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.attested_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.attested_user.id': { + dashed_name: 'process-entry-leader-attested-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.attested_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.attested_user.name': { + dashed_name: 'process-entry-leader-attested-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.attested_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.attested_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.command_line': { + dashed_name: 'process-entry-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.entry_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.entry_leader.entity_id': { + dashed_name: 'process-entry-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.entry_meta.source.ip': { + dashed_name: 'process-entry-leader-entry-meta-source-ip', + description: 'IP address of the source (IPv4 or IPv6).', + flat_name: 'process.entry_leader.entry_meta.source.ip', + level: 'core', + name: 'ip', + normalize: [], + original_fieldset: 'source', + short: 'IP address of the source.', + type: 'ip', + }, + 'process.entry_leader.entry_meta.type': { + dashed_name: 'process-entry-leader-entry-meta-type', + description: + 'The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader.', + flat_name: 'process.entry_leader.entry_meta.type', + ignore_above: 1024, + level: 'extended', + name: 'entry_meta.type', + normalize: [], + original_fieldset: 'process', + short: 'The entry type for the entry session leader.', + type: 'keyword', + }, + 'process.entry_leader.executable': { + dashed_name: 'process-entry-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.entry_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.entry_leader.group.id': { + dashed_name: 'process-entry-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.group.name': { + dashed_name: 'process-entry-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.interactive': { + dashed_name: 'process-entry-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.entry_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.entry_leader.name': { + dashed_name: 'process-entry-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.entry_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.entry_leader.parent.entity_id': { + dashed_name: 'process-entry-leader-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.parent.pid': { + dashed_name: 'process-entry-leader-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.parent.session_leader.entity_id': { + dashed_name: 'process-entry-leader-parent-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.parent.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.parent.session_leader.pid': { + dashed_name: 'process-entry-leader-parent-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.parent.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.parent.session_leader.start': { + dashed_name: 'process-entry-leader-parent-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.parent.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.parent.start': { + dashed_name: 'process-entry-leader-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.pid': { + dashed_name: 'process-entry-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.real_group.id': { + dashed_name: 'process-entry-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.real_group.name': { + dashed_name: 'process-entry-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.real_user.id': { + dashed_name: 'process-entry-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.real_user.name': { + dashed_name: 'process-entry-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.same_as_process': { + dashed_name: 'process-entry-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.entry_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.entry_leader.saved_group.id': { + dashed_name: 'process-entry-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.saved_group.name': { + dashed_name: 'process-entry-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.saved_user.id': { + dashed_name: 'process-entry-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.saved_user.name': { + dashed_name: 'process-entry-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.start': { + dashed_name: 'process-entry-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.supplemental_groups.id': { + dashed_name: 'process-entry-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.supplemental_groups.name': { + dashed_name: 'process-entry-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.tty': { + dashed_name: 'process-entry-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.entry_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.entry_leader.tty.char_device.major': { + dashed_name: 'process-entry-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.entry_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.entry_leader.tty.char_device.minor': { + dashed_name: 'process-entry-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.entry_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.entry_leader.user.id': { + dashed_name: 'process-entry-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.user.name': { + dashed_name: 'process-entry-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.working_directory': { + dashed_name: 'process-entry-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.entry_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.env_vars': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-env-vars', + description: + 'Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.', + example: '["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]', + flat_name: 'process.env_vars', + ignore_above: 1024, + level: 'extended', + name: 'env_vars', + normalize: ['array'], + short: 'Array of environment variable bindings.', + type: 'keyword', + }, + 'process.executable': { + dashed_name: 'process-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.exit_code': { + dashed_name: 'process-exit-code', + description: + 'The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).', + example: 137, + flat_name: 'process.exit_code', + level: 'extended', + name: 'exit_code', + normalize: [], + short: 'The exit code of the process.', + type: 'long', + }, + 'process.group_leader.args': { + dashed_name: 'process-group-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.group_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.group_leader.args_count': { + dashed_name: 'process-group-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.group_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.group_leader.command_line': { + dashed_name: 'process-group-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.group_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.group_leader.entity_id': { + dashed_name: 'process-group-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.group_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.group_leader.executable': { + dashed_name: 'process-group-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.group_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.group_leader.group.id': { + dashed_name: 'process-group-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.group.name': { + dashed_name: 'process-group-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.interactive': { + dashed_name: 'process-group-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.group_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.group_leader.name': { + dashed_name: 'process-group-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.group_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.group_leader.pid': { + dashed_name: 'process-group-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.group_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.group_leader.real_group.id': { + dashed_name: 'process-group-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.real_group.name': { + dashed_name: 'process-group-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.real_user.id': { + dashed_name: 'process-group-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.real_user.name': { + dashed_name: 'process-group-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.same_as_process': { + dashed_name: 'process-group-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.group_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.group_leader.saved_group.id': { + dashed_name: 'process-group-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.saved_group.name': { + dashed_name: 'process-group-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.saved_user.id': { + dashed_name: 'process-group-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.saved_user.name': { + dashed_name: 'process-group-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.start': { + dashed_name: 'process-group-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.group_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.group_leader.supplemental_groups.id': { + dashed_name: 'process-group-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.supplemental_groups.name': { + dashed_name: 'process-group-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.tty': { + dashed_name: 'process-group-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.group_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.group_leader.tty.char_device.major': { + dashed_name: 'process-group-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.group_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.group_leader.tty.char_device.minor': { + dashed_name: 'process-group-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.group_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.group_leader.user.id': { + dashed_name: 'process-group-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.user.name': { + dashed_name: 'process-group-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.working_directory': { + dashed_name: 'process-group-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.group_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.hash.md5': { + dashed_name: 'process-hash-md5', + description: 'MD5 hash.', + flat_name: 'process.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'process.hash.sha1': { + dashed_name: 'process-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'process.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'process.hash.sha256': { + dashed_name: 'process-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'process.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'process.hash.sha384': { + dashed_name: 'process-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'process.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'process.hash.sha512': { + dashed_name: 'process-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'process.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'process.hash.ssdeep': { + dashed_name: 'process-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'process.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'process.hash.tlsh': { + dashed_name: 'process-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'process.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'process.interactive': { + dashed_name: 'process-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.io': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io', + description: + 'A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input.', + flat_name: 'process.io', + level: 'extended', + name: 'io', + normalize: [], + short: 'A chunk of input or output (IO) from a single process.', + type: 'object', + }, + 'process.io.bytes_skipped': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped', + description: + 'An array of byte offsets and lengths denoting where IO data has been skipped.', + flat_name: 'process.io.bytes_skipped', + level: 'extended', + name: 'io.bytes_skipped', + normalize: ['array'], + short: 'An array of byte offsets and lengths denoting where IO data has been skipped.', + type: 'object', + }, + 'process.io.bytes_skipped.length': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped-length', + description: 'The length of bytes skipped.', + flat_name: 'process.io.bytes_skipped.length', + level: 'extended', + name: 'io.bytes_skipped.length', + normalize: [], + short: 'The length of bytes skipped.', + type: 'long', + }, + 'process.io.bytes_skipped.offset': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped-offset', + description: + "The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.", + flat_name: 'process.io.bytes_skipped.offset', + level: 'extended', + name: 'io.bytes_skipped.offset', + normalize: [], + short: + "The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.", + type: 'long', + }, + 'process.io.max_bytes_per_process_exceeded': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-max-bytes-per-process-exceeded', + description: + 'If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.', + flat_name: 'process.io.max_bytes_per_process_exceeded', + level: 'extended', + name: 'io.max_bytes_per_process_exceeded', + normalize: [], + short: + 'If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.', + type: 'boolean', + }, + 'process.io.text': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-text', + description: + 'A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.', + flat_name: 'process.io.text', + level: 'extended', + name: 'io.text', + normalize: [], + short: 'A chunk of output or input sanitized to UTF-8.', + type: 'wildcard', + }, + 'process.io.total_bytes_captured': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-total-bytes-captured', + description: 'The total number of bytes captured in this event.', + flat_name: 'process.io.total_bytes_captured', + level: 'extended', + name: 'io.total_bytes_captured', + normalize: [], + short: 'The total number of bytes captured in this event.', + type: 'long', + }, + 'process.io.total_bytes_skipped': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-total-bytes-skipped', + description: + 'The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero', + flat_name: 'process.io.total_bytes_skipped', + level: 'extended', + name: 'io.total_bytes_skipped', + normalize: [], + short: + 'The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.', + type: 'long', + }, + 'process.io.type': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-type', + description: + "The type of object on which the IO action (read or write) was taken.\nCurrently only 'tty' is supported. Other types may be added in the future for 'file' and 'socket' support.", + flat_name: 'process.io.type', + ignore_above: 1024, + level: 'extended', + name: 'io.type', + normalize: [], + short: 'The type of object on which the IO action (read or write) was taken.', + type: 'keyword', + }, + 'process.name': { + dashed_name: 'process-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.args': { + dashed_name: 'process-parent-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.parent.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.parent.args_count': { + dashed_name: 'process-parent-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.parent.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.parent.code_signature.digest_algorithm': { + dashed_name: 'process-parent-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'process.parent.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.exists': { + dashed_name: 'process-parent-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'process.parent.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'process.parent.code_signature.signing_id': { + dashed_name: 'process-parent-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'process.parent.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.status': { + dashed_name: 'process-parent-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'process.parent.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'process.parent.code_signature.subject_name': { + dashed_name: 'process-parent-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'process.parent.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'process.parent.code_signature.team_id': { + dashed_name: 'process-parent-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'process.parent.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.timestamp': { + dashed_name: 'process-parent-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'process.parent.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'process.parent.code_signature.trusted': { + dashed_name: 'process-parent-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'process.parent.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'process.parent.code_signature.valid': { + dashed_name: 'process-parent-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'process.parent.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'process.parent.command_line': { + dashed_name: 'process-parent-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.parent.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.parent.elf.architecture': { + dashed_name: 'process-parent-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'process.parent.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.byte_order': { + dashed_name: 'process-parent-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'process.parent.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'process.parent.elf.cpu_type': { + dashed_name: 'process-parent-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'process.parent.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.creation_date': { + dashed_name: 'process-parent-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'process.parent.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'process.parent.elf.exports': { + dashed_name: 'process-parent-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'process.parent.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'process.parent.elf.header.abi_version': { + dashed_name: 'process-parent-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'process.parent.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'process.parent.elf.header.class': { + dashed_name: 'process-parent-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'process.parent.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.header.data': { + dashed_name: 'process-parent-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'process.parent.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'process.parent.elf.header.entrypoint': { + dashed_name: 'process-parent-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'process.parent.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'process.parent.elf.header.object_version': { + dashed_name: 'process-parent-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'process.parent.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'process.parent.elf.header.os_abi': { + dashed_name: 'process-parent-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'process.parent.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'process.parent.elf.header.type': { + dashed_name: 'process-parent-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'process.parent.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.header.version': { + dashed_name: 'process-parent-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'process.parent.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'process.parent.elf.imports': { + dashed_name: 'process-parent-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'process.parent.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'process.parent.elf.sections': { + dashed_name: 'process-parent-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'process.parent.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'process.parent.elf.sections.chi2': { + dashed_name: 'process-parent-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'process.parent.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'process.parent.elf.sections.entropy': { + dashed_name: 'process-parent-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'process.parent.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'process.parent.elf.sections.flags': { + dashed_name: 'process-parent-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'process.parent.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'process.parent.elf.sections.name': { + dashed_name: 'process-parent-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'process.parent.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'process.parent.elf.sections.physical_offset': { + dashed_name: 'process-parent-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'process.parent.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'process.parent.elf.sections.physical_size': { + dashed_name: 'process-parent-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'process.parent.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'process.parent.elf.sections.type': { + dashed_name: 'process-parent-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'process.parent.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'process.parent.elf.sections.virtual_address': { + dashed_name: 'process-parent-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'process.parent.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'process.parent.elf.sections.virtual_size': { + dashed_name: 'process-parent-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'process.parent.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'process.parent.elf.segments': { + dashed_name: 'process-parent-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'process.parent.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'process.parent.elf.segments.sections': { + dashed_name: 'process-parent-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'process.parent.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'process.parent.elf.segments.type': { + dashed_name: 'process-parent-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'process.parent.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'process.parent.elf.shared_libraries': { + dashed_name: 'process-parent-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'process.parent.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'process.parent.elf.telfhash': { + dashed_name: 'process-parent-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'process.parent.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'process.parent.end': { + dashed_name: 'process-parent-end', + description: 'The time the process ended.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.end', + level: 'extended', + name: 'end', + normalize: [], + original_fieldset: 'process', + short: 'The time the process ended.', + type: 'date', + }, + 'process.parent.entity_id': { + dashed_name: 'process-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.parent.executable': { + dashed_name: 'process-parent-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.parent.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.parent.exit_code': { + dashed_name: 'process-parent-exit-code', + description: + 'The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).', + example: 137, + flat_name: 'process.parent.exit_code', + level: 'extended', + name: 'exit_code', + normalize: [], + original_fieldset: 'process', + short: 'The exit code of the process.', + type: 'long', + }, + 'process.parent.group.id': { + dashed_name: 'process-parent-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.group.name': { + dashed_name: 'process-parent-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.group_leader.entity_id': { + dashed_name: 'process-parent-group-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.parent.group_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.parent.group_leader.pid': { + dashed_name: 'process-parent-group-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.parent.group_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.parent.group_leader.start': { + dashed_name: 'process-parent-group-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.group_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.parent.hash.md5': { + dashed_name: 'process-parent-hash-md5', + description: 'MD5 hash.', + flat_name: 'process.parent.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha1': { + dashed_name: 'process-parent-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'process.parent.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha256': { + dashed_name: 'process-parent-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'process.parent.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha384': { + dashed_name: 'process-parent-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'process.parent.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha512': { + dashed_name: 'process-parent-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'process.parent.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'process.parent.hash.ssdeep': { + dashed_name: 'process-parent-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'process.parent.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'process.parent.hash.tlsh': { + dashed_name: 'process-parent-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'process.parent.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'process.parent.interactive': { + dashed_name: 'process-parent-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.parent.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.parent.name': { + dashed_name: 'process-parent-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.parent.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.pe.architecture': { + dashed_name: 'process-parent-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'process.parent.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'process.parent.pe.company': { + dashed_name: 'process-parent-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'process.parent.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.description': { + dashed_name: 'process-parent-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'process.parent.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.file_version': { + dashed_name: 'process-parent-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'process.parent.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.pe.imphash': { + dashed_name: 'process-parent-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'process.parent.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'process.parent.pe.original_file_name': { + dashed_name: 'process-parent-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'process.parent.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.pehash': { + dashed_name: 'process-parent-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'process.parent.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'process.parent.pe.product': { + dashed_name: 'process-parent-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'process.parent.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pgid': { + dashed_name: 'process-parent-pgid', + description: + 'Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.', + flat_name: 'process.parent.pgid', + format: 'string', + level: 'extended', + name: 'pgid', + normalize: [], + original_fieldset: 'process', + short: 'Deprecated identifier of the group of processes the process belongs to.', + type: 'long', + }, + 'process.parent.pid': { + dashed_name: 'process-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.parent.real_group.id': { + dashed_name: 'process-parent-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.real_group.name': { + dashed_name: 'process-parent-real-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.real_user.id': { + dashed_name: 'process-parent-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.real_user.name': { + dashed_name: 'process-parent-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.saved_group.id': { + dashed_name: 'process-parent-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.saved_group.name': { + dashed_name: 'process-parent-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.saved_user.id': { + dashed_name: 'process-parent-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.saved_user.name': { + dashed_name: 'process-parent-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.start': { + dashed_name: 'process-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.parent.supplemental_groups.id': { + dashed_name: 'process-parent-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.supplemental_groups.name': { + dashed_name: 'process-parent-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.parent.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.thread.id': { + dashed_name: 'process-parent-thread-id', + description: 'Thread ID.', + example: 4242, + flat_name: 'process.parent.thread.id', + format: 'string', + level: 'extended', + name: 'thread.id', + normalize: [], + original_fieldset: 'process', + short: 'Thread ID.', + type: 'long', + }, + 'process.parent.thread.name': { + dashed_name: 'process-parent-thread-name', + description: 'Thread name.', + example: 'thread-0', + flat_name: 'process.parent.thread.name', + ignore_above: 1024, + level: 'extended', + name: 'thread.name', + normalize: [], + original_fieldset: 'process', + short: 'Thread name.', + type: 'keyword', + }, + 'process.parent.title': { + dashed_name: 'process-parent-title', + description: + 'Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.', + flat_name: 'process.parent.title', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.title.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'title', + normalize: [], + original_fieldset: 'process', + short: 'Process title.', + type: 'keyword', + }, + 'process.parent.tty': { + dashed_name: 'process-parent-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.parent.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.parent.tty.char_device.major': { + dashed_name: 'process-parent-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.parent.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.parent.tty.char_device.minor': { + dashed_name: 'process-parent-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.parent.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.parent.uptime': { + dashed_name: 'process-parent-uptime', + description: 'Seconds the process has been up.', + example: 1325, + flat_name: 'process.parent.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + original_fieldset: 'process', + short: 'Seconds the process has been up.', + type: 'long', + }, + 'process.parent.user.id': { + dashed_name: 'process-parent-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.user.name': { + dashed_name: 'process-parent-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.working_directory': { + dashed_name: 'process-parent-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.parent.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.pe.architecture': { + dashed_name: 'process-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'process.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'process.pe.company': { + dashed_name: 'process-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'process.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.description': { + dashed_name: 'process-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'process.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.file_version': { + dashed_name: 'process-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'process.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'process.pe.imphash': { + dashed_name: 'process-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'process.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'process.pe.original_file_name': { + dashed_name: 'process-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'process.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.pehash': { + dashed_name: 'process-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'process.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'process.pe.product': { + dashed_name: 'process-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'process.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pgid': { + dashed_name: 'process-pgid', + description: + 'Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.', + flat_name: 'process.pgid', + format: 'string', + level: 'extended', + name: 'pgid', + normalize: [], + short: 'Deprecated identifier of the group of processes the process belongs to.', + type: 'long', + }, + 'process.pid': { + dashed_name: 'process-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + short: 'Process id.', + type: 'long', + }, + 'process.previous.args': { + dashed_name: 'process-previous-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.previous.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.previous.args_count': { + dashed_name: 'process-previous-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.previous.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.previous.executable': { + dashed_name: 'process-previous-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.previous.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.previous.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.real_group.id': { + dashed_name: 'process-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.real_group.name': { + dashed_name: 'process-real-group-name', + description: 'Name of the group.', + flat_name: 'process.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.real_user.id': { + dashed_name: 'process-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.real_user.name': { + dashed_name: 'process-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.saved_group.id': { + dashed_name: 'process-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.saved_group.name': { + dashed_name: 'process-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.saved_user.id': { + dashed_name: 'process-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.saved_user.name': { + dashed_name: 'process-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.args': { + dashed_name: 'process-session-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.session_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.session_leader.args_count': { + dashed_name: 'process-session-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.session_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.session_leader.command_line': { + dashed_name: 'process-session-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.session_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.session_leader.entity_id': { + dashed_name: 'process-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.executable': { + dashed_name: 'process-session-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.session_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.session_leader.group.id': { + dashed_name: 'process-session-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.group.name': { + dashed_name: 'process-session-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.interactive': { + dashed_name: 'process-session-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.session_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.session_leader.name': { + dashed_name: 'process-session-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.session_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.session_leader.parent.entity_id': { + dashed_name: 'process-session-leader-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.parent.pid': { + dashed_name: 'process-session-leader-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.parent.session_leader.entity_id': { + dashed_name: 'process-session-leader-parent-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.parent.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.parent.session_leader.pid': { + dashed_name: 'process-session-leader-parent-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.parent.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.parent.session_leader.start': { + dashed_name: 'process-session-leader-parent-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.parent.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.parent.start': { + dashed_name: 'process-session-leader-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.pid': { + dashed_name: 'process-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.real_group.id': { + dashed_name: 'process-session-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.real_group.name': { + dashed_name: 'process-session-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.real_user.id': { + dashed_name: 'process-session-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.real_user.name': { + dashed_name: 'process-session-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.same_as_process': { + dashed_name: 'process-session-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.session_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.session_leader.saved_group.id': { + dashed_name: 'process-session-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.saved_group.name': { + dashed_name: 'process-session-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.saved_user.id': { + dashed_name: 'process-session-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.saved_user.name': { + dashed_name: 'process-session-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.start': { + dashed_name: 'process-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.supplemental_groups.id': { + dashed_name: 'process-session-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.supplemental_groups.name': { + dashed_name: 'process-session-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.tty': { + dashed_name: 'process-session-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.session_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.session_leader.tty.char_device.major': { + dashed_name: 'process-session-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.session_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.session_leader.tty.char_device.minor': { + dashed_name: 'process-session-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.session_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.session_leader.user.id': { + dashed_name: 'process-session-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.user.name': { + dashed_name: 'process-session-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.working_directory': { + dashed_name: 'process-session-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.session_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.start': { + dashed_name: 'process-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.start', + level: 'extended', + name: 'start', + normalize: [], + short: 'The time the process started.', + type: 'date', + }, + 'process.supplemental_groups.id': { + dashed_name: 'process-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.supplemental_groups.name': { + dashed_name: 'process-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.thread.id': { + dashed_name: 'process-thread-id', + description: 'Thread ID.', + example: 4242, + flat_name: 'process.thread.id', + format: 'string', + level: 'extended', + name: 'thread.id', + normalize: [], + short: 'Thread ID.', + type: 'long', + }, + 'process.thread.name': { + dashed_name: 'process-thread-name', + description: 'Thread name.', + example: 'thread-0', + flat_name: 'process.thread.name', + ignore_above: 1024, + level: 'extended', + name: 'thread.name', + normalize: [], + short: 'Thread name.', + type: 'keyword', + }, + 'process.title': { + dashed_name: 'process-title', + description: + 'Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.', + flat_name: 'process.title', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.title.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'title', + normalize: [], + short: 'Process title.', + type: 'keyword', + }, + 'process.tty': { + dashed_name: 'process-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.tty', + level: 'extended', + name: 'tty', + normalize: [], + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.tty.char_device.major': { + dashed_name: 'process-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.tty.char_device.minor': { + dashed_name: 'process-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.tty.columns': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-tty-columns', + description: + "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'", + example: 80, + flat_name: 'process.tty.columns', + level: 'extended', + name: 'tty.columns', + normalize: [], + short: 'The number of character columns per line. e.g terminal width', + type: 'long', + }, + 'process.tty.rows': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-tty-rows', + description: + "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'", + example: 24, + flat_name: 'process.tty.rows', + level: 'extended', + name: 'tty.rows', + normalize: [], + short: 'The number of character rows in the terminal. e.g terminal height', + type: 'long', + }, + 'process.uptime': { + dashed_name: 'process-uptime', + description: 'Seconds the process has been up.', + example: 1325, + flat_name: 'process.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + short: 'Seconds the process has been up.', + type: 'long', + }, + 'process.user.id': { + dashed_name: 'process-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.user.name': { + dashed_name: 'process-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.working_directory': { + dashed_name: 'process-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + short: 'The working directory of the process.', + type: 'keyword', + }, + }, + group: 2, + name: 'process', + nestings: [ + 'process.attested_groups', + 'process.attested_user', + 'process.code_signature', + 'process.elf', + 'process.entry_leader', + 'process.entry_leader.parent', + 'process.entry_leader.parent.session_leader', + 'process.entry_meta.source', + 'process.group', + 'process.group_leader', + 'process.hash', + 'process.parent', + 'process.parent.group_leader', + 'process.pe', + 'process.previous', + 'process.real_group', + 'process.real_user', + 'process.saved_group', + 'process.saved_user', + 'process.session_leader', + 'process.session_leader.parent', + 'process.session_leader.parent.session_leader', + 'process.supplemental_groups', + 'process.user', + ], + prefix: 'process.', + reusable: { + expected: [ + { + as: 'parent', + at: 'process', + full: 'process.parent', + short_override: 'Information about the parent process.', + }, + { + as: 'entry_leader', + at: 'process', + full: 'process.entry_leader', + short_override: + 'First process from terminal or remote access via SSH, SSM, etc OR a service directly started by the init process.', + }, + { + as: 'session_leader', + at: 'process', + full: 'process.session_leader', + short_override: + 'Often the same as entry_leader. When it differs, it represents a session started within another session. e.g. using tmux', + }, + { + as: 'group_leader', + at: 'process', + full: 'process.group_leader', + short_override: + 'Information about the process group leader. In some cases this may be the same as the top level process.', + }, + { + as: 'group_leader', + at: 'process.parent', + full: 'process.parent.group_leader', + short_override: + "Information about the parent's process group leader. Only pid, start and entity_id fields are set.", + }, + { + as: 'parent', + at: 'process.entry_leader', + full: 'process.entry_leader.parent', + short_override: + "Information about the entry leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + as: 'parent', + at: 'process.session_leader', + full: 'process.session_leader.parent', + short_override: + "Information about the session leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + as: 'session_leader', + at: 'process.entry_leader.parent', + full: 'process.entry_leader.parent.session_leader', + short_override: + 'Information about the parent session of the entry leader. Only pid, start and entity_id fields are set.', + }, + { + as: 'session_leader', + at: 'process.session_leader.parent', + full: 'process.session_leader.parent.session_leader', + short_override: + 'Information about the parent session of the session leader. Only pid, start and entity_id fields are set.', + }, + { + as: 'previous', + at: 'process', + full: 'process.previous', + normalize: ['array'], + short_override: + 'An array of previous executions for the process, including the initial fork. Only executable and args are set.', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'process.group', + schema_name: 'group', + short: 'The effective group (egid).', + }, + { + full: 'process.real_group', + schema_name: 'group', + short: 'The real group (rgid).', + }, + { + full: 'process.saved_group', + schema_name: 'group', + short: 'The saved group (sgid).', + }, + { + full: 'process.supplemental_groups', + normalize: ['array'], + schema_name: 'group', + short: 'An array of supplemental groups.', + }, + { + beta: 'Reusing the `group` fields in this location is currently considered beta.', + full: 'process.attested_groups', + normalize: ['array'], + schema_name: 'group', + short: 'The externally attested groups based on an external source such as the Kube API.', + }, + { + full: 'process.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + { + full: 'process.pe', + schema_name: 'pe', + short: 'These fields contain Windows Portable Executable (PE) metadata.', + }, + { + full: 'process.code_signature', + schema_name: 'code_signature', + short: 'These fields contain information about binary code signatures.', + }, + { + beta: 'This field reuse is beta and subject to change.', + full: 'process.elf', + schema_name: 'elf', + short: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + }, + { + full: 'process.entry_meta.source', + schema_name: 'source', + short: 'Remote client information such as ip, port and geo location.', + }, + { + full: 'process.user', + schema_name: 'user', + short: 'The effective user (euid).', + }, + { + full: 'process.saved_user', + schema_name: 'user', + short: 'The saved user (suid).', + }, + { + full: 'process.real_user', + schema_name: 'user', + short: 'The real user (ruid). Identifies the real owner of the process.', + }, + { + beta: 'Reusing the `user` fields in this location is currently considered beta.', + full: 'process.attested_user', + schema_name: 'user', + short: 'The externally attested user based on an external source such as the Kube API.', + }, + { + full: 'process.parent', + schema_name: 'process', + short: 'Information about the parent process.', + }, + { + full: 'process.entry_leader', + schema_name: 'process', + short: + 'First process from terminal or remote access via SSH, SSM, etc OR a service directly started by the init process.', + }, + { + full: 'process.session_leader', + schema_name: 'process', + short: + 'Often the same as entry_leader. When it differs, it represents a session started within another session. e.g. using tmux', + }, + { + full: 'process.group_leader', + schema_name: 'process', + short: + 'Information about the process group leader. In some cases this may be the same as the top level process.', + }, + { + full: 'process.parent.group_leader', + schema_name: 'process', + short: + "Information about the parent's process group leader. Only pid, start and entity_id fields are set.", + }, + { + full: 'process.entry_leader.parent', + schema_name: 'process', + short: + "Information about the entry leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + full: 'process.session_leader.parent', + schema_name: 'process', + short: + "Information about the session leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + full: 'process.entry_leader.parent.session_leader', + schema_name: 'process', + short: + 'Information about the parent session of the entry leader. Only pid, start and entity_id fields are set.', + }, + { + full: 'process.session_leader.parent.session_leader', + schema_name: 'process', + short: + 'Information about the parent session of the session leader. Only pid, start and entity_id fields are set.', + }, + { + full: 'process.previous', + normalize: ['array'], + schema_name: 'process', + short: + 'An array of previous executions for the process, including the initial fork. Only executable and args are set.', + }, + ], + short: 'These fields contain information about a process.', + title: 'Process', + type: 'group', + }, + registry: { + description: 'Fields related to Windows Registry operations.', + fields: { + 'registry.data.bytes': { + dashed_name: 'registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'registry.data.strings': { + dashed_name: 'registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'registry.data.type': { + dashed_name: 'registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'registry.hive': { + dashed_name: 'registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'registry.key': { + dashed_name: 'registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'registry.path': { + dashed_name: 'registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'registry.value': { + dashed_name: 'registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + short: 'Name of the value written.', + type: 'keyword', + }, + }, + group: 2, + name: 'registry', + prefix: 'registry.', + reusable: { + expected: [ + { + as: 'registry', + at: 'threat.indicator', + full: 'threat.indicator.registry', + }, + { + as: 'registry', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.registry', + }, + ], + top_level: true, + }, + short: 'Fields related to Windows Registry operations.', + title: 'Registry', + type: 'group', + }, + related: { + description: + 'This field set is meant to facilitate pivoting around a piece of data.\nSome pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`.\nA concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`.', + fields: { + 'related.hash': { + dashed_name: 'related-hash', + description: + "All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search).", + flat_name: 'related.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: ['array'], + short: 'All the hashes seen on your event.', + type: 'keyword', + }, + 'related.hosts': { + dashed_name: 'related-hosts', + description: + 'All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases.', + flat_name: 'related.hosts', + ignore_above: 1024, + level: 'extended', + name: 'hosts', + normalize: ['array'], + short: 'All the host identifiers seen on your event.', + type: 'keyword', + }, + 'related.ip': { + dashed_name: 'related-ip', + description: 'All of the IPs seen on your event.', + flat_name: 'related.ip', + level: 'extended', + name: 'ip', + normalize: ['array'], + short: 'All of the IPs seen on your event.', + type: 'ip', + }, + 'related.user': { + dashed_name: 'related-user', + description: 'All the user names or other user identifiers seen on the event.', + flat_name: 'related.user', + ignore_above: 1024, + level: 'extended', + name: 'user', + normalize: ['array'], + short: 'All the user names or other user identifiers seen on the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'related', + prefix: 'related.', + short: 'Fields meant to facilitate pivoting around a piece of data.', + title: 'Related', + type: 'group', + }, + risk: { + beta: 'These fields are in beta and are subject to change.', + description: + 'Fields for describing risk score and risk level of entities such as hosts and users. These fields are not allowed to be nested under `event.*`. Please continue to use `event.risk_score` and `event.risk_score_norm` for event risk.', + fields: { + 'risk.calculated_level': { + dashed_name: 'risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'risk.calculated_score': { + dashed_name: 'risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'risk.calculated_score_norm': { + dashed_name: 'risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'risk.static_level': { + dashed_name: 'risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'risk.static_score': { + dashed_name: 'risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'risk.static_score_norm': { + dashed_name: 'risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + }, + group: 2, + name: 'risk', + prefix: 'risk.', + reusable: { + expected: [ + { as: 'risk', at: 'host', full: 'host.risk' }, + { as: 'risk', at: 'user', full: 'user.risk' }, + ], + top_level: false, + }, + short: 'Fields for describing risk score and level.', + title: 'Risk information', + type: 'group', + }, + rule: { + description: + 'Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.', + fields: { + 'rule.author': { + dashed_name: 'rule-author', + description: + 'Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.', + example: '["Star-Lord"]', + flat_name: 'rule.author', + ignore_above: 1024, + level: 'extended', + name: 'author', + normalize: ['array'], + short: 'Rule author', + type: 'keyword', + }, + 'rule.category': { + dashed_name: 'rule-category', + description: + 'A categorization value keyword used by the entity using the rule for detection of this event.', + example: 'Attempted Information Leak', + flat_name: 'rule.category', + ignore_above: 1024, + level: 'extended', + name: 'category', + normalize: [], + short: 'Rule category', + type: 'keyword', + }, + 'rule.description': { + dashed_name: 'rule-description', + description: 'The description of the rule generating the event.', + example: 'Block requests to public DNS over HTTPS / TLS protocols', + flat_name: 'rule.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Rule description', + type: 'keyword', + }, + 'rule.id': { + dashed_name: 'rule-id', + description: + 'A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.', + example: 101, + flat_name: 'rule.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Rule ID', + type: 'keyword', + }, + 'rule.license': { + dashed_name: 'rule-license', + description: + 'Name of the license under which the rule used to generate this event is made available.', + example: 'Apache 2.0', + flat_name: 'rule.license', + ignore_above: 1024, + level: 'extended', + name: 'license', + normalize: [], + short: 'Rule license', + type: 'keyword', + }, + 'rule.name': { + dashed_name: 'rule-name', + description: 'The name of the rule or signature generating the event.', + example: 'BLOCK_DNS_over_TLS', + flat_name: 'rule.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Rule name', + type: 'keyword', + }, + 'rule.reference': { + dashed_name: 'rule-reference', + description: + "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.", + example: 'https://en.wikipedia.org/wiki/DNS_over_TLS', + flat_name: 'rule.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Rule reference URL', + type: 'keyword', + }, + 'rule.ruleset': { + dashed_name: 'rule-ruleset', + description: + 'Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.', + example: 'Standard_Protocol_Filters', + flat_name: 'rule.ruleset', + ignore_above: 1024, + level: 'extended', + name: 'ruleset', + normalize: [], + short: 'Rule ruleset', + type: 'keyword', + }, + 'rule.uuid': { + dashed_name: 'rule-uuid', + description: + 'A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.', + example: 1100110011, + flat_name: 'rule.uuid', + ignore_above: 1024, + level: 'extended', + name: 'uuid', + normalize: [], + short: 'Rule UUID', + type: 'keyword', + }, + 'rule.version': { + dashed_name: 'rule-version', + description: 'The version / revision of the rule being used for analysis.', + example: 1.1, + flat_name: 'rule.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Rule version', + type: 'keyword', + }, + }, + group: 2, + name: 'rule', + prefix: 'rule.', + short: 'Fields to capture details about rules used to generate alerts or other notable events.', + title: 'Rule', + type: 'group', + }, + server: { + description: + 'A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records.\nFor TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term "responder" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events.\nClient / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.', + fields: { + 'server.address': { + dashed_name: 'server-address', + description: + 'Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'server.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Server network address.', + type: 'keyword', + }, + 'server.as.number': { + dashed_name: 'server-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'server.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'server.as.organization.name': { + dashed_name: 'server-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'server.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'server.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'server.bytes': { + dashed_name: 'server-bytes', + description: 'Bytes sent from the server to the client.', + example: 184, + flat_name: 'server.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the server to the client.', + type: 'long', + }, + 'server.domain': { + dashed_name: 'server-domain', + description: + 'The domain name of the server system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'server.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the server.', + type: 'keyword', + }, + 'server.geo.city_name': { + dashed_name: 'server-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'server.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'server.geo.continent_code': { + dashed_name: 'server-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'server.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'server.geo.continent_name': { + dashed_name: 'server-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'server.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'server.geo.country_iso_code': { + dashed_name: 'server-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'server.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'server.geo.country_name': { + dashed_name: 'server-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'server.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'server.geo.location': { + dashed_name: 'server-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'server.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'server.geo.name': { + dashed_name: 'server-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'server.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'server.geo.postal_code': { + dashed_name: 'server-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'server.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'server.geo.region_iso_code': { + dashed_name: 'server-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'server.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'server.geo.region_name': { + dashed_name: 'server-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'server.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'server.geo.timezone': { + dashed_name: 'server-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'server.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'server.ip': { + dashed_name: 'server-ip', + description: 'IP address of the server (IPv4 or IPv6).', + flat_name: 'server.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the server.', + type: 'ip', + }, + 'server.mac': { + dashed_name: 'server-mac', + description: + 'MAC address of the server.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'server.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the server.', + type: 'keyword', + }, + 'server.nat.ip': { + dashed_name: 'server-nat-ip', + description: + 'Translated ip of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'server.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Server NAT ip', + type: 'ip', + }, + 'server.nat.port': { + dashed_name: 'server-nat-port', + description: + 'Translated port of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'server.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Server NAT port', + type: 'long', + }, + 'server.packets': { + dashed_name: 'server-packets', + description: 'Packets sent from the server to the client.', + example: 12, + flat_name: 'server.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the server to the client.', + type: 'long', + }, + 'server.port': { + dashed_name: 'server-port', + description: 'Port of the server.', + flat_name: 'server.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the server.', + type: 'long', + }, + 'server.registered_domain': { + dashed_name: 'server-registered-domain', + description: + 'The highest registered server domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'server.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered server domain, stripped of the subdomain.', + type: 'keyword', + }, + 'server.subdomain': { + dashed_name: 'server-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'server.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'server.top_level_domain': { + dashed_name: 'server-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'server.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'server.user.domain': { + dashed_name: 'server-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'server.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'server.user.email': { + dashed_name: 'server-user-email', + description: 'User email address.', + flat_name: 'server.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'server.user.full_name': { + dashed_name: 'server-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'server.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'server.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'server.user.group.domain': { + dashed_name: 'server-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'server.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'server.user.group.id': { + dashed_name: 'server-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'server.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'server.user.group.name': { + dashed_name: 'server-user-group-name', + description: 'Name of the group.', + flat_name: 'server.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'server.user.hash': { + dashed_name: 'server-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'server.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'server.user.id': { + dashed_name: 'server-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'server.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'server.user.name': { + dashed_name: 'server-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'server.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'server.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'server.user.roles': { + dashed_name: 'server-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'server.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'server', + nestings: ['server.as', 'server.geo', 'server.user'], + prefix: 'server.', + reused_here: [ + { + full: 'server.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'server.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'server.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the server side of a network connection, used with client.', + title: 'Server', + type: 'group', + }, + service: { + description: + 'The service fields describe the service for or from which the data was collected.\nThese fields help you find and correlate logs for a specific service and version.', + fields: { + 'service.address': { + dashed_name: 'service-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Address of this service.', + type: 'keyword', + }, + 'service.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.ephemeral_id': { + dashed_name: 'service-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.id': { + dashed_name: 'service-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.name': { + dashed_name: 'service-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the service.', + type: 'keyword', + }, + 'service.node.name': { + dashed_name: 'service-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.node.role': { + dashed_name: 'service-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.node.roles': { + dashed_name: 'service-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.origin.address': { + dashed_name: 'service-origin-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.origin.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + original_fieldset: 'service', + short: 'Address of this service.', + type: 'keyword', + }, + 'service.origin.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-origin-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.origin.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + original_fieldset: 'service', + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.origin.ephemeral_id': { + dashed_name: 'service-origin-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.origin.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + original_fieldset: 'service', + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.origin.id': { + dashed_name: 'service-origin-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.origin.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'service', + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.origin.name': { + dashed_name: 'service-origin-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.origin.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service.', + type: 'keyword', + }, + 'service.origin.node.name': { + dashed_name: 'service-origin-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.origin.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.origin.node.role': { + dashed_name: 'service-origin-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.origin.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + original_fieldset: 'service', + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.origin.node.roles': { + dashed_name: 'service-origin-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.origin.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + original_fieldset: 'service', + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.origin.state': { + dashed_name: 'service-origin-state', + description: 'Current state of the service.', + flat_name: 'service.origin.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + original_fieldset: 'service', + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.origin.type': { + dashed_name: 'service-origin-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.origin.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + original_fieldset: 'service', + short: 'The type of the service.', + type: 'keyword', + }, + 'service.origin.version': { + dashed_name: 'service-origin-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.origin.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + original_fieldset: 'service', + short: 'Version of the service.', + type: 'keyword', + }, + 'service.state': { + dashed_name: 'service-state', + description: 'Current state of the service.', + flat_name: 'service.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.target.address': { + dashed_name: 'service-target-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.target.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + original_fieldset: 'service', + short: 'Address of this service.', + type: 'keyword', + }, + 'service.target.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-target-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.target.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + original_fieldset: 'service', + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.target.ephemeral_id': { + dashed_name: 'service-target-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.target.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + original_fieldset: 'service', + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.target.id': { + dashed_name: 'service-target-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.target.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'service', + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.target.name': { + dashed_name: 'service-target-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.target.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service.', + type: 'keyword', + }, + 'service.target.node.name': { + dashed_name: 'service-target-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.target.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.target.node.role': { + dashed_name: 'service-target-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.target.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + original_fieldset: 'service', + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.target.node.roles': { + dashed_name: 'service-target-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.target.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + original_fieldset: 'service', + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.target.state': { + dashed_name: 'service-target-state', + description: 'Current state of the service.', + flat_name: 'service.target.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + original_fieldset: 'service', + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.target.type': { + dashed_name: 'service-target-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.target.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + original_fieldset: 'service', + short: 'The type of the service.', + type: 'keyword', + }, + 'service.target.version': { + dashed_name: 'service-target-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.target.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + original_fieldset: 'service', + short: 'Version of the service.', + type: 'keyword', + }, + 'service.type': { + dashed_name: 'service-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'The type of the service.', + type: 'keyword', + }, + 'service.version': { + dashed_name: 'service-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Version of the service.', + type: 'keyword', + }, + }, + footnote: + 'The service fields may be self-nested under service.origin.* and service.target.* to describe origin or target services in the context of incoming or outgoing requests, respectively. However, the fieldsets service.origin.* and service.target.* must not be confused with the root service fieldset that is used to describe the actual service under observation. The fieldset service.origin.* may only be used in the context of incoming requests or events to describe the originating service of the request. The fieldset service.target.* may only be used in the context of outgoing requests or events to describe the target service of the request.', + group: 2, + name: 'service', + nestings: ['service.origin', 'service.target'], + prefix: 'service.', + reusable: { + expected: [ + { + as: 'origin', + at: 'service', + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.origin', + short_override: 'Describes the origin service in case of an incoming request or event.', + }, + { + as: 'target', + at: 'service', + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.target', + short_override: 'Describes the target service in case of an outgoing request or event.', + }, + ], + top_level: true, + }, + reused_here: [ + { + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.origin', + schema_name: 'service', + short: 'Describes the origin service in case of an incoming request or event.', + }, + { + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.target', + schema_name: 'service', + short: 'Describes the target service in case of an outgoing request or event.', + }, + ], + short: 'Fields describing the service for or from which the data was collected.', + title: 'Service', + type: 'group', + }, + source: { + description: + 'Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.', + fields: { + 'source.address': { + dashed_name: 'source-address', + description: + 'Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'source.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Source network address.', + type: 'keyword', + }, + 'source.as.number': { + dashed_name: 'source-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'source.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'source.as.organization.name': { + dashed_name: 'source-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'source.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'source.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'source.bytes': { + dashed_name: 'source-bytes', + description: 'Bytes sent from the source to the destination.', + example: 184, + flat_name: 'source.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the source to the destination.', + type: 'long', + }, + 'source.domain': { + dashed_name: 'source-domain', + description: + 'The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'source.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the source.', + type: 'keyword', + }, + 'source.geo.city_name': { + dashed_name: 'source-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'source.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'source.geo.continent_code': { + dashed_name: 'source-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'source.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'source.geo.continent_name': { + dashed_name: 'source-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'source.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'source.geo.country_iso_code': { + dashed_name: 'source-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'source.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'source.geo.country_name': { + dashed_name: 'source-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'source.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'source.geo.location': { + dashed_name: 'source-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'source.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'source.geo.name': { + dashed_name: 'source-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'source.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'source.geo.postal_code': { + dashed_name: 'source-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'source.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'source.geo.region_iso_code': { + dashed_name: 'source-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'source.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'source.geo.region_name': { + dashed_name: 'source-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'source.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'source.geo.timezone': { + dashed_name: 'source-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'source.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'source.ip': { + dashed_name: 'source-ip', + description: 'IP address of the source (IPv4 or IPv6).', + flat_name: 'source.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the source.', + type: 'ip', + }, + 'source.mac': { + dashed_name: 'source-mac', + description: + 'MAC address of the source.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'source.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the source.', + type: 'keyword', + }, + 'source.nat.ip': { + dashed_name: 'source-nat-ip', + description: + 'Translated ip of source based NAT sessions (e.g. internal client to internet)\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'source.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Source NAT ip', + type: 'ip', + }, + 'source.nat.port': { + dashed_name: 'source-nat-port', + description: + 'Translated port of source based NAT sessions. (e.g. internal client to internet)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'source.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Source NAT port', + type: 'long', + }, + 'source.packets': { + dashed_name: 'source-packets', + description: 'Packets sent from the source to the destination.', + example: 12, + flat_name: 'source.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the source to the destination.', + type: 'long', + }, + 'source.port': { + dashed_name: 'source-port', + description: 'Port of the source.', + flat_name: 'source.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the source.', + type: 'long', + }, + 'source.registered_domain': { + dashed_name: 'source-registered-domain', + description: + 'The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'source.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered source domain, stripped of the subdomain.', + type: 'keyword', + }, + 'source.subdomain': { + dashed_name: 'source-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'source.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'source.top_level_domain': { + dashed_name: 'source-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'source.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'source.user.domain': { + dashed_name: 'source-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'source.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'source.user.email': { + dashed_name: 'source-user-email', + description: 'User email address.', + flat_name: 'source.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'source.user.full_name': { + dashed_name: 'source-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'source.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'source.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'source.user.group.domain': { + dashed_name: 'source-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'source.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'source.user.group.id': { + dashed_name: 'source-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'source.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'source.user.group.name': { + dashed_name: 'source-user-group-name', + description: 'Name of the group.', + flat_name: 'source.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'source.user.hash': { + dashed_name: 'source-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'source.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'source.user.id': { + dashed_name: 'source-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'source.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'source.user.name': { + dashed_name: 'source-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'source.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'source.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'source.user.roles': { + dashed_name: 'source-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'source.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'source', + nestings: ['source.as', 'source.geo', 'source.user'], + prefix: 'source.', + reusable: { + expected: [ + { + as: 'source', + at: 'process.entry_meta', + full: 'process.entry_meta.source', + short_override: 'Remote client information such as ip, port and geo location.', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'source.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'source.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'source.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the source side of a network connection, used with destination.', + title: 'Source', + type: 'group', + }, + threat: { + description: + 'Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").', + fields: { + 'threat.enrichments': { + dashed_name: 'threat-enrichments', + description: + 'A list of associated indicators objects enriching the event, and the context of that association/enrichment.', + flat_name: 'threat.enrichments', + level: 'extended', + name: 'enrichments', + normalize: ['array'], + short: 'List of objects containing indicators enriching the event.', + type: 'nested', + }, + 'threat.enrichments.indicator': { + dashed_name: 'threat-enrichments-indicator', + description: 'Object containing associated indicators enriching the event.', + flat_name: 'threat.enrichments.indicator', + level: 'extended', + name: 'enrichments.indicator', + normalize: [], + short: 'Object containing indicators enriching the event.', + type: 'object', + }, + 'threat.enrichments.indicator.as.number': { + dashed_name: 'threat-enrichments-indicator-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'threat.enrichments.indicator.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'threat.enrichments.indicator.as.organization.name': { + dashed_name: 'threat-enrichments-indicator-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'threat.enrichments.indicator.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.confidence': { + dashed_name: 'threat-enrichments-indicator-confidence', + description: + 'Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.', + example: 'Medium', + expected_values: ['Not Specified', 'None', 'Low', 'Medium', 'High'], + flat_name: 'threat.enrichments.indicator.confidence', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.confidence', + normalize: [], + short: 'Indicator confidence rating', + type: 'keyword', + }, + 'threat.enrichments.indicator.description': { + dashed_name: 'threat-enrichments-indicator-description', + description: 'Describes the type of action conducted by the threat.', + example: 'IP x.x.x.x was observed delivering the Angler EK.', + flat_name: 'threat.enrichments.indicator.description', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.description', + normalize: [], + short: 'Indicator description', + type: 'keyword', + }, + 'threat.enrichments.indicator.email.address': { + dashed_name: 'threat-enrichments-indicator-email-address', + description: + 'Identifies a threat indicator as an email address (irrespective of direction).', + example: 'phish@example.com', + flat_name: 'threat.enrichments.indicator.email.address', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.email.address', + normalize: [], + short: 'Indicator email address', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.accessed': { + dashed_name: 'threat-enrichments-indicator-file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'threat.enrichments.indicator.file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file was accessed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.attributes': { + dashed_name: 'threat-enrichments-indicator-file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'threat.enrichments.indicator.file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + original_fieldset: 'file', + short: 'Array of file attributes.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.digest_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'threat.enrichments.indicator.file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.exists': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.code_signature.signing_id': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'threat.enrichments.indicator.file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.status': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'threat.enrichments.indicator.file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.subject_name': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'threat.enrichments.indicator.file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.team_id': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'threat.enrichments.indicator.file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.timestamp': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'threat.enrichments.indicator.file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.code_signature.trusted': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.code_signature.valid': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.created': { + dashed_name: 'threat-enrichments-indicator-file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'threat.enrichments.indicator.file.created', + level: 'extended', + name: 'created', + normalize: [], + original_fieldset: 'file', + short: 'File creation time.', + type: 'date', + }, + 'threat.enrichments.indicator.file.ctime': { + dashed_name: 'threat-enrichments-indicator-file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'threat.enrichments.indicator.file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.device': { + dashed_name: 'threat-enrichments-indicator-file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'threat.enrichments.indicator.file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + original_fieldset: 'file', + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.directory': { + dashed_name: 'threat-enrichments-indicator-file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'threat.enrichments.indicator.file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + original_fieldset: 'file', + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.drive_letter': { + dashed_name: 'threat-enrichments-indicator-file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'threat.enrichments.indicator.file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + original_fieldset: 'file', + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.architecture': { + dashed_name: 'threat-enrichments-indicator-file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'threat.enrichments.indicator.file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.byte_order': { + dashed_name: 'threat-enrichments-indicator-file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'threat.enrichments.indicator.file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.cpu_type': { + dashed_name: 'threat-enrichments-indicator-file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'threat.enrichments.indicator.file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.creation_date': { + dashed_name: 'threat-enrichments-indicator-file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'threat.enrichments.indicator.file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'threat.enrichments.indicator.file.elf.exports': { + dashed_name: 'threat-enrichments-indicator-file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'threat.enrichments.indicator.file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'threat.enrichments.indicator.file.elf.header.abi_version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'threat.enrichments.indicator.file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.class': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.data': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'threat.enrichments.indicator.file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.entrypoint': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.header.object_version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'threat.enrichments.indicator.file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.os_abi': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'threat.enrichments.indicator.file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'threat.enrichments.indicator.file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.imports': { + dashed_name: 'threat-enrichments-indicator-file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'threat.enrichments.indicator.file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'threat.enrichments.indicator.file.elf.sections': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'threat.enrichments.indicator.file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'threat.enrichments.indicator.file.elf.sections.chi2': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.entropy': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.flags': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.name': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.physical_offset': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.physical_size': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.virtual_address': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.virtual_size': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.segments': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'threat.enrichments.indicator.file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'threat.enrichments.indicator.file.elf.segments.sections': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'threat.enrichments.indicator.file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.segments.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'threat.enrichments.indicator.file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.shared_libraries': { + dashed_name: 'threat-enrichments-indicator-file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'threat.enrichments.indicator.file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.telfhash': { + dashed_name: 'threat-enrichments-indicator-file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.extension': { + dashed_name: 'threat-enrichments-indicator-file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.enrichments.indicator.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'file', + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.fork_name': { + dashed_name: 'threat-enrichments-indicator-file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'threat.enrichments.indicator.file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + original_fieldset: 'file', + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.gid': { + dashed_name: 'threat-enrichments-indicator-file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'threat.enrichments.indicator.file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + original_fieldset: 'file', + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.group': { + dashed_name: 'threat-enrichments-indicator-file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'threat.enrichments.indicator.file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + original_fieldset: 'file', + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.md5': { + dashed_name: 'threat-enrichments-indicator-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha1': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha256': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha384': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha512': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.ssdeep': { + dashed_name: 'threat-enrichments-indicator-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'threat.enrichments.indicator.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.tlsh': { + dashed_name: 'threat-enrichments-indicator-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'threat.enrichments.indicator.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.inode': { + dashed_name: 'threat-enrichments-indicator-file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'threat.enrichments.indicator.file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + original_fieldset: 'file', + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mime_type': { + dashed_name: 'threat-enrichments-indicator-file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'threat.enrichments.indicator.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + original_fieldset: 'file', + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mode': { + dashed_name: 'threat-enrichments-indicator-file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'threat.enrichments.indicator.file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + original_fieldset: 'file', + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mtime': { + dashed_name: 'threat-enrichments-indicator-file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'threat.enrichments.indicator.file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file content was modified.', + type: 'date', + }, + 'threat.enrichments.indicator.file.name': { + dashed_name: 'threat-enrichments-indicator-file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'threat.enrichments.indicator.file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'file', + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.owner': { + dashed_name: 'threat-enrichments-indicator-file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'threat.enrichments.indicator.file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + original_fieldset: 'file', + short: "File owner's username.", + type: 'keyword', + }, + 'threat.enrichments.indicator.file.path': { + dashed_name: 'threat-enrichments-indicator-file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'threat.enrichments.indicator.file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + original_fieldset: 'file', + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.architecture': { + dashed_name: 'threat-enrichments-indicator-file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'threat.enrichments.indicator.file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.company': { + dashed_name: 'threat-enrichments-indicator-file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'threat.enrichments.indicator.file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.description': { + dashed_name: 'threat-enrichments-indicator-file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'threat.enrichments.indicator.file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.file_version': { + dashed_name: 'threat-enrichments-indicator-file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'threat.enrichments.indicator.file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.imphash': { + dashed_name: 'threat-enrichments-indicator-file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'threat.enrichments.indicator.file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.original_file_name': { + dashed_name: 'threat-enrichments-indicator-file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'threat.enrichments.indicator.file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.pehash': { + dashed_name: 'threat-enrichments-indicator-file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'threat.enrichments.indicator.file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.product': { + dashed_name: 'threat-enrichments-indicator-file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'threat.enrichments.indicator.file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.size': { + dashed_name: 'threat-enrichments-indicator-file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'threat.enrichments.indicator.file.size', + level: 'extended', + name: 'size', + normalize: [], + original_fieldset: 'file', + short: 'File size in bytes.', + type: 'long', + }, + 'threat.enrichments.indicator.file.target_path': { + dashed_name: 'threat-enrichments-indicator-file-target-path', + description: 'Target path for symlinks.', + flat_name: 'threat.enrichments.indicator.file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + original_fieldset: 'file', + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.type': { + dashed_name: 'threat-enrichments-indicator-file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'threat.enrichments.indicator.file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'file', + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.uid': { + dashed_name: 'threat-enrichments-indicator-file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'threat.enrichments.indicator.file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + original_fieldset: 'file', + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.alternative_names': { + dashed_name: 'threat-enrichments-indicator-file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.enrichments.indicator.file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.common_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.country': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.locality': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.organization': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.state_or_province': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.not_after': { + dashed_name: 'threat-enrichments-indicator-file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.enrichments.indicator.file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.file.x509.not_before': { + dashed_name: 'threat-enrichments-indicator-file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.enrichments.indicator.file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.file.x509.public_key_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.enrichments.indicator.file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.public_key_curve': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.enrichments.indicator.file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.public_key_exponent': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.enrichments.indicator.file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.enrichments.indicator.file.x509.public_key_size': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.enrichments.indicator.file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.enrichments.indicator.file.x509.serial_number': { + dashed_name: 'threat-enrichments-indicator-file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.enrichments.indicator.file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.signature_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.enrichments.indicator.file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.common_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.enrichments.indicator.file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.country': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.enrichments.indicator.file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.enrichments.indicator.file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.locality': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.enrichments.indicator.file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.organization': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.enrichments.indicator.file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.enrichments.indicator.file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.state_or_province': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.version_number': { + dashed_name: 'threat-enrichments-indicator-file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.enrichments.indicator.file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.enrichments.indicator.first_seen': { + dashed_name: 'threat-enrichments-indicator-first-seen', + description: + 'The date and time when intelligence source first reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.first_seen', + level: 'extended', + name: 'enrichments.indicator.first_seen', + normalize: [], + short: 'Date/time indicator was first reported.', + type: 'date', + }, + 'threat.enrichments.indicator.geo.city_name': { + dashed_name: 'threat-enrichments-indicator-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'threat.enrichments.indicator.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.continent_code': { + dashed_name: 'threat-enrichments-indicator-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'threat.enrichments.indicator.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.continent_name': { + dashed_name: 'threat-enrichments-indicator-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'threat.enrichments.indicator.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.country_iso_code': { + dashed_name: 'threat-enrichments-indicator-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'threat.enrichments.indicator.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.country_name': { + dashed_name: 'threat-enrichments-indicator-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'threat.enrichments.indicator.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.location': { + dashed_name: 'threat-enrichments-indicator-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'threat.enrichments.indicator.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'threat.enrichments.indicator.geo.name': { + dashed_name: 'threat-enrichments-indicator-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'threat.enrichments.indicator.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.postal_code': { + dashed_name: 'threat-enrichments-indicator-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'threat.enrichments.indicator.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.region_iso_code': { + dashed_name: 'threat-enrichments-indicator-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'threat.enrichments.indicator.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.region_name': { + dashed_name: 'threat-enrichments-indicator-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'threat.enrichments.indicator.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.timezone': { + dashed_name: 'threat-enrichments-indicator-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'threat.enrichments.indicator.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'threat.enrichments.indicator.ip': { + dashed_name: 'threat-enrichments-indicator-ip', + description: 'Identifies a threat indicator as an IP address (irrespective of direction).', + example: '1.2.3.4', + flat_name: 'threat.enrichments.indicator.ip', + level: 'extended', + name: 'enrichments.indicator.ip', + normalize: [], + short: 'Indicator IP address', + type: 'ip', + }, + 'threat.enrichments.indicator.last_seen': { + dashed_name: 'threat-enrichments-indicator-last-seen', + description: + 'The date and time when intelligence source last reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.last_seen', + level: 'extended', + name: 'enrichments.indicator.last_seen', + normalize: [], + short: 'Date/time indicator was last reported.', + type: 'date', + }, + 'threat.enrichments.indicator.marking.tlp.version': { + dashed_name: 'threat-enrichments-indicator-marking-tlp-version', + description: 'Traffic Light Protocol version.', + example: 2, + flat_name: 'threat.enrichments.indicator.marking.tlp.version', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.marking.tlp.version', + normalize: [], + short: 'Indicator TLP version', + type: 'keyword', + }, + 'threat.enrichments.indicator.modified_at': { + dashed_name: 'threat-enrichments-indicator-modified-at', + description: + 'The date and time when intelligence source last modified information for this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.modified_at', + level: 'extended', + name: 'enrichments.indicator.modified_at', + normalize: [], + short: 'Date/time indicator was last updated.', + type: 'date', + }, + 'threat.enrichments.indicator.port': { + dashed_name: 'threat-enrichments-indicator-port', + description: 'Identifies a threat indicator as a port number (irrespective of direction).', + example: 443, + flat_name: 'threat.enrichments.indicator.port', + level: 'extended', + name: 'enrichments.indicator.port', + normalize: [], + short: 'Indicator port', + type: 'long', + }, + 'threat.enrichments.indicator.provider': { + dashed_name: 'threat-enrichments-indicator-provider', + description: "The name of the indicator's provider.", + example: 'lrz_urlhaus', + flat_name: 'threat.enrichments.indicator.provider', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.provider', + normalize: [], + short: 'Indicator provider', + type: 'keyword', + }, + 'threat.enrichments.indicator.reference': { + dashed_name: 'threat-enrichments-indicator-reference', + description: 'Reference URL linking to additional information about this indicator.', + example: 'https://system.example.com/indicator/0001234', + flat_name: 'threat.enrichments.indicator.reference', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.reference', + normalize: [], + short: 'Indicator reference URL', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.data.bytes': { + dashed_name: 'threat-enrichments-indicator-registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'threat.enrichments.indicator.registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + original_fieldset: 'registry', + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.data.strings': { + dashed_name: 'threat-enrichments-indicator-registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'threat.enrichments.indicator.registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + original_fieldset: 'registry', + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.registry.data.type': { + dashed_name: 'threat-enrichments-indicator-registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'threat.enrichments.indicator.registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + original_fieldset: 'registry', + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.hive': { + dashed_name: 'threat-enrichments-indicator-registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'threat.enrichments.indicator.registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + original_fieldset: 'registry', + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.key': { + dashed_name: 'threat-enrichments-indicator-registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'threat.enrichments.indicator.registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + original_fieldset: 'registry', + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.path': { + dashed_name: 'threat-enrichments-indicator-registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'threat.enrichments.indicator.registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + original_fieldset: 'registry', + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.value': { + dashed_name: 'threat-enrichments-indicator-registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'threat.enrichments.indicator.registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + original_fieldset: 'registry', + short: 'Name of the value written.', + type: 'keyword', + }, + 'threat.enrichments.indicator.scanner_stats': { + dashed_name: 'threat-enrichments-indicator-scanner-stats', + description: 'Count of AV/EDR vendors that successfully detected malicious file or URL.', + example: 4, + flat_name: 'threat.enrichments.indicator.scanner_stats', + level: 'extended', + name: 'enrichments.indicator.scanner_stats', + normalize: [], + short: 'Scanner statistics', + type: 'long', + }, + 'threat.enrichments.indicator.sightings': { + dashed_name: 'threat-enrichments-indicator-sightings', + description: 'Number of times this indicator was observed conducting threat activity.', + example: 20, + flat_name: 'threat.enrichments.indicator.sightings', + level: 'extended', + name: 'enrichments.indicator.sightings', + normalize: [], + short: 'Number of times indicator observed', + type: 'long', + }, + 'threat.enrichments.indicator.type': { + dashed_name: 'threat-enrichments-indicator-type', + description: 'Type of indicator as represented by Cyber Observable in STIX 2.0.', + example: 'ipv4-addr', + expected_values: [ + 'autonomous-system', + 'artifact', + 'directory', + 'domain-name', + 'email-addr', + 'file', + 'ipv4-addr', + 'ipv6-addr', + 'mac-addr', + 'mutex', + 'port', + 'process', + 'software', + 'url', + 'user-account', + 'windows-registry-key', + 'x509-certificate', + ], + flat_name: 'threat.enrichments.indicator.type', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.type', + normalize: [], + short: 'Type of indicator', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.domain': { + dashed_name: 'threat-enrichments-indicator-url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'threat.enrichments.indicator.url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'url', + short: 'Domain of the url.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.extension': { + dashed_name: 'threat-enrichments-indicator-url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.enrichments.indicator.url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'url', + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.fragment': { + dashed_name: 'threat-enrichments-indicator-url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'threat.enrichments.indicator.url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + original_fieldset: 'url', + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.full': { + dashed_name: 'threat-enrichments-indicator-url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'threat.enrichments.indicator.url.full', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.url.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'url', + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.original': { + dashed_name: 'threat-enrichments-indicator-url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'threat.enrichments.indicator.url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + original_fieldset: 'url', + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.password': { + dashed_name: 'threat-enrichments-indicator-url-password', + description: 'Password of the request.', + flat_name: 'threat.enrichments.indicator.url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + original_fieldset: 'url', + short: 'Password of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.path': { + dashed_name: 'threat-enrichments-indicator-url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'threat.enrichments.indicator.url.path', + level: 'extended', + name: 'path', + normalize: [], + original_fieldset: 'url', + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.port': { + dashed_name: 'threat-enrichments-indicator-url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'threat.enrichments.indicator.url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + original_fieldset: 'url', + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'threat.enrichments.indicator.url.query': { + dashed_name: 'threat-enrichments-indicator-url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'threat.enrichments.indicator.url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + original_fieldset: 'url', + short: 'Query string of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.registered_domain': { + dashed_name: 'threat-enrichments-indicator-url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'threat.enrichments.indicator.url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + original_fieldset: 'url', + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.scheme': { + dashed_name: 'threat-enrichments-indicator-url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'threat.enrichments.indicator.url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + original_fieldset: 'url', + short: 'Scheme of the url.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.subdomain': { + dashed_name: 'threat-enrichments-indicator-url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'threat.enrichments.indicator.url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + original_fieldset: 'url', + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.top_level_domain': { + dashed_name: 'threat-enrichments-indicator-url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'threat.enrichments.indicator.url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + original_fieldset: 'url', + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.username': { + dashed_name: 'threat-enrichments-indicator-url-username', + description: 'Username of the request.', + flat_name: 'threat.enrichments.indicator.url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + original_fieldset: 'url', + short: 'Username of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.alternative_names': { + dashed_name: 'threat-enrichments-indicator-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.enrichments.indicator.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.common_name': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.country': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.enrichments.indicator.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.locality': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.enrichments.indicator.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.organization': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.enrichments.indicator.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.enrichments.indicator.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.state_or_province': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.not_after': { + dashed_name: 'threat-enrichments-indicator-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.enrichments.indicator.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.x509.not_before': { + dashed_name: 'threat-enrichments-indicator-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.enrichments.indicator.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.x509.public_key_algorithm': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.enrichments.indicator.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.public_key_curve': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.enrichments.indicator.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.public_key_exponent': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.enrichments.indicator.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.enrichments.indicator.x509.public_key_size': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.enrichments.indicator.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.enrichments.indicator.x509.serial_number': { + dashed_name: 'threat-enrichments-indicator-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.enrichments.indicator.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.signature_algorithm': { + dashed_name: 'threat-enrichments-indicator-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.enrichments.indicator.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.common_name': { + dashed_name: 'threat-enrichments-indicator-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.enrichments.indicator.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.country': { + dashed_name: 'threat-enrichments-indicator-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.enrichments.indicator.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.enrichments.indicator.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.locality': { + dashed_name: 'threat-enrichments-indicator-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.enrichments.indicator.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.organization': { + dashed_name: 'threat-enrichments-indicator-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.enrichments.indicator.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.enrichments.indicator.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.state_or_province': { + dashed_name: 'threat-enrichments-indicator-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.version_number': { + dashed_name: 'threat-enrichments-indicator-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.enrichments.indicator.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.enrichments.matched.atomic': { + dashed_name: 'threat-enrichments-matched-atomic', + description: + 'Identifies the atomic indicator value that matched a local environment endpoint or network event.', + example: 'bad-domain.com', + flat_name: 'threat.enrichments.matched.atomic', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.atomic', + normalize: [], + short: 'Matched indicator value', + type: 'keyword', + }, + 'threat.enrichments.matched.field': { + dashed_name: 'threat-enrichments-matched-field', + description: + 'Identifies the field of the atomic indicator that matched a local environment endpoint or network event.', + example: 'file.hash.sha256', + flat_name: 'threat.enrichments.matched.field', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.field', + normalize: [], + short: 'Matched indicator field', + type: 'keyword', + }, + 'threat.enrichments.matched.id': { + dashed_name: 'threat-enrichments-matched-id', + description: 'Identifies the _id of the indicator document enriching the event.', + example: 'ff93aee5-86a1-4a61-b0e6-0cdc313d01b5', + flat_name: 'threat.enrichments.matched.id', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.id', + normalize: [], + short: 'Matched indicator identifier', + type: 'keyword', + }, + 'threat.enrichments.matched.index': { + dashed_name: 'threat-enrichments-matched-index', + description: 'Identifies the _index of the indicator document enriching the event.', + example: 'filebeat-8.0.0-2021.05.23-000011', + flat_name: 'threat.enrichments.matched.index', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.index', + normalize: [], + short: 'Matched indicator index', + type: 'keyword', + }, + 'threat.enrichments.matched.occurred': { + dashed_name: 'threat-enrichments-matched-occurred', + description: 'Indicates when the indicator match was generated', + example: '2021-10-05T17:00:58.326Z', + flat_name: 'threat.enrichments.matched.occurred', + level: 'extended', + name: 'enrichments.matched.occurred', + normalize: [], + short: 'Date of match', + type: 'date', + }, + 'threat.enrichments.matched.type': { + dashed_name: 'threat-enrichments-matched-type', + description: + 'Identifies the type of match that caused the event to be enriched with the given indicator', + example: 'indicator_match_rule', + flat_name: 'threat.enrichments.matched.type', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.type', + normalize: [], + short: 'Type of indicator match', + type: 'keyword', + }, + 'threat.feed.dashboard_id': { + dashed_name: 'threat-feed-dashboard-id', + description: + 'The saved object ID of the dashboard belonging to the threat feed for displaying dashboard links to threat feeds in Kibana.', + example: '5ba16340-72e6-11eb-a3e3-b3cc7c78a70f', + flat_name: 'threat.feed.dashboard_id', + ignore_above: 1024, + level: 'extended', + name: 'feed.dashboard_id', + normalize: [], + short: 'Feed dashboard ID.', + type: 'keyword', + }, + 'threat.feed.description': { + dashed_name: 'threat-feed-description', + description: 'Description of the threat feed in a UI friendly format.', + example: 'Threat feed from the AlienVault Open Threat eXchange network.', + flat_name: 'threat.feed.description', + ignore_above: 1024, + level: 'extended', + name: 'feed.description', + normalize: [], + short: 'Description of the threat feed.', + type: 'keyword', + }, + 'threat.feed.name': { + dashed_name: 'threat-feed-name', + description: 'The name of the threat feed in UI friendly format.', + example: 'AlienVault OTX', + flat_name: 'threat.feed.name', + ignore_above: 1024, + level: 'extended', + name: 'feed.name', + normalize: [], + short: 'Name of the threat feed.', + type: 'keyword', + }, + 'threat.feed.reference': { + dashed_name: 'threat-feed-reference', + description: 'Reference information for the threat feed in a UI friendly format.', + example: 'https://otx.alienvault.com', + flat_name: 'threat.feed.reference', + ignore_above: 1024, + level: 'extended', + name: 'feed.reference', + normalize: [], + short: 'Reference for the threat feed.', + type: 'keyword', + }, + 'threat.framework': { + dashed_name: 'threat-framework', + description: + 'Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.', + example: 'MITRE ATT&CK', + flat_name: 'threat.framework', + ignore_above: 1024, + level: 'extended', + name: 'framework', + normalize: [], + short: 'Threat classification framework.', + type: 'keyword', + }, + 'threat.group.alias': { + dashed_name: 'threat-group-alias', + description: + 'The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).', + example: '[ "Magecart Group 6" ]', + flat_name: 'threat.group.alias', + ignore_above: 1024, + level: 'extended', + name: 'group.alias', + normalize: ['array'], + short: 'Alias of the group.', + type: 'keyword', + }, + 'threat.group.id': { + dashed_name: 'threat-group-id', + description: + 'The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.', + example: 'G0037', + flat_name: 'threat.group.id', + ignore_above: 1024, + level: 'extended', + name: 'group.id', + normalize: [], + short: 'ID of the group.', + type: 'keyword', + }, + 'threat.group.name': { + dashed_name: 'threat-group-name', + description: + 'The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.', + example: 'FIN6', + flat_name: 'threat.group.name', + ignore_above: 1024, + level: 'extended', + name: 'group.name', + normalize: [], + short: 'Name of the group.', + type: 'keyword', + }, + 'threat.group.reference': { + dashed_name: 'threat-group-reference', + description: + 'The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.', + example: 'https://attack.mitre.org/groups/G0037/', + flat_name: 'threat.group.reference', + ignore_above: 1024, + level: 'extended', + name: 'group.reference', + normalize: [], + short: 'Reference URL of the group.', + type: 'keyword', + }, + 'threat.indicator.as.number': { + dashed_name: 'threat-indicator-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'threat.indicator.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'threat.indicator.as.organization.name': { + dashed_name: 'threat-indicator-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'threat.indicator.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'threat.indicator.confidence': { + dashed_name: 'threat-indicator-confidence', + description: + 'Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.', + example: 'Medium', + expected_values: ['Not Specified', 'None', 'Low', 'Medium', 'High'], + flat_name: 'threat.indicator.confidence', + ignore_above: 1024, + level: 'extended', + name: 'indicator.confidence', + normalize: [], + short: 'Indicator confidence rating', + type: 'keyword', + }, + 'threat.indicator.description': { + dashed_name: 'threat-indicator-description', + description: 'Describes the type of action conducted by the threat.', + example: 'IP x.x.x.x was observed delivering the Angler EK.', + flat_name: 'threat.indicator.description', + ignore_above: 1024, + level: 'extended', + name: 'indicator.description', + normalize: [], + short: 'Indicator description', + type: 'keyword', + }, + 'threat.indicator.email.address': { + dashed_name: 'threat-indicator-email-address', + description: + 'Identifies a threat indicator as an email address (irrespective of direction).', + example: 'phish@example.com', + flat_name: 'threat.indicator.email.address', + ignore_above: 1024, + level: 'extended', + name: 'indicator.email.address', + normalize: [], + short: 'Indicator email address', + type: 'keyword', + }, + 'threat.indicator.file.accessed': { + dashed_name: 'threat-indicator-file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'threat.indicator.file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file was accessed.', + type: 'date', + }, + 'threat.indicator.file.attributes': { + dashed_name: 'threat-indicator-file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'threat.indicator.file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + original_fieldset: 'file', + short: 'Array of file attributes.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.digest_algorithm': { + dashed_name: 'threat-indicator-file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'threat.indicator.file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.exists': { + dashed_name: 'threat-indicator-file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'threat.indicator.file.code_signature.signing_id': { + dashed_name: 'threat-indicator-file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'threat.indicator.file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.status': { + dashed_name: 'threat-indicator-file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'threat.indicator.file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.subject_name': { + dashed_name: 'threat-indicator-file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'threat.indicator.file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.team_id': { + dashed_name: 'threat-indicator-file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'threat.indicator.file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.timestamp': { + dashed_name: 'threat-indicator-file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'threat.indicator.file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'threat.indicator.file.code_signature.trusted': { + dashed_name: 'threat-indicator-file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'threat.indicator.file.code_signature.valid': { + dashed_name: 'threat-indicator-file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'threat.indicator.file.created': { + dashed_name: 'threat-indicator-file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'threat.indicator.file.created', + level: 'extended', + name: 'created', + normalize: [], + original_fieldset: 'file', + short: 'File creation time.', + type: 'date', + }, + 'threat.indicator.file.ctime': { + dashed_name: 'threat-indicator-file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'threat.indicator.file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'threat.indicator.file.device': { + dashed_name: 'threat-indicator-file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'threat.indicator.file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + original_fieldset: 'file', + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'threat.indicator.file.directory': { + dashed_name: 'threat-indicator-file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'threat.indicator.file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + original_fieldset: 'file', + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'threat.indicator.file.drive_letter': { + dashed_name: 'threat-indicator-file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'threat.indicator.file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + original_fieldset: 'file', + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'threat.indicator.file.elf.architecture': { + dashed_name: 'threat-indicator-file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'threat.indicator.file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.byte_order': { + dashed_name: 'threat-indicator-file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'threat.indicator.file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.cpu_type': { + dashed_name: 'threat-indicator-file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'threat.indicator.file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.creation_date': { + dashed_name: 'threat-indicator-file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'threat.indicator.file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'threat.indicator.file.elf.exports': { + dashed_name: 'threat-indicator-file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'threat.indicator.file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'threat.indicator.file.elf.header.abi_version': { + dashed_name: 'threat-indicator-file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'threat.indicator.file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.class': { + dashed_name: 'threat-indicator-file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.data': { + dashed_name: 'threat-indicator-file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'threat.indicator.file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.entrypoint': { + dashed_name: 'threat-indicator-file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'threat.indicator.file.elf.header.object_version': { + dashed_name: 'threat-indicator-file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'threat.indicator.file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.os_abi': { + dashed_name: 'threat-indicator-file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'threat.indicator.file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.type': { + dashed_name: 'threat-indicator-file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.version': { + dashed_name: 'threat-indicator-file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'threat.indicator.file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'threat.indicator.file.elf.imports': { + dashed_name: 'threat-indicator-file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'threat.indicator.file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'threat.indicator.file.elf.sections': { + dashed_name: 'threat-indicator-file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'threat.indicator.file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'threat.indicator.file.elf.sections.chi2': { + dashed_name: 'threat-indicator-file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'threat.indicator.file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.entropy': { + dashed_name: 'threat-indicator-file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'threat.indicator.file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.flags': { + dashed_name: 'threat-indicator-file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'threat.indicator.file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.name': { + dashed_name: 'threat-indicator-file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'threat.indicator.file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.physical_offset': { + dashed_name: 'threat-indicator-file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'threat.indicator.file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.physical_size': { + dashed_name: 'threat-indicator-file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'threat.indicator.file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.type': { + dashed_name: 'threat-indicator-file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'threat.indicator.file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.virtual_address': { + dashed_name: 'threat-indicator-file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'threat.indicator.file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.virtual_size': { + dashed_name: 'threat-indicator-file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'threat.indicator.file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'threat.indicator.file.elf.segments': { + dashed_name: 'threat-indicator-file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'threat.indicator.file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'threat.indicator.file.elf.segments.sections': { + dashed_name: 'threat-indicator-file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'threat.indicator.file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'threat.indicator.file.elf.segments.type': { + dashed_name: 'threat-indicator-file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'threat.indicator.file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'threat.indicator.file.elf.shared_libraries': { + dashed_name: 'threat-indicator-file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'threat.indicator.file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'threat.indicator.file.elf.telfhash': { + dashed_name: 'threat-indicator-file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'threat.indicator.file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.extension': { + dashed_name: 'threat-indicator-file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.indicator.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'file', + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'threat.indicator.file.fork_name': { + dashed_name: 'threat-indicator-file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'threat.indicator.file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + original_fieldset: 'file', + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'threat.indicator.file.gid': { + dashed_name: 'threat-indicator-file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'threat.indicator.file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + original_fieldset: 'file', + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'threat.indicator.file.group': { + dashed_name: 'threat-indicator-file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'threat.indicator.file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + original_fieldset: 'file', + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'threat.indicator.file.hash.md5': { + dashed_name: 'threat-indicator-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'threat.indicator.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha1': { + dashed_name: 'threat-indicator-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'threat.indicator.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha256': { + dashed_name: 'threat-indicator-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'threat.indicator.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha384': { + dashed_name: 'threat-indicator-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'threat.indicator.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha512': { + dashed_name: 'threat-indicator-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'threat.indicator.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.ssdeep': { + dashed_name: 'threat-indicator-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'threat.indicator.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.tlsh': { + dashed_name: 'threat-indicator-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'threat.indicator.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'threat.indicator.file.inode': { + dashed_name: 'threat-indicator-file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'threat.indicator.file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + original_fieldset: 'file', + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'threat.indicator.file.mime_type': { + dashed_name: 'threat-indicator-file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'threat.indicator.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + original_fieldset: 'file', + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'threat.indicator.file.mode': { + dashed_name: 'threat-indicator-file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'threat.indicator.file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + original_fieldset: 'file', + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'threat.indicator.file.mtime': { + dashed_name: 'threat-indicator-file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'threat.indicator.file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file content was modified.', + type: 'date', + }, + 'threat.indicator.file.name': { + dashed_name: 'threat-indicator-file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'threat.indicator.file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'file', + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'threat.indicator.file.owner': { + dashed_name: 'threat-indicator-file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'threat.indicator.file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + original_fieldset: 'file', + short: "File owner's username.", + type: 'keyword', + }, + 'threat.indicator.file.path': { + dashed_name: 'threat-indicator-file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'threat.indicator.file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + original_fieldset: 'file', + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'threat.indicator.file.pe.architecture': { + dashed_name: 'threat-indicator-file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'threat.indicator.file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'threat.indicator.file.pe.company': { + dashed_name: 'threat-indicator-file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'threat.indicator.file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.description': { + dashed_name: 'threat-indicator-file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'threat.indicator.file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.file_version': { + dashed_name: 'threat-indicator-file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'threat.indicator.file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'threat.indicator.file.pe.imphash': { + dashed_name: 'threat-indicator-file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'threat.indicator.file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'threat.indicator.file.pe.original_file_name': { + dashed_name: 'threat-indicator-file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'threat.indicator.file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.pehash': { + dashed_name: 'threat-indicator-file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'threat.indicator.file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'threat.indicator.file.pe.product': { + dashed_name: 'threat-indicator-file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'threat.indicator.file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.size': { + dashed_name: 'threat-indicator-file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'threat.indicator.file.size', + level: 'extended', + name: 'size', + normalize: [], + original_fieldset: 'file', + short: 'File size in bytes.', + type: 'long', + }, + 'threat.indicator.file.target_path': { + dashed_name: 'threat-indicator-file-target-path', + description: 'Target path for symlinks.', + flat_name: 'threat.indicator.file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + original_fieldset: 'file', + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'threat.indicator.file.type': { + dashed_name: 'threat-indicator-file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'threat.indicator.file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'file', + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'threat.indicator.file.uid': { + dashed_name: 'threat-indicator-file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'threat.indicator.file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + original_fieldset: 'file', + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'threat.indicator.file.x509.alternative_names': { + dashed_name: 'threat-indicator-file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.indicator.file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.common_name': { + dashed_name: 'threat-indicator-file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.country': { + dashed_name: 'threat-indicator-file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.indicator.file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.distinguished_name': { + dashed_name: 'threat-indicator-file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.locality': { + dashed_name: 'threat-indicator-file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.indicator.file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.organization': { + dashed_name: 'threat-indicator-file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.indicator.file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.organizational_unit': { + dashed_name: 'threat-indicator-file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.indicator.file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.state_or_province': { + dashed_name: 'threat-indicator-file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.file.x509.not_after': { + dashed_name: 'threat-indicator-file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.indicator.file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.indicator.file.x509.not_before': { + dashed_name: 'threat-indicator-file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.indicator.file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.indicator.file.x509.public_key_algorithm': { + dashed_name: 'threat-indicator-file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.indicator.file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.indicator.file.x509.public_key_curve': { + dashed_name: 'threat-indicator-file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.indicator.file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.indicator.file.x509.public_key_exponent': { + dashed_name: 'threat-indicator-file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.indicator.file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.indicator.file.x509.public_key_size': { + dashed_name: 'threat-indicator-file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.indicator.file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.indicator.file.x509.serial_number': { + dashed_name: 'threat-indicator-file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.indicator.file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.signature_algorithm': { + dashed_name: 'threat-indicator-file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.indicator.file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.common_name': { + dashed_name: 'threat-indicator-file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.indicator.file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.country': { + dashed_name: 'threat-indicator-file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.indicator.file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.distinguished_name': { + dashed_name: 'threat-indicator-file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.indicator.file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.locality': { + dashed_name: 'threat-indicator-file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.indicator.file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.organization': { + dashed_name: 'threat-indicator-file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.indicator.file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.organizational_unit': { + dashed_name: 'threat-indicator-file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.indicator.file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.state_or_province': { + dashed_name: 'threat-indicator-file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.file.x509.version_number': { + dashed_name: 'threat-indicator-file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.indicator.file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.indicator.first_seen': { + dashed_name: 'threat-indicator-first-seen', + description: + 'The date and time when intelligence source first reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.first_seen', + level: 'extended', + name: 'indicator.first_seen', + normalize: [], + short: 'Date/time indicator was first reported.', + type: 'date', + }, + 'threat.indicator.geo.city_name': { + dashed_name: 'threat-indicator-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'threat.indicator.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'threat.indicator.geo.continent_code': { + dashed_name: 'threat-indicator-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'threat.indicator.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'threat.indicator.geo.continent_name': { + dashed_name: 'threat-indicator-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'threat.indicator.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'threat.indicator.geo.country_iso_code': { + dashed_name: 'threat-indicator-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'threat.indicator.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'threat.indicator.geo.country_name': { + dashed_name: 'threat-indicator-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'threat.indicator.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'threat.indicator.geo.location': { + dashed_name: 'threat-indicator-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'threat.indicator.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'threat.indicator.geo.name': { + dashed_name: 'threat-indicator-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'threat.indicator.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'threat.indicator.geo.postal_code': { + dashed_name: 'threat-indicator-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'threat.indicator.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'threat.indicator.geo.region_iso_code': { + dashed_name: 'threat-indicator-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'threat.indicator.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'threat.indicator.geo.region_name': { + dashed_name: 'threat-indicator-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'threat.indicator.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'threat.indicator.geo.timezone': { + dashed_name: 'threat-indicator-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'threat.indicator.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'threat.indicator.ip': { + dashed_name: 'threat-indicator-ip', + description: 'Identifies a threat indicator as an IP address (irrespective of direction).', + example: '1.2.3.4', + flat_name: 'threat.indicator.ip', + level: 'extended', + name: 'indicator.ip', + normalize: [], + short: 'Indicator IP address', + type: 'ip', + }, + 'threat.indicator.last_seen': { + dashed_name: 'threat-indicator-last-seen', + description: + 'The date and time when intelligence source last reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.last_seen', + level: 'extended', + name: 'indicator.last_seen', + normalize: [], + short: 'Date/time indicator was last reported.', + type: 'date', + }, + 'threat.indicator.marking.tlp': { + dashed_name: 'threat-indicator-marking-tlp', + description: 'Traffic Light Protocol sharing markings.', + example: 'CLEAR', + expected_values: ['WHITE', 'CLEAR', 'GREEN', 'AMBER', 'AMBER+STRICT', 'RED'], + flat_name: 'threat.indicator.marking.tlp', + ignore_above: 1024, + level: 'extended', + name: 'indicator.marking.tlp', + normalize: [], + short: 'Indicator TLP marking', + type: 'keyword', + }, + 'threat.indicator.modified_at': { + dashed_name: 'threat-indicator-modified-at', + description: + 'The date and time when intelligence source last modified information for this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.modified_at', + level: 'extended', + name: 'indicator.modified_at', + normalize: [], + short: 'Date/time indicator was last updated.', + type: 'date', + }, + 'threat.indicator.port': { + dashed_name: 'threat-indicator-port', + description: 'Identifies a threat indicator as a port number (irrespective of direction).', + example: 443, + flat_name: 'threat.indicator.port', + level: 'extended', + name: 'indicator.port', + normalize: [], + short: 'Indicator port', + type: 'long', + }, + 'threat.indicator.provider': { + dashed_name: 'threat-indicator-provider', + description: "The name of the indicator's provider.", + example: 'lrz_urlhaus', + flat_name: 'threat.indicator.provider', + ignore_above: 1024, + level: 'extended', + name: 'indicator.provider', + normalize: [], + short: 'Indicator provider', + type: 'keyword', + }, + 'threat.indicator.reference': { + dashed_name: 'threat-indicator-reference', + description: 'Reference URL linking to additional information about this indicator.', + example: 'https://system.example.com/indicator/0001234', + flat_name: 'threat.indicator.reference', + ignore_above: 1024, + level: 'extended', + name: 'indicator.reference', + normalize: [], + short: 'Indicator reference URL', + type: 'keyword', + }, + 'threat.indicator.registry.data.bytes': { + dashed_name: 'threat-indicator-registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'threat.indicator.registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + original_fieldset: 'registry', + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'threat.indicator.registry.data.strings': { + dashed_name: 'threat-indicator-registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'threat.indicator.registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + original_fieldset: 'registry', + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'threat.indicator.registry.data.type': { + dashed_name: 'threat-indicator-registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'threat.indicator.registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + original_fieldset: 'registry', + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'threat.indicator.registry.hive': { + dashed_name: 'threat-indicator-registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'threat.indicator.registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + original_fieldset: 'registry', + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'threat.indicator.registry.key': { + dashed_name: 'threat-indicator-registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'threat.indicator.registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + original_fieldset: 'registry', + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'threat.indicator.registry.path': { + dashed_name: 'threat-indicator-registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'threat.indicator.registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + original_fieldset: 'registry', + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'threat.indicator.registry.value': { + dashed_name: 'threat-indicator-registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'threat.indicator.registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + original_fieldset: 'registry', + short: 'Name of the value written.', + type: 'keyword', + }, + 'threat.indicator.scanner_stats': { + dashed_name: 'threat-indicator-scanner-stats', + description: 'Count of AV/EDR vendors that successfully detected malicious file or URL.', + example: 4, + flat_name: 'threat.indicator.scanner_stats', + level: 'extended', + name: 'indicator.scanner_stats', + normalize: [], + short: 'Scanner statistics', + type: 'long', + }, + 'threat.indicator.sightings': { + dashed_name: 'threat-indicator-sightings', + description: 'Number of times this indicator was observed conducting threat activity.', + example: 20, + flat_name: 'threat.indicator.sightings', + level: 'extended', + name: 'indicator.sightings', + normalize: [], + short: 'Number of times indicator observed', + type: 'long', + }, + 'threat.indicator.type': { + dashed_name: 'threat-indicator-type', + description: 'Type of indicator as represented by Cyber Observable in STIX 2.0.', + example: 'ipv4-addr', + expected_values: [ + 'autonomous-system', + 'artifact', + 'directory', + 'domain-name', + 'email-addr', + 'file', + 'ipv4-addr', + 'ipv6-addr', + 'mac-addr', + 'mutex', + 'port', + 'process', + 'software', + 'url', + 'user-account', + 'windows-registry-key', + 'x509-certificate', + ], + flat_name: 'threat.indicator.type', + ignore_above: 1024, + level: 'extended', + name: 'indicator.type', + normalize: [], + short: 'Type of indicator', + type: 'keyword', + }, + 'threat.indicator.url.domain': { + dashed_name: 'threat-indicator-url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'threat.indicator.url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'url', + short: 'Domain of the url.', + type: 'keyword', + }, + 'threat.indicator.url.extension': { + dashed_name: 'threat-indicator-url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.indicator.url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'url', + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'threat.indicator.url.fragment': { + dashed_name: 'threat-indicator-url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'threat.indicator.url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + original_fieldset: 'url', + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'threat.indicator.url.full': { + dashed_name: 'threat-indicator-url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'threat.indicator.url.full', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.url.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'url', + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'threat.indicator.url.original': { + dashed_name: 'threat-indicator-url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'threat.indicator.url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + original_fieldset: 'url', + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'threat.indicator.url.password': { + dashed_name: 'threat-indicator-url-password', + description: 'Password of the request.', + flat_name: 'threat.indicator.url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + original_fieldset: 'url', + short: 'Password of the request.', + type: 'keyword', + }, + 'threat.indicator.url.path': { + dashed_name: 'threat-indicator-url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'threat.indicator.url.path', + level: 'extended', + name: 'path', + normalize: [], + original_fieldset: 'url', + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'threat.indicator.url.port': { + dashed_name: 'threat-indicator-url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'threat.indicator.url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + original_fieldset: 'url', + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'threat.indicator.url.query': { + dashed_name: 'threat-indicator-url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'threat.indicator.url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + original_fieldset: 'url', + short: 'Query string of the request.', + type: 'keyword', + }, + 'threat.indicator.url.registered_domain': { + dashed_name: 'threat-indicator-url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'threat.indicator.url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + original_fieldset: 'url', + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'threat.indicator.url.scheme': { + dashed_name: 'threat-indicator-url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'threat.indicator.url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + original_fieldset: 'url', + short: 'Scheme of the url.', + type: 'keyword', + }, + 'threat.indicator.url.subdomain': { + dashed_name: 'threat-indicator-url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'threat.indicator.url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + original_fieldset: 'url', + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'threat.indicator.url.top_level_domain': { + dashed_name: 'threat-indicator-url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'threat.indicator.url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + original_fieldset: 'url', + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'threat.indicator.url.username': { + dashed_name: 'threat-indicator-url-username', + description: 'Username of the request.', + flat_name: 'threat.indicator.url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + original_fieldset: 'url', + short: 'Username of the request.', + type: 'keyword', + }, + 'threat.indicator.x509.alternative_names': { + dashed_name: 'threat-indicator-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.indicator.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.common_name': { + dashed_name: 'threat-indicator-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.country': { + dashed_name: 'threat-indicator-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.indicator.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.distinguished_name': { + dashed_name: 'threat-indicator-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.locality': { + dashed_name: 'threat-indicator-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.indicator.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.organization': { + dashed_name: 'threat-indicator-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.indicator.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.organizational_unit': { + dashed_name: 'threat-indicator-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.indicator.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.state_or_province': { + dashed_name: 'threat-indicator-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.x509.not_after': { + dashed_name: 'threat-indicator-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.indicator.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.indicator.x509.not_before': { + dashed_name: 'threat-indicator-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.indicator.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.indicator.x509.public_key_algorithm': { + dashed_name: 'threat-indicator-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.indicator.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.indicator.x509.public_key_curve': { + dashed_name: 'threat-indicator-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.indicator.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.indicator.x509.public_key_exponent': { + dashed_name: 'threat-indicator-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.indicator.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.indicator.x509.public_key_size': { + dashed_name: 'threat-indicator-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.indicator.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.indicator.x509.serial_number': { + dashed_name: 'threat-indicator-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.indicator.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.signature_algorithm': { + dashed_name: 'threat-indicator-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.indicator.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.common_name': { + dashed_name: 'threat-indicator-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.indicator.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.country': { + dashed_name: 'threat-indicator-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.indicator.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.indicator.x509.subject.distinguished_name': { + dashed_name: 'threat-indicator-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.indicator.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.locality': { + dashed_name: 'threat-indicator-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.indicator.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.x509.subject.organization': { + dashed_name: 'threat-indicator-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.indicator.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.organizational_unit': { + dashed_name: 'threat-indicator-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.indicator.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.state_or_province': { + dashed_name: 'threat-indicator-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.x509.version_number': { + dashed_name: 'threat-indicator-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.indicator.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.software.alias': { + dashed_name: 'threat-software-alias', + description: + 'The alias(es) of the software for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® associated software description.', + example: '[ "X-Agent" ]', + flat_name: 'threat.software.alias', + ignore_above: 1024, + level: 'extended', + name: 'software.alias', + normalize: ['array'], + short: 'Alias of the software', + type: 'keyword', + }, + 'threat.software.id': { + dashed_name: 'threat-software-id', + description: + 'The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.', + example: 'S0552', + flat_name: 'threat.software.id', + ignore_above: 1024, + level: 'extended', + name: 'software.id', + normalize: [], + short: 'ID of the software', + type: 'keyword', + }, + 'threat.software.name': { + dashed_name: 'threat-software-name', + description: + 'The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.', + example: 'AdFind', + flat_name: 'threat.software.name', + ignore_above: 1024, + level: 'extended', + name: 'software.name', + normalize: [], + short: 'Name of the software.', + type: 'keyword', + }, + 'threat.software.platforms': { + dashed_name: 'threat-software-platforms', + description: + 'The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.', + example: '[ "Windows" ]', + expected_values: [ + 'AWS', + 'Azure', + 'Azure AD', + 'GCP', + 'Linux', + 'macOS', + 'Network', + 'Office 365', + 'SaaS', + 'Windows', + ], + flat_name: 'threat.software.platforms', + ignore_above: 1024, + level: 'extended', + name: 'software.platforms', + normalize: ['array'], + short: 'Platforms of the software.', + type: 'keyword', + }, + 'threat.software.reference': { + dashed_name: 'threat-software-reference', + description: + 'The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.', + example: 'https://attack.mitre.org/software/S0552/', + flat_name: 'threat.software.reference', + ignore_above: 1024, + level: 'extended', + name: 'software.reference', + normalize: [], + short: 'Software reference URL.', + type: 'keyword', + }, + 'threat.software.type': { + dashed_name: 'threat-software-type', + description: + 'The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.', + example: 'Tool', + expected_values: ['Malware', 'Tool'], + flat_name: 'threat.software.type', + ignore_above: 1024, + level: 'extended', + name: 'software.type', + normalize: [], + short: 'Software type.', + type: 'keyword', + }, + 'threat.tactic.id': { + dashed_name: 'threat-tactic-id', + description: + 'The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )', + example: 'TA0002', + flat_name: 'threat.tactic.id', + ignore_above: 1024, + level: 'extended', + name: 'tactic.id', + normalize: ['array'], + short: 'Threat tactic id.', + type: 'keyword', + }, + 'threat.tactic.name': { + dashed_name: 'threat-tactic-name', + description: + 'Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)', + example: 'Execution', + flat_name: 'threat.tactic.name', + ignore_above: 1024, + level: 'extended', + name: 'tactic.name', + normalize: ['array'], + short: 'Threat tactic.', + type: 'keyword', + }, + 'threat.tactic.reference': { + dashed_name: 'threat-tactic-reference', + description: + 'The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )', + example: 'https://attack.mitre.org/tactics/TA0002/', + flat_name: 'threat.tactic.reference', + ignore_above: 1024, + level: 'extended', + name: 'tactic.reference', + normalize: ['array'], + short: 'Threat tactic URL reference.', + type: 'keyword', + }, + 'threat.technique.id': { + dashed_name: 'threat-technique-id', + description: + 'The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'T1059', + flat_name: 'threat.technique.id', + ignore_above: 1024, + level: 'extended', + name: 'technique.id', + normalize: ['array'], + short: 'Threat technique id.', + type: 'keyword', + }, + 'threat.technique.name': { + dashed_name: 'threat-technique-name', + description: + 'The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'Command and Scripting Interpreter', + flat_name: 'threat.technique.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.technique.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'technique.name', + normalize: ['array'], + short: 'Threat technique name.', + type: 'keyword', + }, + 'threat.technique.reference': { + dashed_name: 'threat-technique-reference', + description: + 'The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'https://attack.mitre.org/techniques/T1059/', + flat_name: 'threat.technique.reference', + ignore_above: 1024, + level: 'extended', + name: 'technique.reference', + normalize: ['array'], + short: 'Threat technique URL reference.', + type: 'keyword', + }, + 'threat.technique.subtechnique.id': { + dashed_name: 'threat-technique-subtechnique-id', + description: + 'The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'T1059.001', + flat_name: 'threat.technique.subtechnique.id', + ignore_above: 1024, + level: 'extended', + name: 'technique.subtechnique.id', + normalize: ['array'], + short: 'Threat subtechnique id.', + type: 'keyword', + }, + 'threat.technique.subtechnique.name': { + dashed_name: 'threat-technique-subtechnique-name', + description: + 'The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'PowerShell', + flat_name: 'threat.technique.subtechnique.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.technique.subtechnique.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'technique.subtechnique.name', + normalize: ['array'], + short: 'Threat subtechnique name.', + type: 'keyword', + }, + 'threat.technique.subtechnique.reference': { + dashed_name: 'threat-technique-subtechnique-reference', + description: + 'The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'https://attack.mitre.org/techniques/T1059/001/', + flat_name: 'threat.technique.subtechnique.reference', + ignore_above: 1024, + level: 'extended', + name: 'technique.subtechnique.reference', + normalize: ['array'], + short: 'Threat subtechnique URL reference.', + type: 'keyword', + }, + 'threat.threat.indicator.marking.tlp.version': { + dashed_name: 'threat-threat-indicator-marking-tlp-version', + description: 'Traffic Light Protocol version.', + example: 2, + flat_name: 'threat.threat.indicator.marking.tlp.version', + ignore_above: 1024, + level: 'extended', + name: 'threat.indicator.marking.tlp.version', + normalize: [], + short: 'Indicator TLP version', + type: 'keyword', + }, + }, + group: 2, + name: 'threat', + nestings: [ + 'threat.enrichments.indicator.as', + 'threat.enrichments.indicator.file', + 'threat.enrichments.indicator.geo', + 'threat.enrichments.indicator.registry', + 'threat.enrichments.indicator.url', + 'threat.enrichments.indicator.x509', + 'threat.indicator.as', + 'threat.indicator.file', + 'threat.indicator.geo', + 'threat.indicator.registry', + 'threat.indicator.url', + 'threat.indicator.x509', + ], + prefix: 'threat.', + reused_here: [ + { + full: 'threat.indicator.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'threat.enrichments.indicator.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'threat.indicator.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'threat.enrichments.indicator.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'threat.indicator.file', + schema_name: 'file', + short: 'Fields describing files.', + }, + { + full: 'threat.enrichments.indicator.file', + schema_name: 'file', + short: 'Fields describing files.', + }, + { + full: 'threat.indicator.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'threat.enrichments.indicator.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'threat.indicator.registry', + schema_name: 'registry', + short: 'Fields related to Windows Registry operations.', + }, + { + full: 'threat.enrichments.indicator.registry', + schema_name: 'registry', + short: 'Fields related to Windows Registry operations.', + }, + { + full: 'threat.indicator.url', + schema_name: 'url', + short: 'Fields that let you store URLs in various forms.', + }, + { + full: 'threat.enrichments.indicator.url', + schema_name: 'url', + short: 'Fields that let you store URLs in various forms.', + }, + ], + short: 'Fields to classify events and alerts according to a threat taxonomy.', + title: 'Threat', + type: 'group', + }, + tls: { + description: + 'Fields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files.', + fields: { + 'tls.cipher': { + dashed_name: 'tls-cipher', + description: 'String indicating the cipher used during the current connection.', + example: 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256', + flat_name: 'tls.cipher', + ignore_above: 1024, + level: 'extended', + name: 'cipher', + normalize: [], + short: 'String indicating the cipher used during the current connection.', + type: 'keyword', + }, + 'tls.client.certificate': { + dashed_name: 'tls-client-certificate', + description: + 'PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list.', + example: 'MII...', + flat_name: 'tls.client.certificate', + ignore_above: 1024, + level: 'extended', + name: 'client.certificate', + normalize: [], + short: 'PEM-encoded stand-alone certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.certificate_chain': { + dashed_name: 'tls-client-certificate-chain', + description: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain.', + example: '["MII...", "MII..."]', + flat_name: 'tls.client.certificate_chain', + ignore_above: 1024, + level: 'extended', + name: 'client.certificate_chain', + normalize: ['array'], + short: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.md5': { + dashed_name: 'tls-client-hash-md5', + description: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC', + flat_name: 'tls.client.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.md5', + normalize: [], + short: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.sha1': { + dashed_name: 'tls-client-hash-sha1', + description: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '9E393D93138888D288266C2D915214D1D1CCEB2A', + flat_name: 'tls.client.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.sha1', + normalize: [], + short: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.sha256': { + dashed_name: 'tls-client-hash-sha256', + description: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0', + flat_name: 'tls.client.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.sha256', + normalize: [], + short: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.issuer': { + dashed_name: 'tls-client-issuer', + description: + 'Distinguished name of subject of the issuer of the x.509 certificate presented by the client.', + example: 'CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.client.issuer', + ignore_above: 1024, + level: 'extended', + name: 'client.issuer', + normalize: [], + short: + 'Distinguished name of subject of the issuer of the x.509 certificate presented by the client.', + type: 'keyword', + }, + 'tls.client.ja3': { + dashed_name: 'tls-client-ja3', + description: + 'A hash that identifies clients based on how they perform an SSL/TLS handshake.', + example: 'd4e5b18d6b55c71272893221c96ba240', + flat_name: 'tls.client.ja3', + ignore_above: 1024, + level: 'extended', + name: 'client.ja3', + normalize: [], + short: 'A hash that identifies clients based on how they perform an SSL/TLS handshake.', + type: 'keyword', + }, + 'tls.client.not_after': { + dashed_name: 'tls-client-not-after', + description: 'Date/Time indicating when client certificate is no longer considered valid.', + example: '2021-01-01T00:00:00.000Z', + flat_name: 'tls.client.not_after', + level: 'extended', + name: 'client.not_after', + normalize: [], + short: 'Date/Time indicating when client certificate is no longer considered valid.', + type: 'date', + }, + 'tls.client.not_before': { + dashed_name: 'tls-client-not-before', + description: 'Date/Time indicating when client certificate is first considered valid.', + example: '1970-01-01T00:00:00.000Z', + flat_name: 'tls.client.not_before', + level: 'extended', + name: 'client.not_before', + normalize: [], + short: 'Date/Time indicating when client certificate is first considered valid.', + type: 'date', + }, + 'tls.client.server_name': { + dashed_name: 'tls-client-server-name', + description: + 'Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`.', + example: 'www.elastic.co', + flat_name: 'tls.client.server_name', + ignore_above: 1024, + level: 'extended', + name: 'client.server_name', + normalize: [], + short: 'Hostname the client is trying to connect to. Also called the SNI.', + type: 'keyword', + }, + 'tls.client.subject': { + dashed_name: 'tls-client-subject', + description: + 'Distinguished name of subject of the x.509 certificate presented by the client.', + example: 'CN=myclient, OU=Documentation Team, DC=example, DC=com', + flat_name: 'tls.client.subject', + ignore_above: 1024, + level: 'extended', + name: 'client.subject', + normalize: [], + short: 'Distinguished name of subject of the x.509 certificate presented by the client.', + type: 'keyword', + }, + 'tls.client.supported_ciphers': { + dashed_name: 'tls-client-supported-ciphers', + description: 'Array of ciphers offered by the client during the client hello.', + example: + '["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]', + flat_name: 'tls.client.supported_ciphers', + ignore_above: 1024, + level: 'extended', + name: 'client.supported_ciphers', + normalize: ['array'], + short: 'Array of ciphers offered by the client during the client hello.', + type: 'keyword', + }, + 'tls.client.x509.alternative_names': { + dashed_name: 'tls-client-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'tls.client.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'tls.client.x509.issuer.common_name': { + dashed_name: 'tls-client-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'tls.client.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.country': { + dashed_name: 'tls-client-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'tls.client.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'tls.client.x509.issuer.distinguished_name': { + dashed_name: 'tls-client-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'tls.client.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.locality': { + dashed_name: 'tls-client-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'tls.client.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.client.x509.issuer.organization': { + dashed_name: 'tls-client-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'tls.client.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.organizational_unit': { + dashed_name: 'tls-client-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'tls.client.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.state_or_province': { + dashed_name: 'tls-client-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.client.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.client.x509.not_after': { + dashed_name: 'tls-client-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'tls.client.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'tls.client.x509.not_before': { + dashed_name: 'tls-client-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'tls.client.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'tls.client.x509.public_key_algorithm': { + dashed_name: 'tls-client-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'tls.client.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'tls.client.x509.public_key_curve': { + dashed_name: 'tls-client-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'tls.client.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'tls.client.x509.public_key_exponent': { + dashed_name: 'tls-client-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'tls.client.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'tls.client.x509.public_key_size': { + dashed_name: 'tls-client-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'tls.client.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'tls.client.x509.serial_number': { + dashed_name: 'tls-client-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'tls.client.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.signature_algorithm': { + dashed_name: 'tls-client-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'tls.client.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'tls.client.x509.subject.common_name': { + dashed_name: 'tls-client-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'tls.client.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.country': { + dashed_name: 'tls-client-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'tls.client.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'tls.client.x509.subject.distinguished_name': { + dashed_name: 'tls-client-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'tls.client.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'tls.client.x509.subject.locality': { + dashed_name: 'tls-client-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'tls.client.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.client.x509.subject.organization': { + dashed_name: 'tls-client-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'tls.client.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.organizational_unit': { + dashed_name: 'tls-client-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'tls.client.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.state_or_province': { + dashed_name: 'tls-client-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.client.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.client.x509.version_number': { + dashed_name: 'tls-client-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'tls.client.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'tls.curve': { + dashed_name: 'tls-curve', + description: 'String indicating the curve used for the given cipher, when applicable.', + example: 'secp256r1', + flat_name: 'tls.curve', + ignore_above: 1024, + level: 'extended', + name: 'curve', + normalize: [], + short: 'String indicating the curve used for the given cipher, when applicable.', + type: 'keyword', + }, + 'tls.established': { + dashed_name: 'tls-established', + description: + 'Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.', + flat_name: 'tls.established', + level: 'extended', + name: 'established', + normalize: [], + short: + 'Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.', + type: 'boolean', + }, + 'tls.next_protocol': { + dashed_name: 'tls-next-protocol', + description: + 'String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case.', + example: 'http/1.1', + flat_name: 'tls.next_protocol', + ignore_above: 1024, + level: 'extended', + name: 'next_protocol', + normalize: [], + short: 'String indicating the protocol being tunneled.', + type: 'keyword', + }, + 'tls.resumed': { + dashed_name: 'tls-resumed', + description: + 'Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.', + flat_name: 'tls.resumed', + level: 'extended', + name: 'resumed', + normalize: [], + short: + 'Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.', + type: 'boolean', + }, + 'tls.server.certificate': { + dashed_name: 'tls-server-certificate', + description: + 'PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list.', + example: 'MII...', + flat_name: 'tls.server.certificate', + ignore_above: 1024, + level: 'extended', + name: 'server.certificate', + normalize: [], + short: 'PEM-encoded stand-alone certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.certificate_chain': { + dashed_name: 'tls-server-certificate-chain', + description: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain.', + example: '["MII...", "MII..."]', + flat_name: 'tls.server.certificate_chain', + ignore_above: 1024, + level: 'extended', + name: 'server.certificate_chain', + normalize: ['array'], + short: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.md5': { + dashed_name: 'tls-server-hash-md5', + description: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC', + flat_name: 'tls.server.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.md5', + normalize: [], + short: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.sha1': { + dashed_name: 'tls-server-hash-sha1', + description: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '9E393D93138888D288266C2D915214D1D1CCEB2A', + flat_name: 'tls.server.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.sha1', + normalize: [], + short: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.sha256': { + dashed_name: 'tls-server-hash-sha256', + description: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0', + flat_name: 'tls.server.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.sha256', + normalize: [], + short: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.issuer': { + dashed_name: 'tls-server-issuer', + description: 'Subject of the issuer of the x.509 certificate presented by the server.', + example: 'CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.server.issuer', + ignore_above: 1024, + level: 'extended', + name: 'server.issuer', + normalize: [], + short: 'Subject of the issuer of the x.509 certificate presented by the server.', + type: 'keyword', + }, + 'tls.server.ja3s': { + dashed_name: 'tls-server-ja3s', + description: + 'A hash that identifies servers based on how they perform an SSL/TLS handshake.', + example: '394441ab65754e2207b1e1b457b3641d', + flat_name: 'tls.server.ja3s', + ignore_above: 1024, + level: 'extended', + name: 'server.ja3s', + normalize: [], + short: 'A hash that identifies servers based on how they perform an SSL/TLS handshake.', + type: 'keyword', + }, + 'tls.server.not_after': { + dashed_name: 'tls-server-not-after', + description: 'Timestamp indicating when server certificate is no longer considered valid.', + example: '2021-01-01T00:00:00.000Z', + flat_name: 'tls.server.not_after', + level: 'extended', + name: 'server.not_after', + normalize: [], + short: 'Timestamp indicating when server certificate is no longer considered valid.', + type: 'date', + }, + 'tls.server.not_before': { + dashed_name: 'tls-server-not-before', + description: 'Timestamp indicating when server certificate is first considered valid.', + example: '1970-01-01T00:00:00.000Z', + flat_name: 'tls.server.not_before', + level: 'extended', + name: 'server.not_before', + normalize: [], + short: 'Timestamp indicating when server certificate is first considered valid.', + type: 'date', + }, + 'tls.server.subject': { + dashed_name: 'tls-server-subject', + description: 'Subject of the x.509 certificate presented by the server.', + example: 'CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.server.subject', + ignore_above: 1024, + level: 'extended', + name: 'server.subject', + normalize: [], + short: 'Subject of the x.509 certificate presented by the server.', + type: 'keyword', + }, + 'tls.server.x509.alternative_names': { + dashed_name: 'tls-server-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'tls.server.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'tls.server.x509.issuer.common_name': { + dashed_name: 'tls-server-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'tls.server.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.country': { + dashed_name: 'tls-server-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'tls.server.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'tls.server.x509.issuer.distinguished_name': { + dashed_name: 'tls-server-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'tls.server.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.locality': { + dashed_name: 'tls-server-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'tls.server.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.server.x509.issuer.organization': { + dashed_name: 'tls-server-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'tls.server.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.organizational_unit': { + dashed_name: 'tls-server-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'tls.server.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.state_or_province': { + dashed_name: 'tls-server-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.server.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.server.x509.not_after': { + dashed_name: 'tls-server-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'tls.server.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'tls.server.x509.not_before': { + dashed_name: 'tls-server-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'tls.server.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'tls.server.x509.public_key_algorithm': { + dashed_name: 'tls-server-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'tls.server.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'tls.server.x509.public_key_curve': { + dashed_name: 'tls-server-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'tls.server.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'tls.server.x509.public_key_exponent': { + dashed_name: 'tls-server-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'tls.server.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'tls.server.x509.public_key_size': { + dashed_name: 'tls-server-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'tls.server.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'tls.server.x509.serial_number': { + dashed_name: 'tls-server-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'tls.server.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.signature_algorithm': { + dashed_name: 'tls-server-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'tls.server.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'tls.server.x509.subject.common_name': { + dashed_name: 'tls-server-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'tls.server.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.country': { + dashed_name: 'tls-server-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'tls.server.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'tls.server.x509.subject.distinguished_name': { + dashed_name: 'tls-server-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'tls.server.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'tls.server.x509.subject.locality': { + dashed_name: 'tls-server-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'tls.server.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.server.x509.subject.organization': { + dashed_name: 'tls-server-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'tls.server.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.organizational_unit': { + dashed_name: 'tls-server-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'tls.server.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.state_or_province': { + dashed_name: 'tls-server-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.server.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.server.x509.version_number': { + dashed_name: 'tls-server-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'tls.server.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'tls.version': { + dashed_name: 'tls-version', + description: 'Numeric part of the version parsed from the original string.', + example: '1.2', + flat_name: 'tls.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Numeric part of the version parsed from the original string.', + type: 'keyword', + }, + 'tls.version_protocol': { + dashed_name: 'tls-version-protocol', + description: 'Normalized lowercase protocol name parsed from original string.', + example: 'tls', + flat_name: 'tls.version_protocol', + ignore_above: 1024, + level: 'extended', + name: 'version_protocol', + normalize: [], + short: 'Normalized lowercase protocol name parsed from original string.', + type: 'keyword', + }, + }, + group: 2, + name: 'tls', + nestings: ['tls.client.x509', 'tls.server.x509'], + prefix: 'tls.', + reused_here: [ + { + full: 'tls.client.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'tls.server.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + ], + short: 'Fields describing a TLS connection.', + title: 'TLS', + type: 'group', + }, + tracing: { + description: + 'Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.\nUnlike most field sets in ECS, the tracing fields are *not* nested under the field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, and so on.', + fields: { + 'span.id': { + dashed_name: 'span-id', + description: + 'Unique identifier of the span within the scope of its trace.\nA span represents an operation within a transaction, such as a request to another service, or a database query.', + example: '3ff9a8981b7ccd5a', + flat_name: 'span.id', + ignore_above: 1024, + level: 'extended', + name: 'span.id', + normalize: [], + short: 'Unique identifier of the span within the scope of its trace.', + type: 'keyword', + }, + 'trace.id': { + dashed_name: 'trace-id', + description: + 'Unique identifier of the trace.\nA trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services.', + example: '4bf92f3577b34da6a3ce929d0e0e4736', + flat_name: 'trace.id', + ignore_above: 1024, + level: 'extended', + name: 'trace.id', + normalize: [], + short: 'Unique identifier of the trace.', + type: 'keyword', + }, + 'transaction.id': { + dashed_name: 'transaction-id', + description: + 'Unique identifier of the transaction within the scope of its trace.\nA transaction is the highest level of work measured within a service, such as a request to a server.', + example: '00f067aa0ba902b7', + flat_name: 'transaction.id', + ignore_above: 1024, + level: 'extended', + name: 'transaction.id', + normalize: [], + short: 'Unique identifier of the transaction within the scope of its trace.', + type: 'keyword', + }, + }, + group: 2, + name: 'tracing', + prefix: '', + root: true, + short: 'Fields related to distributed tracing.', + title: 'Tracing', + type: 'group', + }, + url: { + description: + 'URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on.', + fields: { + 'url.domain': { + dashed_name: 'url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Domain of the url.', + type: 'keyword', + }, + 'url.extension': { + dashed_name: 'url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'url.fragment': { + dashed_name: 'url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'url.full': { + dashed_name: 'url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'url.full', + level: 'extended', + multi_fields: [{ flat_name: 'url.full.text', name: 'text', type: 'match_only_text' }], + name: 'full', + normalize: [], + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'url.original': { + dashed_name: 'url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'url.password': { + dashed_name: 'url-password', + description: 'Password of the request.', + flat_name: 'url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + short: 'Password of the request.', + type: 'keyword', + }, + 'url.path': { + dashed_name: 'url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'url.path', + level: 'extended', + name: 'path', + normalize: [], + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'url.port': { + dashed_name: 'url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'url.query': { + dashed_name: 'url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + short: 'Query string of the request.', + type: 'keyword', + }, + 'url.registered_domain': { + dashed_name: 'url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'url.scheme': { + dashed_name: 'url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + short: 'Scheme of the url.', + type: 'keyword', + }, + 'url.subdomain': { + dashed_name: 'url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'url.top_level_domain': { + dashed_name: 'url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'url.username': { + dashed_name: 'url-username', + description: 'Username of the request.', + flat_name: 'url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + short: 'Username of the request.', + type: 'keyword', + }, + }, + group: 2, + name: 'url', + prefix: 'url.', + reusable: { + expected: [ + { as: 'url', at: 'threat.indicator', full: 'threat.indicator.url' }, + { + as: 'url', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.url', + }, + ], + top_level: true, + }, + short: 'Fields that let you store URLs in various forms.', + title: 'URL', + type: 'group', + }, + user: { + description: + 'The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.', + fields: { + 'user.changes.domain': { + dashed_name: 'user-changes-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.changes.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.changes.email': { + dashed_name: 'user-changes-email', + description: 'User email address.', + flat_name: 'user.changes.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.changes.full_name': { + dashed_name: 'user-changes-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.changes.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.changes.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.changes.group.domain': { + dashed_name: 'user-changes-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.changes.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.changes.group.id': { + dashed_name: 'user-changes-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.changes.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.changes.group.name': { + dashed_name: 'user-changes-group-name', + description: 'Name of the group.', + flat_name: 'user.changes.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.changes.hash': { + dashed_name: 'user-changes-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.changes.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.changes.id': { + dashed_name: 'user-changes-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.changes.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.changes.name': { + dashed_name: 'user-changes-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.changes.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.changes.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.changes.roles': { + dashed_name: 'user-changes-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.changes.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.domain': { + dashed_name: 'user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.effective.domain': { + dashed_name: 'user-effective-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.effective.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.effective.email': { + dashed_name: 'user-effective-email', + description: 'User email address.', + flat_name: 'user.effective.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.effective.full_name': { + dashed_name: 'user-effective-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.effective.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.effective.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.effective.group.domain': { + dashed_name: 'user-effective-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.effective.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.effective.group.id': { + dashed_name: 'user-effective-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.effective.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.effective.group.name': { + dashed_name: 'user-effective-group-name', + description: 'Name of the group.', + flat_name: 'user.effective.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.effective.hash': { + dashed_name: 'user-effective-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.effective.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.effective.id': { + dashed_name: 'user-effective-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.effective.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.effective.name': { + dashed_name: 'user-effective-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.effective.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.effective.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.effective.roles': { + dashed_name: 'user-effective-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.effective.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.email': { + dashed_name: 'user-email', + description: 'User email address.', + flat_name: 'user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + short: 'User email address.', + type: 'keyword', + }, + 'user.full_name': { + dashed_name: 'user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.group.domain': { + dashed_name: 'user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.group.id': { + dashed_name: 'user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.group.name': { + dashed_name: 'user-group-name', + description: 'Name of the group.', + flat_name: 'user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.hash': { + dashed_name: 'user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.id': { + dashed_name: 'user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.name': { + dashed_name: 'user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.risk.calculated_level': { + dashed_name: 'user-risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'user.risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'user.risk.calculated_score': { + dashed_name: 'user-risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'user.risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'user.risk.calculated_score_norm': { + dashed_name: 'user-risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'user.risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'user.risk.static_level': { + dashed_name: 'user-risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'user.risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'user.risk.static_score': { + dashed_name: 'user-risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'user.risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'user.risk.static_score_norm': { + dashed_name: 'user-risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'user.risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + 'user.roles': { + dashed_name: 'user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.target.domain': { + dashed_name: 'user-target-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.target.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.target.email': { + dashed_name: 'user-target-email', + description: 'User email address.', + flat_name: 'user.target.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.target.full_name': { + dashed_name: 'user-target-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.target.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.target.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.target.group.domain': { + dashed_name: 'user-target-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.target.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.target.group.id': { + dashed_name: 'user-target-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.target.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.target.group.name': { + dashed_name: 'user-target-group-name', + description: 'Name of the group.', + flat_name: 'user.target.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.target.hash': { + dashed_name: 'user-target-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.target.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.target.id': { + dashed_name: 'user-target-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.target.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.target.name': { + dashed_name: 'user-target-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.target.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.target.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.target.roles': { + dashed_name: 'user-target-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.target.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'user', + nestings: ['user.changes', 'user.effective', 'user.group', 'user.risk', 'user.target'], + prefix: 'user.', + reusable: { + expected: [ + { as: 'user', at: 'client', full: 'client.user' }, + { as: 'user', at: 'destination', full: 'destination.user' }, + { as: 'user', at: 'server', full: 'server.user' }, + { as: 'user', at: 'source', full: 'source.user' }, + { + as: 'target', + at: 'user', + full: 'user.target', + short_override: 'Targeted user of action taken.', + }, + { + as: 'effective', + at: 'user', + full: 'user.effective', + short_override: 'User whose privileges were assumed.', + }, + { + as: 'changes', + at: 'user', + full: 'user.changes', + short_override: 'Captures changes made to a user.', + }, + { + as: 'user', + at: 'process', + full: 'process.user', + short_override: 'The effective user (euid).', + }, + { + as: 'saved_user', + at: 'process', + full: 'process.saved_user', + short_override: 'The saved user (suid).', + }, + { + as: 'real_user', + at: 'process', + full: 'process.real_user', + short_override: 'The real user (ruid). Identifies the real owner of the process.', + }, + { + as: 'attested_user', + at: 'process', + beta: 'Reusing the `user` fields in this location is currently considered beta.', + full: 'process.attested_user', + short_override: + 'The externally attested user based on an external source such as the Kube API.', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'user.group', + schema_name: 'group', + short: "User's group relevant to the event.", + }, + { + full: 'user.risk', + schema_name: 'risk', + short: 'Fields for describing risk score and level.', + }, + { + full: 'user.target', + schema_name: 'user', + short: 'Targeted user of action taken.', + }, + { + full: 'user.effective', + schema_name: 'user', + short: 'User whose privileges were assumed.', + }, + { + full: 'user.changes', + schema_name: 'user', + short: 'Captures changes made to a user.', + }, + ], + short: 'Fields to describe the user relevant to the event.', + title: 'User', + type: 'group', + }, + user_agent: { + description: + 'The user_agent fields normally come from a browser request.\nThey often show up in web service logs coming from the parsed user agent string.', + fields: { + 'user_agent.device.name': { + dashed_name: 'user-agent-device-name', + description: 'Name of the device.', + example: 'iPhone', + flat_name: 'user_agent.device.name', + ignore_above: 1024, + level: 'extended', + name: 'device.name', + normalize: [], + short: 'Name of the device.', + type: 'keyword', + }, + 'user_agent.name': { + dashed_name: 'user-agent-name', + description: 'Name of the user agent.', + example: 'Safari', + flat_name: 'user_agent.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the user agent.', + type: 'keyword', + }, + 'user_agent.original': { + dashed_name: 'user-agent-original', + description: 'Unparsed user_agent string.', + example: + 'Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1', + flat_name: 'user_agent.original', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + short: 'Unparsed user_agent string.', + type: 'keyword', + }, + 'user_agent.os.family': { + dashed_name: 'user-agent-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'user_agent.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'user_agent.os.full': { + dashed_name: 'user-agent-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'user_agent.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'user_agent.os.kernel': { + dashed_name: 'user-agent-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'user_agent.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'user_agent.os.name': { + dashed_name: 'user-agent-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'user_agent.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'user_agent.os.platform': { + dashed_name: 'user-agent-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'user_agent.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'user_agent.os.type': { + dashed_name: 'user-agent-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'user_agent.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'user_agent.os.version': { + dashed_name: 'user-agent-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'user_agent.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'user_agent.version': { + dashed_name: 'user-agent-version', + description: 'Version of the user agent.', + example: 12, + flat_name: 'user_agent.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Version of the user agent.', + type: 'keyword', + }, + }, + group: 2, + name: 'user_agent', + nestings: ['user_agent.os'], + prefix: 'user_agent.', + reused_here: [ + { + full: 'user_agent.os', + schema_name: 'os', + short: 'OS fields contain information about the operating system.', + }, + ], + short: 'Fields to describe a browser user_agent string.', + title: 'User agent', + type: 'group', + }, + vlan: { + description: + 'The VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection.\nNetwork.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic.\nNetwork.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging.\nObserver.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers.', + fields: { + 'vlan.id': { + dashed_name: 'vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'vlan.name': { + dashed_name: 'vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + }, + group: 2, + name: 'vlan', + prefix: 'vlan.', + reusable: { + expected: [ + { as: 'vlan', at: 'observer.ingress', full: 'observer.ingress.vlan' }, + { as: 'vlan', at: 'observer.egress', full: 'observer.egress.vlan' }, + { as: 'vlan', at: 'network', full: 'network.vlan' }, + { as: 'vlan', at: 'network.inner', full: 'network.inner.vlan' }, + ], + top_level: false, + }, + short: 'Fields to describe observed VLAN information.', + title: 'VLAN', + type: 'group', + }, + vulnerability: { + description: + 'The vulnerability fields describe information about a vulnerability that is relevant to an event.', + fields: { + 'vulnerability.category': { + dashed_name: 'vulnerability-category', + description: + 'The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories])\nThis field must be an array.', + example: '["Firewall"]', + flat_name: 'vulnerability.category', + ignore_above: 1024, + level: 'extended', + name: 'category', + normalize: ['array'], + short: 'Category of a vulnerability.', + type: 'keyword', + }, + 'vulnerability.classification': { + dashed_name: 'vulnerability-classification', + description: + 'The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/)', + example: 'CVSS', + flat_name: 'vulnerability.classification', + ignore_above: 1024, + level: 'extended', + name: 'classification', + normalize: [], + short: 'Classification of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.description': { + dashed_name: 'vulnerability-description', + description: + 'The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description])', + example: 'In macOS before 2.12.6, there is a vulnerability in the RPC...', + flat_name: 'vulnerability.description', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'vulnerability.description.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'description', + normalize: [], + short: 'Description of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.enumeration': { + dashed_name: 'vulnerability-enumeration', + description: + 'The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/)', + example: 'CVE', + flat_name: 'vulnerability.enumeration', + ignore_above: 1024, + level: 'extended', + name: 'enumeration', + normalize: [], + short: 'Identifier of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.id': { + dashed_name: 'vulnerability-id', + description: + 'The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID]', + example: 'CVE-2019-00001', + flat_name: 'vulnerability.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'ID of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.reference': { + dashed_name: 'vulnerability-reference', + description: + 'A resource that provides additional information, context, and mitigations for the identified vulnerability.', + example: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111', + flat_name: 'vulnerability.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Reference of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.report_id': { + dashed_name: 'vulnerability-report-id', + description: 'The report or scan identification number.', + example: 20191018.0001, + flat_name: 'vulnerability.report_id', + ignore_above: 1024, + level: 'extended', + name: 'report_id', + normalize: [], + short: 'Scan identification number.', + type: 'keyword', + }, + 'vulnerability.scanner.vendor': { + dashed_name: 'vulnerability-scanner-vendor', + description: 'The name of the vulnerability scanner vendor.', + example: 'Tenable', + flat_name: 'vulnerability.scanner.vendor', + ignore_above: 1024, + level: 'extended', + name: 'scanner.vendor', + normalize: [], + short: 'Name of the scanner vendor.', + type: 'keyword', + }, + 'vulnerability.score.base': { + dashed_name: 'vulnerability-score-base', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nBase scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document)', + example: 5.5, + flat_name: 'vulnerability.score.base', + level: 'extended', + name: 'score.base', + normalize: [], + short: 'Vulnerability Base score.', + type: 'float', + }, + 'vulnerability.score.environmental': { + dashed_name: 'vulnerability-score-environmental', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nEnvironmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document)', + example: 5.5, + flat_name: 'vulnerability.score.environmental', + level: 'extended', + name: 'score.environmental', + normalize: [], + short: 'Vulnerability Environmental score.', + type: 'float', + }, + 'vulnerability.score.temporal': { + dashed_name: 'vulnerability-score-temporal', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nTemporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document)', + flat_name: 'vulnerability.score.temporal', + level: 'extended', + name: 'score.temporal', + normalize: [], + short: 'Vulnerability Temporal score.', + type: 'float', + }, + 'vulnerability.score.version': { + dashed_name: 'vulnerability-score-version', + description: + 'The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.\nCVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss)', + example: 2, + flat_name: 'vulnerability.score.version', + ignore_above: 1024, + level: 'extended', + name: 'score.version', + normalize: [], + short: 'CVSS version.', + type: 'keyword', + }, + 'vulnerability.severity': { + dashed_name: 'vulnerability-severity', + description: + 'The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)', + example: 'Critical', + flat_name: 'vulnerability.severity', + ignore_above: 1024, + level: 'extended', + name: 'severity', + normalize: [], + short: 'Severity of the vulnerability.', + type: 'keyword', + }, + }, + group: 2, + name: 'vulnerability', + prefix: 'vulnerability.', + short: 'Fields to describe the vulnerability relevant to an event.', + title: 'Vulnerability', + type: 'group', + }, + x509: { + description: + 'This implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk.\nWhen the certificate relates to a file, use the fields at `file.x509`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`).\nEvents that contain certificate information about network connections, should use the x509 fields under the relevant TLS fields: `tls.server.x509` and/or `tls.client.x509`.', + fields: { + 'x509.alternative_names': { + dashed_name: 'x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'x509.issuer.common_name': { + dashed_name: 'x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.country': { + dashed_name: 'x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'x509.issuer.distinguished_name': { + dashed_name: 'x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.locality': { + dashed_name: 'x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + short: 'List of locality names (L)', + type: 'keyword', + }, + 'x509.issuer.organization': { + dashed_name: 'x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.organizational_unit': { + dashed_name: 'x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.state_or_province': { + dashed_name: 'x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'x509.not_after': { + dashed_name: 'x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'x509.not_before': { + dashed_name: 'x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'x509.public_key_algorithm': { + dashed_name: 'x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'x509.public_key_curve': { + dashed_name: 'x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'x509.public_key_exponent': { + dashed_name: 'x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'x509.public_key_size': { + dashed_name: 'x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'x509.serial_number': { + dashed_name: 'x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'x509.signature_algorithm': { + dashed_name: 'x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'x509.subject.common_name': { + dashed_name: 'x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'x509.subject.country': { + dashed_name: 'x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'x509.subject.distinguished_name': { + dashed_name: 'x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'x509.subject.locality': { + dashed_name: 'x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + short: 'List of locality names (L)', + type: 'keyword', + }, + 'x509.subject.organization': { + dashed_name: 'x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'x509.subject.organizational_unit': { + dashed_name: 'x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'x509.subject.state_or_province': { + dashed_name: 'x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'x509.version_number': { + dashed_name: 'x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + short: 'Version of x509 format.', + type: 'keyword', + }, + }, + group: 2, + name: 'x509', + prefix: 'x509.', + reusable: { + expected: [ + { as: 'x509', at: 'file', full: 'file.x509' }, + { as: 'x509', at: 'threat.indicator', full: 'threat.indicator.x509' }, + { + as: 'x509', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.x509', + }, + { as: 'x509', at: 'tls.client', full: 'tls.client.x509' }, + { as: 'x509', at: 'tls.server', full: 'tls.server.x509' }, + ], + top_level: false, + }, + short: 'These fields contain x509 certificate metadata.', + title: 'x509 Certificate', + type: 'group', + }, +}; diff --git a/packages/kbn-ecs/generated/elf.ts b/packages/kbn-ecs/generated/elf.ts new file mode 100644 index 0000000000000..3036fa8690733 --- /dev/null +++ b/packages/kbn-ecs/generated/elf.ts @@ -0,0 +1,90 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain Linux Executable Linkable Format (ELF) metadata. + */ +export interface EcsElf { + /** + * Machine architecture of the ELF file. + */ + architecture?: string; + /** + * Byte sequence of ELF file. + */ + byte_order?: string; + /** + * CPU type of the ELF file. + */ + cpu_type?: string; + /** + * Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. + */ + creation_date?: string; + /** + * List of exported element names and types. + */ + exports?: Array>; + header?: { + /** + * Version of the ELF Application Binary Interface (ABI). + */ + abi_version?: string; + /** + * Header class of the ELF file. + */ + class?: string; + /** + * Data table of the ELF header. + */ + data?: string; + /** + * Header entrypoint of the ELF file. + */ + entrypoint?: number; + /** + * "0x1" for original ELF files. + */ + object_version?: string; + /** + * Application Binary Interface (ABI) of the Linux OS. + */ + os_abi?: string; + /** + * Header type of the ELF file. + */ + type?: string; + /** + * Version of the ELF header. + */ + version?: string; + }; + + /** + * List of imported element names and types. + */ + imports?: Array>; + /** + * An array containing an object for each section of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. + */ + sections?: Array>; + /** + * An array containing an object for each segment of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. + */ + segments?: Array>; + /** + * List of shared libraries used by this ELF object. + */ + shared_libraries?: string[]; + /** + * telfhash symbol hash for ELF file. + */ + telfhash?: string; +} diff --git a/packages/kbn-ecs/generated/email.ts b/packages/kbn-ecs/generated/email.ts new file mode 100644 index 0000000000000..6148733a28a14 --- /dev/null +++ b/packages/kbn-ecs/generated/email.ts @@ -0,0 +1,94 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Event details relating to an email transaction. + * This field set focuses on the email message header, body, and attachments. Network protocols that send and receive email messages such as SMTP are outside the scope of the `email.*` fields. + */ +export interface EcsEmail { + /** + * A list of objects describing the attachment files sent along with an email message. + */ + attachments?: Array>; + bcc?: { + /** + * The email address of BCC recipient + */ + address?: string[]; + }; + + cc?: { + /** + * The email address of CC recipient + */ + address?: string[]; + }; + + /** + * Information about how the message is to be displayed. + * Typically a MIME type. + */ + content_type?: string; + /** + * The date and time when the email message was received by the service or client. + */ + delivery_timestamp?: string; + /** + * The direction of the message based on the sending and receiving domains. + */ + direction?: string; + from?: { + /** + * The email address of the sender, typically from the RFC 5322 `From:` header field. + */ + address?: string[]; + }; + + /** + * Unique identifier given to the email by the source that created the event. + * Identifier is not persistent across hops. + */ + local_id?: string; + /** + * Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message. + */ + message_id?: string; + /** + * The date and time the email message was composed. Many email clients will fill in this value automatically when the message is sent by a user. + */ + origination_timestamp?: string; + reply_to?: { + /** + * The address that replies should be delivered to based on the value in the RFC 5322 `Reply-To:` header. + */ + address?: string[]; + }; + + sender?: { + /** + * Per RFC 5322, specifies the address responsible for the actual transmission of the message. + */ + address?: string; + }; + + /** + * A brief summary of the topic of the message. + */ + subject?: string; + to?: { + /** + * The email address of recipient + */ + address?: string[]; + }; + + /** + * The name of the application that was used to draft and send the original email message. + */ + x_mailer?: string; +} diff --git a/packages/kbn-ecs/src/ecs/error.ts b/packages/kbn-ecs/generated/error.ts similarity index 52% rename from packages/kbn-ecs/src/ecs/error.ts rename to packages/kbn-ecs/generated/error.ts index ad5373b1bfea7..37266f4d4604f 100644 --- a/packages/kbn-ecs/src/ecs/error.ts +++ b/packages/kbn-ecs/generated/error.ts @@ -7,14 +7,28 @@ */ /** - * https://www.elastic.co/guide/en/ecs/master/ecs-error.html - * - * @internal + * These fields can represent errors of any kind. + * Use them for errors that happen while fetching events or in cases where the event itself contains an error. */ export interface EcsError { + /** + * Error code describing the error. + */ code?: string; + /** + * Unique identifier for the error. + */ id?: string; + /** + * Error message. + */ message?: string; + /** + * The stack trace of this error in plain text. + */ stack_trace?: string; + /** + * The type of the error, for example the class name of the exception. + */ type?: string; } diff --git a/packages/kbn-ecs/generated/event.ts b/packages/kbn-ecs/generated/event.ts new file mode 100644 index 0000000000000..bab8fe9dfa1ca --- /dev/null +++ b/packages/kbn-ecs/generated/event.ts @@ -0,0 +1,156 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The event fields are used for context information about the log or metric event itself. + * A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events. + */ +export interface EcsEvent { + /** + * The action captured by the event. + * This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. + */ + action?: string; + /** + * Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation. + * For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used. + * If no validation is performed then the field should be omitted. + * The allowed values are: + * `verified` - The `agent.id` field value matches expected value obtained from auth metadata. + * `mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata. + * `missing` - There was no `agent.id` field in the event to validate. + * `auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID. + */ + agent_id_status?: string; + /** + * This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. + * `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. + * This field is an array. This will allow proper categorization of some events that fall in multiple categories. + */ + category?: string[]; + /** + * Identification code for this event, if one exists. + * Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. + */ + code?: string; + /** + * event.created contains the date/time when the event was first read by an agent, or by your pipeline. + * This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. + * In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. + * In case the two timestamps are identical, @timestamp should be used. + */ + created?: string; + /** + * Name of the dataset. + * If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. + * It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. + */ + dataset?: string; + /** + * Duration of the event in nanoseconds. + * If event.start and event.end are known this value should be the difference between the end and start time. + */ + duration?: number; + /** + * event.end contains the date when the event ended or when the activity was last observed. + */ + end?: string; + /** + * Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. + */ + hash?: string; + /** + * Unique ID to describe the event. + */ + id?: string; + /** + * Timestamp when an event arrived in the central data store. + * This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. + * In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. + */ + ingested?: string; + /** + * This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. + * `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. + * The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. + */ + kind?: string; + /** + * Name of the module this data is coming from. + * If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. + */ + module?: string; + /** + * Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. + * This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. + */ + original?: string; + /** + * This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. + * `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. + * Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. + * Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. + * Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. + */ + outcome?: string; + /** + * Source of the event. + * Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). + */ + provider?: string; + /** + * Reason why this event happened, according to the source. + * This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). + */ + reason?: string; + /** + * Reference URL linking to additional information about this event. + * This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. + */ + reference?: string; + /** + * Risk score or priority of the event (e.g. security solutions). Use your system's original value here. + */ + risk_score?: number; + /** + * Normalized risk score or priority of the event, on a scale of 0 to 100. + * This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. + */ + risk_score_norm?: number; + /** + * Sequence number of the event. + * The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. + */ + sequence?: number; + /** + * The numeric severity of the event according to your event source. + * What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. + * The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. + */ + severity?: number; + /** + * event.start contains the date when the event started or when the activity was first observed. + */ + start?: string; + /** + * This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. + * Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). + */ + timezone?: string; + /** + * This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. + * `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. + * This field is an array. This will allow proper categorization of some events that fall in multiple event types. + */ + type?: string[]; + /** + * URL linking to an external system to continue investigation of this event. + * This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. + */ + url?: string; +} diff --git a/packages/kbn-ecs/generated/faas.ts b/packages/kbn-ecs/generated/faas.ts new file mode 100644 index 0000000000000..91704dd91348e --- /dev/null +++ b/packages/kbn-ecs/generated/faas.ts @@ -0,0 +1,38 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The user fields describe information about the function as a service (FaaS) that is relevant to the event. + */ +export interface EcsFaas { + /** + * Boolean value indicating a cold start of a function. + */ + coldstart?: boolean; + /** + * The execution ID of the current function execution. + */ + execution?: string; + /** + * The unique identifier of a serverless function. + * For AWS Lambda it's the function ARN (Amazon Resource Name) without a version or alias suffix. + */ + id?: string; + /** + * The name of a serverless function. + */ + name?: string; + /** + * Details about the function trigger. + */ + trigger?: Record; + /** + * The version of a serverless function. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/file.ts b/packages/kbn-ecs/generated/file.ts new file mode 100644 index 0000000000000..c759adace6246 --- /dev/null +++ b/packages/kbn-ecs/generated/file.ts @@ -0,0 +1,408 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * A file is defined as a set of information that has been created on, or has existed on a filesystem. + * File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric. + */ +export interface EcsFile { + /** + * Last time the file was accessed. + * Note that not all filesystems keep track of access time. + */ + accessed?: string; + /** + * Array of file attributes. + * Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. + */ + attributes?: string[]; + code_signature?: { + /** + * The hashing algorithm used to sign the process. + * This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. + */ + digest_algorithm?: string; + /** + * Boolean to capture if a signature is present. + */ + exists?: boolean; + /** + * The identifier used to sign the process. + * This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. + */ + signing_id?: string; + /** + * Additional information about the certificate status. + * This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + */ + status?: string; + /** + * Subject name of the code signer + */ + subject_name?: string; + /** + * The team identifier used to sign the process. + * This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. + */ + team_id?: string; + /** + * Date and time when the code signature was generated and signed. + */ + timestamp?: string; + /** + * Stores the trust status of the certificate chain. + * Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + */ + trusted?: boolean; + /** + * Boolean to capture if the digital signature is verified against the binary content. + * Leave unpopulated if a certificate was unchecked. + */ + valid?: boolean; + }; + + /** + * File creation time. + * Note that not all filesystems store the creation time. + */ + created?: string; + /** + * Last time the file attributes or metadata changed. + * Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. + */ + ctime?: string; + /** + * Device that is the source of the file. + */ + device?: string; + /** + * Directory where the file is located. It should include the drive letter, when appropriate. + */ + directory?: string; + /** + * Drive letter where the file is located. This field is only relevant on Windows. + * The value should be uppercase, and not include the colon. + */ + drive_letter?: string; + elf?: { + /** + * Machine architecture of the ELF file. + */ + architecture?: string; + /** + * Byte sequence of ELF file. + */ + byte_order?: string; + /** + * CPU type of the ELF file. + */ + cpu_type?: string; + /** + * Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. + */ + creation_date?: string; + /** + * List of exported element names and types. + */ + exports?: Array>; + header?: { + /** + * Version of the ELF Application Binary Interface (ABI). + */ + abi_version?: string; + /** + * Header class of the ELF file. + */ + class?: string; + /** + * Data table of the ELF header. + */ + data?: string; + /** + * Header entrypoint of the ELF file. + */ + entrypoint?: number; + /** + * "0x1" for original ELF files. + */ + object_version?: string; + /** + * Application Binary Interface (ABI) of the Linux OS. + */ + os_abi?: string; + /** + * Header type of the ELF file. + */ + type?: string; + /** + * Version of the ELF header. + */ + version?: string; + }; + + /** + * List of imported element names and types. + */ + imports?: Array>; + /** + * An array containing an object for each section of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. + */ + sections?: Array>; + /** + * An array containing an object for each segment of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. + */ + segments?: Array>; + /** + * List of shared libraries used by this ELF object. + */ + shared_libraries?: string[]; + /** + * telfhash symbol hash for ELF file. + */ + telfhash?: string; + }; + + /** + * File extension, excluding the leading dot. + * Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). + */ + extension?: string; + /** + * A fork is additional data associated with a filesystem object. + * On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist. + * On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name. + */ + fork_name?: string; + /** + * Primary group ID (GID) of the file. + */ + gid?: string; + /** + * Primary group name of the file. + */ + group?: string; + hash?: { + /** + * MD5 hash. + */ + md5?: string; + /** + * SHA1 hash. + */ + sha1?: string; + /** + * SHA256 hash. + */ + sha256?: string; + /** + * SHA384 hash. + */ + sha384?: string; + /** + * SHA512 hash. + */ + sha512?: string; + /** + * SSDEEP hash. + */ + ssdeep?: string; + /** + * TLSH hash. + */ + tlsh?: string; + }; + + /** + * Inode representing the file in the filesystem. + */ + inode?: string; + /** + * MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. + */ + mime_type?: string; + /** + * Mode of the file in octal representation. + */ + mode?: string; + /** + * Last time the file content was modified. + */ + mtime?: string; + /** + * Name of the file including the extension, without the directory. + */ + name?: string; + /** + * File owner's username. + */ + owner?: string; + /** + * Full path to the file, including the file name. It should include the drive letter, when appropriate. + */ + path?: string; + pe?: { + /** + * CPU architecture target for the file. + */ + architecture?: string; + /** + * Internal company name of the file, provided at compile-time. + */ + company?: string; + /** + * Internal description of the file, provided at compile-time. + */ + description?: string; + /** + * Internal version of the file, provided at compile-time. + */ + file_version?: string; + /** + * A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + */ + imphash?: string; + /** + * Internal name of the file, provided at compile-time. + */ + original_file_name?: string; + /** + * A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. + * Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. + */ + pehash?: string; + /** + * Internal product name of the file, provided at compile-time. + */ + product?: string; + }; + + /** + * File size in bytes. + * Only relevant when `file.type` is "file". + */ + size?: number; + /** + * Target path for symlinks. + */ + target_path?: string; + /** + * File type (file, dir, or symlink). + */ + type?: string; + /** + * The user ID (UID) or security identifier (SID) of the file owner. + */ + uid?: string; + x509?: { + /** + * List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. + */ + alternative_names?: string[]; + issuer?: { + /** + * List of common name (CN) of issuing certificate authority. + */ + common_name?: string[]; + /** + * List of country \(C) codes + */ + country?: string[]; + /** + * Distinguished name (DN) of issuing certificate authority. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of issuing certificate authority. + */ + organization?: string[]; + /** + * List of organizational units (OU) of issuing certificate authority. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Time at which the certificate is no longer considered valid. + */ + not_after?: string; + /** + * Time at which the certificate is first considered valid. + */ + not_before?: string; + /** + * Algorithm used to generate the public key. + */ + public_key_algorithm?: string; + /** + * The curve used by the elliptic curve public key algorithm. This is algorithm specific. + */ + public_key_curve?: string; + /** + * Exponent used to derive the public key. This is algorithm specific. + */ + public_key_exponent?: number; + /** + * The size of the public key space in bits. + */ + public_key_size?: number; + /** + * Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + */ + serial_number?: string; + /** + * Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + */ + signature_algorithm?: string; + subject?: { + /** + * List of common names (CN) of subject. + */ + common_name?: string[]; + /** + * List of country \(C) code + */ + country?: string[]; + /** + * Distinguished name (DN) of the certificate subject entity. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of subject. + */ + organization?: string[]; + /** + * List of organizational units (OU) of subject. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Version of x509 format. + */ + version_number?: string; + }; +} diff --git a/packages/kbn-ecs/generated/geo.ts b/packages/kbn-ecs/generated/geo.ts new file mode 100644 index 0000000000000..bbb2cfdd67552 --- /dev/null +++ b/packages/kbn-ecs/generated/geo.ts @@ -0,0 +1,61 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Geo fields can carry data about a specific location related to an event. + * This geolocation information can be derived from techniques such as Geo IP, or be user-supplied. + */ +export interface EcsGeo { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; +} diff --git a/packages/kbn-ecs/src/ecs/group.ts b/packages/kbn-ecs/generated/group.ts similarity index 58% rename from packages/kbn-ecs/src/ecs/group.ts rename to packages/kbn-ecs/generated/group.ts index fe91ce82b64cb..64af8ae4b9176 100644 --- a/packages/kbn-ecs/src/ecs/group.ts +++ b/packages/kbn-ecs/generated/group.ts @@ -7,12 +7,20 @@ */ /** - * https://www.elastic.co/guide/en/ecs/master/ecs-group.html - * - * @internal + * The group fields are meant to represent groups that are relevant to the event. */ export interface EcsGroup { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ id?: string; + /** + * Name of the group. + */ name?: string; } diff --git a/packages/kbn-ecs/generated/hash.ts b/packages/kbn-ecs/generated/hash.ts new file mode 100644 index 0000000000000..9e744fe84a6b3 --- /dev/null +++ b/packages/kbn-ecs/generated/hash.ts @@ -0,0 +1,43 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The hash fields represent different bitwise hash algorithms and their values. + * Field names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512). + * Note that this fieldset is used for common hashes that may be computed over a range of generic bytes. Entity-specific hashes such as ja3 or imphash are placed in the fieldsets to which they relate (tls and pe, respectively). + */ +export interface EcsHash { + /** + * MD5 hash. + */ + md5?: string; + /** + * SHA1 hash. + */ + sha1?: string; + /** + * SHA256 hash. + */ + sha256?: string; + /** + * SHA384 hash. + */ + sha384?: string; + /** + * SHA512 hash. + */ + sha512?: string; + /** + * SSDEEP hash. + */ + ssdeep?: string; + /** + * TLSH hash. + */ + tlsh?: string; +} diff --git a/packages/kbn-ecs/generated/host.ts b/packages/kbn-ecs/generated/host.ts new file mode 100644 index 0000000000000..aa2f082dbb60e --- /dev/null +++ b/packages/kbn-ecs/generated/host.ts @@ -0,0 +1,226 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * A host is defined as a general computing instance. + * ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. + */ +export interface EcsHost { + /** + * Operating system architecture. + */ + architecture?: string; + boot?: { + /** + * Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. + */ + id?: string; + }; + + cpu?: { + /** + * Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. + * Scaling factor: 1000. + * For example: For a two core host, this value should be the average of the two cores, between 0 and 1. + */ + usage?: number; + }; + + disk?: { + read?: { + /** + * The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. + */ + bytes?: number; + }; + + write?: { + /** + * The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. + */ + bytes?: number; + }; + }; + + /** + * Name of the domain of which the host is a member. + * For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. + */ + domain?: string; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * Hostname of the host. + * It normally contains what the `hostname` command returns on the host machine. + */ + hostname?: string; + /** + * Unique host id. + * As hostname is not always unique, use values that are meaningful in your environment. + * Example: The current usage of `beat.name`. + */ + id?: string; + /** + * Host ip addresses. + */ + ip?: string[]; + /** + * Host MAC addresses. + * The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. + */ + mac?: string[]; + /** + * Name of the host. + * It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. + */ + name?: string; + network?: { + egress?: { + /** + * The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection. + */ + bytes?: number; + /** + * The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection. + */ + packets?: number; + }; + + ingress?: { + /** + * The number of bytes received (gauge) on all network interfaces by the host since the last metric collection. + */ + bytes?: number; + /** + * The number of packets (gauge) received on all network interfaces by the host since the last metric collection. + */ + packets?: number; + }; + }; + + os?: { + /** + * OS family (such as redhat, debian, freebsd, windows). + */ + family?: string; + /** + * Operating system name, including the version or code name. + */ + full?: string; + /** + * Operating system kernel version as a raw string. + */ + kernel?: string; + /** + * Operating system name, without the version. + */ + name?: string; + /** + * Operating system platform (such centos, ubuntu, windows). + */ + platform?: string; + /** + * Use the `os.type` field to categorize the operating system into one of the broad commercial families. + * If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. + */ + type?: string; + /** + * Operating system version as a raw string. + */ + version?: string; + }; + + /** + * This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. + */ + pid_ns_ino?: string; + risk?: { + /** + * A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring. + */ + calculated_level?: string; + /** + * A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring. + */ + calculated_score?: number; + /** + * A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100. + */ + calculated_score_norm?: number; + /** + * A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform. + */ + static_level?: string; + /** + * A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform. + */ + static_score?: number; + /** + * A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100. + */ + static_score_norm?: number; + }; + + /** + * Type of host. + * For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. + */ + type?: string; + /** + * Seconds the host has been up. + */ + uptime?: number; +} diff --git a/packages/kbn-ecs/generated/http.ts b/packages/kbn-ecs/generated/http.ts new file mode 100644 index 0000000000000..d1a464ffaad95 --- /dev/null +++ b/packages/kbn-ecs/generated/http.ts @@ -0,0 +1,81 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields related to HTTP activity. Use the `url` field set to store the url of the request. + */ +export interface EcsHttp { + request?: { + body?: { + /** + * Size in bytes of the request body. + */ + bytes?: number; + /** + * The full HTTP request body. + */ + content?: string; + }; + + /** + * Total size in bytes of the request (body and headers). + */ + bytes?: number; + /** + * A unique identifier for each HTTP request to correlate logs between clients and servers in transactions. + * The id may be contained in a non-standard HTTP header, such as `X-Request-ID` or `X-Correlation-ID`. + */ + id?: string; + /** + * HTTP request method. + * The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. + */ + method?: string; + /** + * Mime type of the body of the request. + * This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients. + */ + mime_type?: string; + /** + * Referrer for this HTTP request. + */ + referrer?: string; + }; + + response?: { + body?: { + /** + * Size in bytes of the response body. + */ + bytes?: number; + /** + * The full HTTP response body. + */ + content?: string; + }; + + /** + * Total size in bytes of the response (body and headers). + */ + bytes?: number; + /** + * Mime type of the body of the response. + * This value must only be populated based on the content of the response body, not on the `Content-Type` header. Comparing the mime type of a response with the response's Content-Type header can be helpful in detecting misconfigured servers. + */ + mime_type?: string; + /** + * HTTP response status code. + */ + status_code?: number; + }; + + /** + * HTTP version. + */ + version?: string; +} diff --git a/packages/kbn-ecs/src/ecs/index.ts b/packages/kbn-ecs/generated/index.ts similarity index 78% rename from packages/kbn-ecs/src/ecs/index.ts rename to packages/kbn-ecs/generated/index.ts index e47671515b3de..7b6b198cf2c37 100644 --- a/packages/kbn-ecs/src/ecs/index.ts +++ b/packages/kbn-ecs/generated/index.ts @@ -6,33 +6,43 @@ * Side Public License, v 1. */ -import { EcsBase } from './base'; - import { EcsAgent } from './agent'; -import { EcsAutonomousSystem } from './autonomous_system'; +import { EcsAs } from './as'; +import { EcsBase } from './base'; import { EcsClient } from './client'; import { EcsCloud } from './cloud'; +import { EcsCodeSignature } from './code_signature'; import { EcsContainer } from './container'; import { EcsDataStream } from './data_stream'; import { EcsDestination } from './destination'; +import { EcsDevice } from './device'; +import { EcsDll } from './dll'; import { EcsDns } from './dns'; +import { EcsEcs } from './ecs'; +import { EcsElf } from './elf'; import { EcsEmail } from './email'; import { EcsError } from './error'; import { EcsEvent } from './event'; import { EcsFaas } from './faas'; import { EcsFile } from './file'; +import { EcsGeo } from './geo'; import { EcsGroup } from './group'; +import { EcsHash } from './hash'; import { EcsHost } from './host'; import { EcsHttp } from './http'; +import { EcsInterface } from './interface'; import { EcsLog } from './log'; import { EcsNetwork } from './network'; import { EcsObserver } from './observer'; import { EcsOrchestrator } from './orchestrator'; import { EcsOrganization } from './organization'; +import { EcsOs } from './os'; import { EcsPackage } from './package'; +import { EcsPe } from './pe'; import { EcsProcess } from './process'; import { EcsRegistry } from './registry'; import { EcsRelated } from './related'; +import { EcsRisk } from './risk'; import { EcsRule } from './rule'; import { EcsServer } from './server'; import { EcsService } from './service'; @@ -43,34 +53,56 @@ import { EcsTracing } from './tracing'; import { EcsUrl } from './url'; import { EcsUser } from './user'; import { EcsUserAgent } from './user_agent'; +import { EcsVlan } from './vlan'; import { EcsVulnerability } from './vulnerability'; +import { EcsX509 } from './x509'; + +export const EcsVersion = '8.6.0' as const; + +/** + * Exporting raw schema files for easy programmatic use + */ +export { EcsFlat } from './ecs_flat'; +export { EcsNested } from './ecs_nested'; export type { EcsAgent, - EcsAutonomousSystem, + EcsAs, EcsBase, EcsClient, EcsCloud, + EcsCodeSignature, EcsContainer, EcsDataStream, EcsDestination, + EcsDevice, + EcsDll, EcsDns, + EcsEcs, + EcsElf, EcsEmail, EcsError, + EcsEvent, EcsFaas, EcsFile, + EcsGeo, EcsGroup, + EcsHash, EcsHost, EcsHttp, + EcsInterface, EcsLog, EcsNetwork, EcsObserver, EcsOrchestrator, EcsOrganization, + EcsOs, EcsPackage, + EcsPe, EcsProcess, EcsRegistry, EcsRelated, + EcsRisk, EcsRule, EcsServer, EcsService, @@ -81,45 +113,23 @@ export type { EcsUrl, EcsUser, EcsUserAgent, + EcsVlan, EcsVulnerability, + EcsX509, }; -export type { - EcsEvent, - EcsEventCategory, - EcsEventKind, - EcsEventOutcome, - EcsEventType, -} from './event'; - -interface EcsField { - /** - * These typings were written as of ECS 8.4.0. - * Don't change this value without checking the rest - * of the types to conform to that ECS version. - * - * https://www.elastic.co/guide/en/ecs/master/index.html - */ - version: '8.4.0'; -} - -/** - * Represents the full ECS schema. - * - * @public - */ export type Ecs = EcsBase & EcsTracing & { - ecs: EcsField; - agent?: EcsAgent; - as?: EcsAutonomousSystem; client?: EcsClient; cloud?: EcsCloud; container?: EcsContainer; data_stream?: EcsDataStream; destination?: EcsDestination; + device?: EcsDevice; + dll?: EcsDll; dns?: EcsDns; + ecs: EcsEcs; email?: EcsEmail; error?: EcsError; event?: EcsEvent; diff --git a/packages/kbn-ecs/generated/interface.ts b/packages/kbn-ecs/generated/interface.ts new file mode 100644 index 0000000000000..c6ad119c2b144 --- /dev/null +++ b/packages/kbn-ecs/generated/interface.ts @@ -0,0 +1,25 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection. In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated. + */ +export interface EcsInterface { + /** + * Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming. + */ + alias?: string; + /** + * Interface ID as reported by an observer (typically SNMP interface ID). + */ + id?: string; + /** + * Interface name as reported by the system. + */ + name?: string; +} diff --git a/packages/kbn-ecs/generated/log.ts b/packages/kbn-ecs/generated/log.ts new file mode 100644 index 0000000000000..ae4e84b2975f2 --- /dev/null +++ b/packages/kbn-ecs/generated/log.ts @@ -0,0 +1,56 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Details about the event's logging mechanism or logging transport. + * The log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`. + * The details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields. + */ +export interface EcsLog { + file?: { + /** + * Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. + * If the event wasn't read from a log file, do not populate this field. + */ + path?: string; + }; + + /** + * Original log level of the log event. + * If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). + * Some examples are `warn`, `err`, `i`, `informational`. + */ + level?: string; + /** + * The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. + */ + logger?: string; + origin?: { + file?: { + /** + * The line number of the file containing the source code which originated the log event. + */ + line?: number; + /** + * The name of the file containing the source code which originated the log event. + * Note that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`. + */ + name?: string; + }; + + /** + * The name of the function or method which originated the log event. + */ + function?: string; + }; + + /** + * The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164. + */ + syslog?: Record; +} diff --git a/packages/kbn-ecs/generated/macho.ts b/packages/kbn-ecs/generated/macho.ts new file mode 100644 index 0000000000000..4f6ae41df01b3 --- /dev/null +++ b/packages/kbn-ecs/generated/macho.ts @@ -0,0 +1,61 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain Mac OS Mach Object file format (Mach-O) metadata. + */ +export interface EcsMacho { + /** + * A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). + */ + go_import_hash?: string; + /** + * List of imported Go language element names and types. + */ + go_imports?: Record; + /** + * Shannon entropy calculation from the list of Go imports. + */ + go_imports_names_entropy?: number; + /** + * Variance for Shannon entropy calculation from the list of Go imports. + */ + go_imports_names_var_entropy?: number; + /** + * Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. + */ + go_stripped?: boolean; + /** + * A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * This is a synonym for symhash. + */ + import_hash?: string; + /** + * List of imported element names and types. + */ + imports?: Record; + /** + * Shannon entropy calculation from the list of imported element names and types. + */ + imports_names_entropy?: number; + /** + * Variance for Shannon entropy calculation from the list of imported element names and types. + */ + imports_names_var_entropy?: number; + /** + * An array containing an object for each section of the Mach-O file. + * The keys that should be present in these objects are defined by sub-fields underneath `macho.sections.*`. + */ + sections?: Record; + /** + * A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * This is a Mach-O implementation of the Windows PE imphash + */ + symhash?: string; +} diff --git a/packages/kbn-ecs/generated/network.ts b/packages/kbn-ecs/generated/network.ts new file mode 100644 index 0000000000000..3fbcaddfa5fab --- /dev/null +++ b/packages/kbn-ecs/generated/network.ts @@ -0,0 +1,83 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The network is defined as the communication path over which a host or network event happens. + * The network.* fields should be populated with details about the network activity associated with an event. + */ +export interface EcsNetwork { + /** + * When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. + * For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. + * The field value must be normalized to lowercase for querying. + */ + application?: string; + /** + * Total bytes transferred in both directions. + * If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. + */ + bytes?: number; + /** + * A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. + * Learn more at https://github.com/corelight/community-id-spec. + */ + community_id?: string; + /** + * Direction of the network traffic. + * When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". + * When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". + * Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. + */ + direction?: string; + /** + * Host IP address when the source IP address is the proxy. + */ + forwarded_ip?: string; + /** + * IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. + */ + iana_number?: string; + /** + * Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.) + */ + inner?: Record; + /** + * Name given by operators to sections of their network. + */ + name?: string; + /** + * Total packets transferred in both directions. + * If `source.packets` and `destination.packets` are known, `network.packets` is their sum. + */ + packets?: number; + /** + * In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. + * The field value must be normalized to lowercase for querying. + */ + protocol?: string; + /** + * Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) + * The field value must be normalized to lowercase for querying. + */ + transport?: string; + /** + * In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc + * The field value must be normalized to lowercase for querying. + */ + type?: string; + vlan?: { + /** + * VLAN ID as reported by the observer. + */ + id?: string; + /** + * Optional VLAN name as reported by the observer. + */ + name?: string; + }; +} diff --git a/packages/kbn-ecs/generated/observer.ts b/packages/kbn-ecs/generated/observer.ts new file mode 100644 index 0000000000000..ae4c6f5b8e47a --- /dev/null +++ b/packages/kbn-ecs/generated/observer.ts @@ -0,0 +1,144 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics. + * This could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS. + */ +export interface EcsObserver { + /** + * Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. + */ + egress?: Record; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * Hostname of the observer. + */ + hostname?: string; + /** + * Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic. + */ + ingress?: Record; + /** + * IP addresses of the observer. + */ + ip?: string[]; + /** + * MAC addresses of the observer. + * The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. + */ + mac?: string[]; + /** + * Custom name of the observer. + * This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. + * If no custom name is needed, the field can be left empty. + */ + name?: string; + os?: { + /** + * OS family (such as redhat, debian, freebsd, windows). + */ + family?: string; + /** + * Operating system name, including the version or code name. + */ + full?: string; + /** + * Operating system kernel version as a raw string. + */ + kernel?: string; + /** + * Operating system name, without the version. + */ + name?: string; + /** + * Operating system platform (such centos, ubuntu, windows). + */ + platform?: string; + /** + * Use the `os.type` field to categorize the operating system into one of the broad commercial families. + * If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. + */ + type?: string; + /** + * Operating system version as a raw string. + */ + version?: string; + }; + + /** + * The product name of the observer. + */ + product?: string; + /** + * Observer serial number. + */ + serial_number?: string; + /** + * The type of the observer the data is coming from. + * There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. + */ + type?: string; + /** + * Vendor name of the observer. + */ + vendor?: string; + /** + * Observer version. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/orchestrator.ts b/packages/kbn-ecs/generated/orchestrator.ts new file mode 100644 index 0000000000000..386f182209a29 --- /dev/null +++ b/packages/kbn-ecs/generated/orchestrator.ts @@ -0,0 +1,74 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields that describe the resources which container orchestrators manage or act upon. + */ +export interface EcsOrchestrator { + /** + * API version being used to carry out the action + */ + api_version?: string; + cluster?: { + /** + * Unique ID of the cluster. + */ + id?: string; + /** + * Name of the cluster. + */ + name?: string; + /** + * URL of the API used to manage the cluster. + */ + url?: string; + /** + * The version of the cluster. + */ + version?: string; + }; + + /** + * Namespace in which the action is taking place. + */ + namespace?: string; + /** + * Organization affected by the event (for multi-tenant orchestrator setups). + */ + organization?: string; + resource?: { + /** + * Unique ID of the resource being acted upon. + */ + id?: string; + /** + * IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running). + */ + ip?: string[]; + /** + * Name of the resource being acted upon. + */ + name?: string; + parent?: { + /** + * Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet). + */ + type?: string; + }; + + /** + * Type of resource being acted upon. + */ + type?: string; + }; + + /** + * Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry). + */ + type?: string; +} diff --git a/packages/kbn-ecs/src/ecs/organization.ts b/packages/kbn-ecs/generated/organization.ts similarity index 58% rename from packages/kbn-ecs/src/ecs/organization.ts rename to packages/kbn-ecs/generated/organization.ts index e42e04a33e0bc..1d07ba866405f 100644 --- a/packages/kbn-ecs/src/ecs/organization.ts +++ b/packages/kbn-ecs/generated/organization.ts @@ -7,11 +7,16 @@ */ /** - * https://www.elastic.co/guide/en/ecs/master/ecs-organization.html - * - * @internal + * The organization fields enrich data with information about the company or entity the data is associated with. + * These fields help you arrange or filter data stored in an index by one or multiple organizations. */ export interface EcsOrganization { + /** + * Unique identifier for the organization. + */ id?: string; + /** + * Organization name. + */ name?: string; } diff --git a/packages/kbn-ecs/generated/os.ts b/packages/kbn-ecs/generated/os.ts new file mode 100644 index 0000000000000..120c73163a9df --- /dev/null +++ b/packages/kbn-ecs/generated/os.ts @@ -0,0 +1,42 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The OS fields contain information about the operating system. + */ +export interface EcsOs { + /** + * OS family (such as redhat, debian, freebsd, windows). + */ + family?: string; + /** + * Operating system name, including the version or code name. + */ + full?: string; + /** + * Operating system kernel version as a raw string. + */ + kernel?: string; + /** + * Operating system name, without the version. + */ + name?: string; + /** + * Operating system platform (such centos, ubuntu, windows). + */ + platform?: string; + /** + * Use the `os.type` field to categorize the operating system into one of the broad commercial families. + * If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. + */ + type?: string; + /** + * Operating system version as a raw string. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/package.ts b/packages/kbn-ecs/generated/package.ts new file mode 100644 index 0000000000000..95b6708dc1c76 --- /dev/null +++ b/packages/kbn-ecs/generated/package.ts @@ -0,0 +1,68 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location. + */ +export interface EcsPackage { + /** + * Package architecture. + */ + architecture?: string; + /** + * Additional information about the build version of the installed package. + * For example use the commit SHA of a non-released package. + */ + build_version?: string; + /** + * Checksum of the installed package for verification. + */ + checksum?: string; + /** + * Description of the package. + */ + description?: string; + /** + * Indicating how the package was installed, e.g. user-local, global. + */ + install_scope?: string; + /** + * Time when package was installed. + */ + installed?: string; + /** + * License under which the package was released. + * Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). + */ + license?: string; + /** + * Package name + */ + name?: string; + /** + * Path where the package is installed. + */ + path?: string; + /** + * Home page or reference URL of the software in this package, if available. + */ + reference?: string; + /** + * Package size in bytes. + */ + size?: number; + /** + * Type of package. + * This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. + */ + type?: string; + /** + * Package version + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/pe.ts b/packages/kbn-ecs/generated/pe.ts new file mode 100644 index 0000000000000..91ba52d8f4a11 --- /dev/null +++ b/packages/kbn-ecs/generated/pe.ts @@ -0,0 +1,47 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain Windows Portable Executable (PE) metadata. + */ +export interface EcsPe { + /** + * CPU architecture target for the file. + */ + architecture?: string; + /** + * Internal company name of the file, provided at compile-time. + */ + company?: string; + /** + * Internal description of the file, provided at compile-time. + */ + description?: string; + /** + * Internal version of the file, provided at compile-time. + */ + file_version?: string; + /** + * A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + */ + imphash?: string; + /** + * Internal name of the file, provided at compile-time. + */ + original_file_name?: string; + /** + * A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. + * Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. + */ + pehash?: string; + /** + * Internal product name of the file, provided at compile-time. + */ + product?: string; +} diff --git a/packages/kbn-ecs/generated/process.ts b/packages/kbn-ecs/generated/process.ts new file mode 100644 index 0000000000000..fad38c5e9775f --- /dev/null +++ b/packages/kbn-ecs/generated/process.ts @@ -0,0 +1,1283 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * These fields contain information about a process. + * These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. + */ +export interface EcsProcess { + /** + * Array of process arguments, starting with the absolute path to the executable. + * May be filtered to protect sensitive information. + */ + args?: string[]; + /** + * Length of the process.args array. + * This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + */ + args_count?: number; + code_signature?: { + /** + * The hashing algorithm used to sign the process. + * This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. + */ + digest_algorithm?: string; + /** + * Boolean to capture if a signature is present. + */ + exists?: boolean; + /** + * The identifier used to sign the process. + * This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. + */ + signing_id?: string; + /** + * Additional information about the certificate status. + * This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + */ + status?: string; + /** + * Subject name of the code signer + */ + subject_name?: string; + /** + * The team identifier used to sign the process. + * This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. + */ + team_id?: string; + /** + * Date and time when the code signature was generated and signed. + */ + timestamp?: string; + /** + * Stores the trust status of the certificate chain. + * Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + */ + trusted?: boolean; + /** + * Boolean to capture if the digital signature is verified against the binary content. + * Leave unpopulated if a certificate was unchecked. + */ + valid?: boolean; + }; + + /** + * Full command line that started the process, including the absolute path to the executable, and all arguments. + * Some arguments may be filtered to protect sensitive information. + */ + command_line?: string; + elf?: { + /** + * Machine architecture of the ELF file. + */ + architecture?: string; + /** + * Byte sequence of ELF file. + */ + byte_order?: string; + /** + * CPU type of the ELF file. + */ + cpu_type?: string; + /** + * Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. + */ + creation_date?: string; + /** + * List of exported element names and types. + */ + exports?: Array>; + header?: { + /** + * Version of the ELF Application Binary Interface (ABI). + */ + abi_version?: string; + /** + * Header class of the ELF file. + */ + class?: string; + /** + * Data table of the ELF header. + */ + data?: string; + /** + * Header entrypoint of the ELF file. + */ + entrypoint?: number; + /** + * "0x1" for original ELF files. + */ + object_version?: string; + /** + * Application Binary Interface (ABI) of the Linux OS. + */ + os_abi?: string; + /** + * Header type of the ELF file. + */ + type?: string; + /** + * Version of the ELF header. + */ + version?: string; + }; + + /** + * List of imported element names and types. + */ + imports?: Array>; + /** + * An array containing an object for each section of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. + */ + sections?: Array>; + /** + * An array containing an object for each segment of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. + */ + segments?: Array>; + /** + * List of shared libraries used by this ELF object. + */ + shared_libraries?: string[]; + /** + * telfhash symbol hash for ELF file. + */ + telfhash?: string; + }; + + /** + * The time the process ended. + */ + end?: string; + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + entry_leader?: { + /** + * Array of process arguments, starting with the absolute path to the executable. + * May be filtered to protect sensitive information. + */ + args?: string[]; + /** + * Length of the process.args array. + * This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + */ + args_count?: number; + attested_groups?: { + /** + * Name of the group. + */ + name?: string; + }; + + attested_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * Full command line that started the process, including the absolute path to the executable, and all arguments. + * Some arguments may be filtered to protect sensitive information. + */ + command_line?: string; + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + entry_meta?: { + source?: { + /** + * IP address of the source (IPv4 or IPv6). + */ + ip?: string; + }; + + /** + * The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console + * Note: This field is only set on process.session_leader. + */ + type?: string; + }; + + /** + * Absolute path to the process executable. + */ + executable?: string; + group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Whether the process is connected to an interactive shell. + * Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. + * Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. + */ + interactive?: boolean; + /** + * Process name. + * Sometimes called program name or similar. + */ + name?: string; + parent?: { + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Process id. + */ + pid?: number; + session_leader?: { + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Process id. + */ + pid?: number; + /** + * The time the process started. + */ + start?: string; + }; + + /** + * The time the process started. + */ + start?: string; + }; + + /** + * Process id. + */ + pid?: number; + real_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + real_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * This boolean is used to identify if a leader process is the same as the top level process. + * For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`. + * This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader) + * Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true` + * Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. + */ + same_as_process?: boolean; + saved_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + saved_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The time the process started. + */ + start?: string; + supplemental_groups?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Information about the controlling TTY device. If set, the process belongs to an interactive session. + */ + tty?: Record; + user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The working directory of the process. + */ + working_directory?: string; + }; + + /** + * Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution. + * May be filtered to protect sensitive information. + */ + env_vars?: string[]; + /** + * Absolute path to the process executable. + */ + executable?: string; + /** + * The exit code of the process, if this is a termination event. + * The field should be absent if there is no exit code for the event (e.g. process start). + */ + exit_code?: number; + group_leader?: { + /** + * Array of process arguments, starting with the absolute path to the executable. + * May be filtered to protect sensitive information. + */ + args?: string[]; + /** + * Length of the process.args array. + * This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + */ + args_count?: number; + /** + * Full command line that started the process, including the absolute path to the executable, and all arguments. + * Some arguments may be filtered to protect sensitive information. + */ + command_line?: string; + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Absolute path to the process executable. + */ + executable?: string; + group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Whether the process is connected to an interactive shell. + * Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. + * Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. + */ + interactive?: boolean; + /** + * Process name. + * Sometimes called program name or similar. + */ + name?: string; + /** + * Process id. + */ + pid?: number; + real_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + real_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * This boolean is used to identify if a leader process is the same as the top level process. + * For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`. + * This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader) + * Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true` + * Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. + */ + same_as_process?: boolean; + saved_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + saved_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The time the process started. + */ + start?: string; + supplemental_groups?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Information about the controlling TTY device. If set, the process belongs to an interactive session. + */ + tty?: Record; + user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The working directory of the process. + */ + working_directory?: string; + }; + + hash?: { + /** + * MD5 hash. + */ + md5?: string; + /** + * SHA1 hash. + */ + sha1?: string; + /** + * SHA256 hash. + */ + sha256?: string; + /** + * SHA384 hash. + */ + sha384?: string; + /** + * SHA512 hash. + */ + sha512?: string; + /** + * SSDEEP hash. + */ + ssdeep?: string; + /** + * TLSH hash. + */ + tlsh?: string; + }; + + /** + * Whether the process is connected to an interactive shell. + * Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. + * Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. + */ + interactive?: boolean; + /** + * A chunk of input or output (IO) from a single process. + * This field only appears on the top level process object, which is the process that wrote the output or read the input. + */ + io?: Record; + /** + * Process name. + * Sometimes called program name or similar. + */ + name?: string; + parent?: { + /** + * Array of process arguments, starting with the absolute path to the executable. + * May be filtered to protect sensitive information. + */ + args?: string[]; + /** + * Length of the process.args array. + * This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + */ + args_count?: number; + code_signature?: { + /** + * The hashing algorithm used to sign the process. + * This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. + */ + digest_algorithm?: string; + /** + * Boolean to capture if a signature is present. + */ + exists?: boolean; + /** + * The identifier used to sign the process. + * This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. + */ + signing_id?: string; + /** + * Additional information about the certificate status. + * This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + */ + status?: string; + /** + * Subject name of the code signer + */ + subject_name?: string; + /** + * The team identifier used to sign the process. + * This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. + */ + team_id?: string; + /** + * Date and time when the code signature was generated and signed. + */ + timestamp?: string; + /** + * Stores the trust status of the certificate chain. + * Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + */ + trusted?: boolean; + /** + * Boolean to capture if the digital signature is verified against the binary content. + * Leave unpopulated if a certificate was unchecked. + */ + valid?: boolean; + }; + + /** + * Full command line that started the process, including the absolute path to the executable, and all arguments. + * Some arguments may be filtered to protect sensitive information. + */ + command_line?: string; + elf?: { + /** + * Machine architecture of the ELF file. + */ + architecture?: string; + /** + * Byte sequence of ELF file. + */ + byte_order?: string; + /** + * CPU type of the ELF file. + */ + cpu_type?: string; + /** + * Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. + */ + creation_date?: string; + /** + * List of exported element names and types. + */ + exports?: Array>; + header?: { + /** + * Version of the ELF Application Binary Interface (ABI). + */ + abi_version?: string; + /** + * Header class of the ELF file. + */ + class?: string; + /** + * Data table of the ELF header. + */ + data?: string; + /** + * Header entrypoint of the ELF file. + */ + entrypoint?: number; + /** + * "0x1" for original ELF files. + */ + object_version?: string; + /** + * Application Binary Interface (ABI) of the Linux OS. + */ + os_abi?: string; + /** + * Header type of the ELF file. + */ + type?: string; + /** + * Version of the ELF header. + */ + version?: string; + }; + + /** + * List of imported element names and types. + */ + imports?: Array>; + /** + * An array containing an object for each section of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. + */ + sections?: Array>; + /** + * An array containing an object for each segment of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. + */ + segments?: Array>; + /** + * List of shared libraries used by this ELF object. + */ + shared_libraries?: string[]; + /** + * telfhash symbol hash for ELF file. + */ + telfhash?: string; + }; + + /** + * The time the process ended. + */ + end?: string; + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Absolute path to the process executable. + */ + executable?: string; + /** + * The exit code of the process, if this is a termination event. + * The field should be absent if there is no exit code for the event (e.g. process start). + */ + exit_code?: number; + group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + group_leader?: { + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Process id. + */ + pid?: number; + /** + * The time the process started. + */ + start?: string; + }; + + hash?: { + /** + * MD5 hash. + */ + md5?: string; + /** + * SHA1 hash. + */ + sha1?: string; + /** + * SHA256 hash. + */ + sha256?: string; + /** + * SHA384 hash. + */ + sha384?: string; + /** + * SHA512 hash. + */ + sha512?: string; + /** + * SSDEEP hash. + */ + ssdeep?: string; + /** + * TLSH hash. + */ + tlsh?: string; + }; + + /** + * Whether the process is connected to an interactive shell. + * Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. + * Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. + */ + interactive?: boolean; + /** + * Process name. + * Sometimes called program name or similar. + */ + name?: string; + pe?: { + /** + * CPU architecture target for the file. + */ + architecture?: string; + /** + * Internal company name of the file, provided at compile-time. + */ + company?: string; + /** + * Internal description of the file, provided at compile-time. + */ + description?: string; + /** + * Internal version of the file, provided at compile-time. + */ + file_version?: string; + /** + * A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + */ + imphash?: string; + /** + * Internal name of the file, provided at compile-time. + */ + original_file_name?: string; + /** + * A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. + * Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. + */ + pehash?: string; + /** + * Internal product name of the file, provided at compile-time. + */ + product?: string; + }; + + /** + * Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`. + * Identifier of the group of processes the process belongs to. + */ + pgid?: number; + /** + * Process id. + */ + pid?: number; + real_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + real_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + saved_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + saved_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The time the process started. + */ + start?: string; + supplemental_groups?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + thread?: { + /** + * Thread ID. + */ + id?: number; + /** + * Thread name. + */ + name?: string; + }; + + /** + * Process title. + * The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. + */ + title?: string; + /** + * Information about the controlling TTY device. If set, the process belongs to an interactive session. + */ + tty?: Record; + /** + * Seconds the process has been up. + */ + uptime?: number; + user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The working directory of the process. + */ + working_directory?: string; + }; + + pe?: { + /** + * CPU architecture target for the file. + */ + architecture?: string; + /** + * Internal company name of the file, provided at compile-time. + */ + company?: string; + /** + * Internal description of the file, provided at compile-time. + */ + description?: string; + /** + * Internal version of the file, provided at compile-time. + */ + file_version?: string; + /** + * A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + */ + imphash?: string; + /** + * Internal name of the file, provided at compile-time. + */ + original_file_name?: string; + /** + * A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. + * Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. + */ + pehash?: string; + /** + * Internal product name of the file, provided at compile-time. + */ + product?: string; + }; + + /** + * Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`. + * Identifier of the group of processes the process belongs to. + */ + pgid?: number; + /** + * Process id. + */ + pid?: number; + previous?: { + /** + * Array of process arguments, starting with the absolute path to the executable. + * May be filtered to protect sensitive information. + */ + args?: string[]; + /** + * Length of the process.args array. + * This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + */ + args_count?: number; + /** + * Absolute path to the process executable. + */ + executable?: string; + }; + + real_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + real_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + saved_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + saved_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + session_leader?: { + /** + * Array of process arguments, starting with the absolute path to the executable. + * May be filtered to protect sensitive information. + */ + args?: string[]; + /** + * Length of the process.args array. + * This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. + */ + args_count?: number; + /** + * Full command line that started the process, including the absolute path to the executable, and all arguments. + * Some arguments may be filtered to protect sensitive information. + */ + command_line?: string; + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Absolute path to the process executable. + */ + executable?: string; + group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Whether the process is connected to an interactive shell. + * Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive. + * Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. + */ + interactive?: boolean; + /** + * Process name. + * Sometimes called program name or similar. + */ + name?: string; + parent?: { + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Process id. + */ + pid?: number; + session_leader?: { + /** + * Unique identifier for the process. + * The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. + * Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. + */ + entity_id?: string; + /** + * Process id. + */ + pid?: number; + /** + * The time the process started. + */ + start?: string; + }; + + /** + * The time the process started. + */ + start?: string; + }; + + /** + * Process id. + */ + pid?: number; + real_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + real_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * This boolean is used to identify if a leader process is the same as the top level process. + * For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`. + * This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader) + * Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true` + * Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. + */ + same_as_process?: boolean; + saved_group?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + saved_user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The time the process started. + */ + start?: string; + supplemental_groups?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Information about the controlling TTY device. If set, the process belongs to an interactive session. + */ + tty?: Record; + user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The working directory of the process. + */ + working_directory?: string; + }; + + /** + * The time the process started. + */ + start?: string; + supplemental_groups?: { + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + thread?: { + /** + * Thread ID. + */ + id?: number; + /** + * Thread name. + */ + name?: string; + }; + + /** + * Process title. + * The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. + */ + title?: string; + /** + * Information about the controlling TTY device. If set, the process belongs to an interactive session. + */ + tty?: Record; + /** + * Seconds the process has been up. + */ + uptime?: number; + user?: { + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + }; + + /** + * The working directory of the process. + */ + working_directory?: string; +} diff --git a/packages/kbn-ecs/generated/registry.ts b/packages/kbn-ecs/generated/registry.ts new file mode 100644 index 0000000000000..f1f5ade606b12 --- /dev/null +++ b/packages/kbn-ecs/generated/registry.ts @@ -0,0 +1,46 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields related to Windows Registry operations. + */ +export interface EcsRegistry { + data?: { + /** + * Original bytes written with base64 encoding. + * For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. + */ + bytes?: string; + /** + * Content when writing string types. + * Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). + */ + strings?: string[]; + /** + * Standard registry type for encoding contents + */ + type?: string; + }; + + /** + * Abbreviated name for the hive. + */ + hive?: string; + /** + * Hive-relative path of keys. + */ + key?: string; + /** + * Full path, including hive, key and value + */ + path?: string; + /** + * Name of the value written. + */ + value?: string; +} diff --git a/packages/kbn-ecs/generated/related.ts b/packages/kbn-ecs/generated/related.ts new file mode 100644 index 0000000000000..dc6e1d6b40130 --- /dev/null +++ b/packages/kbn-ecs/generated/related.ts @@ -0,0 +1,31 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * This field set is meant to facilitate pivoting around a piece of data. + * Some pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`. + * A concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`. + */ +export interface EcsRelated { + /** + * All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). + */ + hash?: string[]; + /** + * All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. + */ + hosts?: string[]; + /** + * All of the IPs seen on your event. + */ + ip?: string[]; + /** + * All the user names or other user identifiers seen on the event. + */ + user?: string[]; +} diff --git a/packages/kbn-ecs/generated/risk.ts b/packages/kbn-ecs/generated/risk.ts new file mode 100644 index 0000000000000..ef71b13af721b --- /dev/null +++ b/packages/kbn-ecs/generated/risk.ts @@ -0,0 +1,37 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields for describing risk score and risk level of entities such as hosts and users. These fields are not allowed to be nested under `event.*`. Please continue to use `event.risk_score` and `event.risk_score_norm` for event risk. + */ +export interface EcsRisk { + /** + * A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring. + */ + calculated_level?: string; + /** + * A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring. + */ + calculated_score?: number; + /** + * A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100. + */ + calculated_score_norm?: number; + /** + * A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform. + */ + static_level?: string; + /** + * A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform. + */ + static_score?: number; + /** + * A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100. + */ + static_score_norm?: number; +} diff --git a/packages/kbn-ecs/generated/rule.ts b/packages/kbn-ecs/generated/rule.ts new file mode 100644 index 0000000000000..d632db2e967ca --- /dev/null +++ b/packages/kbn-ecs/generated/rule.ts @@ -0,0 +1,55 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events. + * Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc. + */ +export interface EcsRule { + /** + * Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. + */ + author?: string[]; + /** + * A categorization value keyword used by the entity using the rule for detection of this event. + */ + category?: string; + /** + * The description of the rule generating the event. + */ + description?: string; + /** + * A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. + */ + id?: string; + /** + * Name of the license under which the rule used to generate this event is made available. + */ + license?: string; + /** + * The name of the rule or signature generating the event. + */ + name?: string; + /** + * Reference URL to additional information about the rule used to generate this event. + * The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. + */ + reference?: string; + /** + * Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. + */ + ruleset?: string; + /** + * A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. + */ + uuid?: string; + /** + * The version / revision of the rule being used for analysis. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/schema.ts b/packages/kbn-ecs/generated/schema.ts new file mode 100644 index 0000000000000..72e60f123f788 --- /dev/null +++ b/packages/kbn-ecs/generated/schema.ts @@ -0,0 +1,22185 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +export const EcsSchema = { + agent: { + description: + 'The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.', + fields: { + 'agent.build.original': { + dashed_name: 'agent-build-original', + description: + 'Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.', + example: + 'metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]', + flat_name: 'agent.build.original', + ignore_above: 1024, + level: 'core', + name: 'build.original', + normalize: [], + short: 'Extended build information for the agent.', + type: 'keyword', + }, + 'agent.ephemeral_id': { + dashed_name: 'agent-ephemeral-id', + description: + 'Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.', + example: '8a4f500f', + flat_name: 'agent.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + short: 'Ephemeral identifier of this agent.', + type: 'keyword', + }, + 'agent.id': { + dashed_name: 'agent-id', + description: + 'Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.', + example: '8a4f500d', + flat_name: 'agent.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of this agent.', + type: 'keyword', + }, + 'agent.name': { + dashed_name: 'agent-name', + description: + 'Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.', + example: 'foo', + flat_name: 'agent.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Custom name of the agent.', + type: 'keyword', + }, + 'agent.type': { + dashed_name: 'agent-type', + description: + 'Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.', + example: 'filebeat', + flat_name: 'agent.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'Type of the agent.', + type: 'keyword', + }, + 'agent.version': { + dashed_name: 'agent-version', + description: 'Version of the agent.', + example: '6.0.0-rc2', + flat_name: 'agent.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Version of the agent.', + type: 'keyword', + }, + }, + footnote: + 'Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server.', + group: 2, + name: 'agent', + prefix: 'agent.', + short: 'Fields about the monitoring agent.', + title: 'Agent', + type: 'group', + }, + as: { + description: + 'An autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the internet.', + fields: { + 'as.number': { + dashed_name: 'as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'as.number', + level: 'extended', + name: 'number', + normalize: [], + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'as.organization.name': { + dashed_name: 'as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + short: 'Organization name.', + type: 'keyword', + }, + }, + group: 2, + name: 'as', + prefix: 'as.', + reusable: { + expected: [ + { as: 'as', at: 'client', full: 'client.as' }, + { as: 'as', at: 'destination', full: 'destination.as' }, + { as: 'as', at: 'server', full: 'server.as' }, + { as: 'as', at: 'source', full: 'source.as' }, + { as: 'as', at: 'threat.indicator', full: 'threat.indicator.as' }, + { + as: 'as', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.as', + }, + ], + top_level: false, + }, + short: 'Fields describing an Autonomous System (Internet routing prefix).', + title: 'Autonomous System', + type: 'group', + }, + base: { + description: + 'The `base` field set contains all fields which are at the root of the events. These fields are common across all types of events.', + fields: { + '@timestamp': { + dashed_name: 'timestamp', + description: + 'Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.', + example: '2016-05-23T08:05:34.853Z', + flat_name: '@timestamp', + level: 'core', + name: '@timestamp', + normalize: [], + required: true, + short: 'Date/time when the event originated.', + type: 'date', + }, + labels: { + dashed_name: 'labels', + description: + 'Custom key/value pairs.\nCan be used to add meta information to events. Should not contain nested objects. All values are stored as keyword.\nExample: `docker` and `k8s` labels.', + example: '{"application": "foo-bar", "env": "production"}', + flat_name: 'labels', + level: 'core', + name: 'labels', + normalize: [], + object_type: 'keyword', + short: 'Custom key/value pairs.', + type: 'object', + }, + message: { + dashed_name: 'message', + description: + 'For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.', + example: 'Hello World', + flat_name: 'message', + level: 'core', + name: 'message', + normalize: [], + short: 'Log message optimized for viewing in a log viewer.', + type: 'match_only_text', + }, + tags: { + dashed_name: 'tags', + description: 'List of keywords used to tag each event.', + example: '["production", "env2"]', + flat_name: 'tags', + ignore_above: 1024, + level: 'core', + name: 'tags', + normalize: ['array'], + short: 'List of keywords used to tag each event.', + type: 'keyword', + }, + }, + group: 1, + name: 'base', + prefix: '', + root: true, + short: 'All fields defined directly at the root of the events.', + title: 'Base', + type: 'group', + }, + client: { + description: + 'A client is defined as the initiator of a network connection for events regarding sessions, connections, or bidirectional flow records.\nFor TCP events, the client is the initiator of the TCP connection that sends the SYN packet(s). For other protocols, the client is generally the initiator or requestor in the network transaction. Some systems use the term "originator" to refer the client in TCP connections. The client fields describe details about the system acting as the client in the network event. Client fields are usually populated in conjunction with server fields. Client fields are generally not populated for packet-level events.\nClient / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.', + fields: { + 'client.address': { + dashed_name: 'client-address', + description: + 'Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'client.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Client network address.', + type: 'keyword', + }, + 'client.as.number': { + dashed_name: 'client-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'client.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'client.as.organization.name': { + dashed_name: 'client-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'client.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'client.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'client.bytes': { + dashed_name: 'client-bytes', + description: 'Bytes sent from the client to the server.', + example: 184, + flat_name: 'client.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the client to the server.', + type: 'long', + }, + 'client.domain': { + dashed_name: 'client-domain', + description: + 'The domain name of the client system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'client.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the client.', + type: 'keyword', + }, + 'client.geo.city_name': { + dashed_name: 'client-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'client.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'client.geo.continent_code': { + dashed_name: 'client-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'client.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'client.geo.continent_name': { + dashed_name: 'client-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'client.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'client.geo.country_iso_code': { + dashed_name: 'client-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'client.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'client.geo.country_name': { + dashed_name: 'client-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'client.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'client.geo.location': { + dashed_name: 'client-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'client.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'client.geo.name': { + dashed_name: 'client-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'client.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'client.geo.postal_code': { + dashed_name: 'client-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'client.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'client.geo.region_iso_code': { + dashed_name: 'client-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'client.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'client.geo.region_name': { + dashed_name: 'client-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'client.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'client.geo.timezone': { + dashed_name: 'client-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'client.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'client.ip': { + dashed_name: 'client-ip', + description: 'IP address of the client (IPv4 or IPv6).', + flat_name: 'client.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the client.', + type: 'ip', + }, + 'client.mac': { + dashed_name: 'client-mac', + description: + 'MAC address of the client.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'client.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the client.', + type: 'keyword', + }, + 'client.nat.ip': { + dashed_name: 'client-nat-ip', + description: + 'Translated IP of source based NAT sessions (e.g. internal client to internet).\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'client.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Client NAT ip address', + type: 'ip', + }, + 'client.nat.port': { + dashed_name: 'client-nat-port', + description: + 'Translated port of source based NAT sessions (e.g. internal client to internet).\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'client.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Client NAT port', + type: 'long', + }, + 'client.packets': { + dashed_name: 'client-packets', + description: 'Packets sent from the client to the server.', + example: 12, + flat_name: 'client.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the client to the server.', + type: 'long', + }, + 'client.port': { + dashed_name: 'client-port', + description: 'Port of the client.', + flat_name: 'client.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the client.', + type: 'long', + }, + 'client.registered_domain': { + dashed_name: 'client-registered-domain', + description: + 'The highest registered client domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'client.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered client domain, stripped of the subdomain.', + type: 'keyword', + }, + 'client.subdomain': { + dashed_name: 'client-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'client.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'client.top_level_domain': { + dashed_name: 'client-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'client.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'client.user.domain': { + dashed_name: 'client-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'client.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'client.user.email': { + dashed_name: 'client-user-email', + description: 'User email address.', + flat_name: 'client.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'client.user.full_name': { + dashed_name: 'client-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'client.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'client.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'client.user.group.domain': { + dashed_name: 'client-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'client.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'client.user.group.id': { + dashed_name: 'client-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'client.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'client.user.group.name': { + dashed_name: 'client-user-group-name', + description: 'Name of the group.', + flat_name: 'client.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'client.user.hash': { + dashed_name: 'client-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'client.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'client.user.id': { + dashed_name: 'client-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'client.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'client.user.name': { + dashed_name: 'client-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'client.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'client.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'client.user.roles': { + dashed_name: 'client-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'client.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'client', + nestings: ['client.as', 'client.geo', 'client.user'], + prefix: 'client.', + reused_here: [ + { + full: 'client.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'client.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'client.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the client side of a network connection, used with server.', + title: 'Client', + type: 'group', + }, + cloud: { + description: 'Fields related to the cloud or infrastructure the events are coming from.', + fields: { + 'cloud.account.id': { + dashed_name: 'cloud-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.account.name': { + dashed_name: 'cloud-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.availability_zone': { + dashed_name: 'cloud-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.instance.id': { + dashed_name: 'cloud-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.instance.name': { + dashed_name: 'cloud-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.machine.type': { + dashed_name: 'cloud-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.origin.account.id': { + dashed_name: 'cloud-origin-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.origin.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.origin.account.name': { + dashed_name: 'cloud-origin-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.origin.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.origin.availability_zone': { + dashed_name: 'cloud-origin-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.origin.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + original_fieldset: 'cloud', + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.origin.instance.id': { + dashed_name: 'cloud-origin-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.origin.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.origin.instance.name': { + dashed_name: 'cloud-origin-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.origin.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.origin.machine.type': { + dashed_name: 'cloud-origin-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.origin.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + original_fieldset: 'cloud', + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.origin.project.id': { + dashed_name: 'cloud-origin-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.origin.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.origin.project.name': { + dashed_name: 'cloud-origin-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.origin.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.origin.provider': { + dashed_name: 'cloud-origin-provider', + description: + 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.origin.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + original_fieldset: 'cloud', + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.origin.region': { + dashed_name: 'cloud-origin-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.origin.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + original_fieldset: 'cloud', + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.origin.service.name': { + dashed_name: 'cloud-origin-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.origin.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud service name.', + type: 'keyword', + }, + 'cloud.project.id': { + dashed_name: 'cloud-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.project.name': { + dashed_name: 'cloud-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.provider': { + dashed_name: 'cloud-provider', + description: + 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.region': { + dashed_name: 'cloud-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.service.name': { + dashed_name: 'cloud-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + short: 'The cloud service name.', + type: 'keyword', + }, + 'cloud.target.account.id': { + dashed_name: 'cloud-target-account-id', + description: + 'The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.', + example: 666777888999, + flat_name: 'cloud.target.account.id', + ignore_above: 1024, + level: 'extended', + name: 'account.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account or organization id.', + type: 'keyword', + }, + 'cloud.target.account.name': { + dashed_name: 'cloud-target-account-name', + description: + 'The cloud account name or alias used to identify different entities in a multi-tenant environment.\nExamples: AWS account name, Google Cloud ORG display name.', + example: 'elastic-dev', + flat_name: 'cloud.target.account.name', + ignore_above: 1024, + level: 'extended', + name: 'account.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud account name.', + type: 'keyword', + }, + 'cloud.target.availability_zone': { + dashed_name: 'cloud-target-availability-zone', + description: 'Availability zone in which this host, resource, or service is located.', + example: 'us-east-1c', + flat_name: 'cloud.target.availability_zone', + ignore_above: 1024, + level: 'extended', + name: 'availability_zone', + normalize: [], + original_fieldset: 'cloud', + short: 'Availability zone in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.target.instance.id': { + dashed_name: 'cloud-target-instance-id', + description: 'Instance ID of the host machine.', + example: 'i-1234567890abcdef0', + flat_name: 'cloud.target.instance.id', + ignore_above: 1024, + level: 'extended', + name: 'instance.id', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance ID of the host machine.', + type: 'keyword', + }, + 'cloud.target.instance.name': { + dashed_name: 'cloud-target-instance-name', + description: 'Instance name of the host machine.', + flat_name: 'cloud.target.instance.name', + ignore_above: 1024, + level: 'extended', + name: 'instance.name', + normalize: [], + original_fieldset: 'cloud', + short: 'Instance name of the host machine.', + type: 'keyword', + }, + 'cloud.target.machine.type': { + dashed_name: 'cloud-target-machine-type', + description: 'Machine type of the host machine.', + example: 't2.medium', + flat_name: 'cloud.target.machine.type', + ignore_above: 1024, + level: 'extended', + name: 'machine.type', + normalize: [], + original_fieldset: 'cloud', + short: 'Machine type of the host machine.', + type: 'keyword', + }, + 'cloud.target.project.id': { + dashed_name: 'cloud-target-project-id', + description: + 'The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.', + example: 'my-project', + flat_name: 'cloud.target.project.id', + ignore_above: 1024, + level: 'extended', + name: 'project.id', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project id.', + type: 'keyword', + }, + 'cloud.target.project.name': { + dashed_name: 'cloud-target-project-name', + description: + 'The cloud project name.\nExamples: Google Cloud Project name, Azure Project name.', + example: 'my project', + flat_name: 'cloud.target.project.name', + ignore_above: 1024, + level: 'extended', + name: 'project.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud project name.', + type: 'keyword', + }, + 'cloud.target.provider': { + dashed_name: 'cloud-target-provider', + description: + 'Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.', + example: 'aws', + flat_name: 'cloud.target.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + original_fieldset: 'cloud', + short: 'Name of the cloud provider.', + type: 'keyword', + }, + 'cloud.target.region': { + dashed_name: 'cloud-target-region', + description: 'Region in which this host, resource, or service is located.', + example: 'us-east-1', + flat_name: 'cloud.target.region', + ignore_above: 1024, + level: 'extended', + name: 'region', + normalize: [], + original_fieldset: 'cloud', + short: 'Region in which this host, resource, or service is located.', + type: 'keyword', + }, + 'cloud.target.service.name': { + dashed_name: 'cloud-target-service-name', + description: + 'The cloud service name is intended to distinguish services running on different platforms within a provider, eg AWS EC2 vs Lambda, GCP GCE vs App Engine, Azure VM vs App Server.\nExamples: app engine, app service, cloud run, fargate, lambda.', + example: 'lambda', + flat_name: 'cloud.target.service.name', + ignore_above: 1024, + level: 'extended', + name: 'service.name', + normalize: [], + original_fieldset: 'cloud', + short: 'The cloud service name.', + type: 'keyword', + }, + }, + footnote: + "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information.", + group: 2, + name: 'cloud', + nestings: ['cloud.origin', 'cloud.target'], + prefix: 'cloud.', + reusable: { + expected: [ + { + as: 'origin', + at: 'cloud', + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.origin', + short_override: + 'Provides the cloud information of the origin entity in case of an incoming request or event.', + }, + { + as: 'target', + at: 'cloud', + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.target', + short_override: + 'Provides the cloud information of the target entity in case of an outgoing request or event.', + }, + ], + top_level: true, + }, + reused_here: [ + { + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.origin', + schema_name: 'cloud', + short: + 'Provides the cloud information of the origin entity in case of an incoming request or event.', + }, + { + beta: 'Reusing the `cloud` fields in this location is currently considered beta.', + full: 'cloud.target', + schema_name: 'cloud', + short: + 'Provides the cloud information of the target entity in case of an outgoing request or event.', + }, + ], + short: 'Fields about the cloud resource.', + title: 'Cloud', + type: 'group', + }, + code_signature: { + description: 'These fields contain information about binary code signatures.', + fields: { + 'code_signature.digest_algorithm': { + dashed_name: 'code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'code_signature.exists': { + dashed_name: 'code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'code_signature.signing_id': { + dashed_name: 'code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'code_signature.status': { + dashed_name: 'code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'code_signature.subject_name': { + dashed_name: 'code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'code_signature.team_id': { + dashed_name: 'code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'code_signature.timestamp': { + dashed_name: 'code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'code_signature.trusted': { + dashed_name: 'code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'code_signature.valid': { + dashed_name: 'code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + }, + group: 2, + name: 'code_signature', + prefix: 'code_signature.', + reusable: { + expected: [ + { as: 'code_signature', at: 'file', full: 'file.code_signature' }, + { as: 'code_signature', at: 'process', full: 'process.code_signature' }, + { as: 'code_signature', at: 'dll', full: 'dll.code_signature' }, + ], + top_level: false, + }, + short: 'These fields contain information about binary code signatures.', + title: 'Code Signature', + type: 'group', + }, + container: { + description: + 'Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.', + fields: { + 'container.cpu.usage': { + dashed_name: 'container-cpu-usage', + description: + 'Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000.', + flat_name: 'container.cpu.usage', + level: 'extended', + name: 'cpu.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent CPU used, between 0 and 1.', + type: 'scaled_float', + }, + 'container.disk.read.bytes': { + dashed_name: 'container-disk-read-bytes', + description: + 'The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'container.disk.read.bytes', + level: 'extended', + name: 'disk.read.bytes', + normalize: [], + short: 'The number of bytes read by all disks.', + type: 'long', + }, + 'container.disk.write.bytes': { + dashed_name: 'container-disk-write-bytes', + description: + 'The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'container.disk.write.bytes', + level: 'extended', + name: 'disk.write.bytes', + normalize: [], + short: 'The number of bytes written on all disks.', + type: 'long', + }, + 'container.id': { + dashed_name: 'container-id', + description: 'Unique container id.', + flat_name: 'container.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique container id.', + type: 'keyword', + }, + 'container.image.hash.all': { + dashed_name: 'container-image-hash-all', + description: + 'An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.', + example: '[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]', + flat_name: 'container.image.hash.all', + ignore_above: 1024, + level: 'extended', + name: 'image.hash.all', + normalize: ['array'], + short: 'An array of digests of the image the container was built on.', + type: 'keyword', + }, + 'container.image.name': { + dashed_name: 'container-image-name', + description: 'Name of the image the container was built on.', + flat_name: 'container.image.name', + ignore_above: 1024, + level: 'extended', + name: 'image.name', + normalize: [], + short: 'Name of the image the container was built on.', + type: 'keyword', + }, + 'container.image.tag': { + dashed_name: 'container-image-tag', + description: 'Container image tags.', + flat_name: 'container.image.tag', + ignore_above: 1024, + level: 'extended', + name: 'image.tag', + normalize: ['array'], + short: 'Container image tags.', + type: 'keyword', + }, + 'container.labels': { + dashed_name: 'container-labels', + description: 'Image labels.', + flat_name: 'container.labels', + level: 'extended', + name: 'labels', + normalize: [], + object_type: 'keyword', + short: 'Image labels.', + type: 'object', + }, + 'container.memory.usage': { + dashed_name: 'container-memory-usage', + description: 'Memory usage percentage and it ranges from 0 to 1. Scaling factor: 1000.', + flat_name: 'container.memory.usage', + level: 'extended', + name: 'memory.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent memory used, between 0 and 1.', + type: 'scaled_float', + }, + 'container.name': { + dashed_name: 'container-name', + description: 'Container name.', + flat_name: 'container.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Container name.', + type: 'keyword', + }, + 'container.network.egress.bytes': { + dashed_name: 'container-network-egress-bytes', + description: + 'The number of bytes (gauge) sent out on all network interfaces by the container since the last metric collection.', + flat_name: 'container.network.egress.bytes', + level: 'extended', + name: 'network.egress.bytes', + normalize: [], + short: 'The number of bytes sent on all network interfaces.', + type: 'long', + }, + 'container.network.ingress.bytes': { + dashed_name: 'container-network-ingress-bytes', + description: + 'The number of bytes received (gauge) on all network interfaces by the container since the last metric collection.', + flat_name: 'container.network.ingress.bytes', + level: 'extended', + name: 'network.ingress.bytes', + normalize: [], + short: 'The number of bytes received on all network interfaces.', + type: 'long', + }, + 'container.runtime': { + dashed_name: 'container-runtime', + description: 'Runtime managing this container.', + example: 'docker', + flat_name: 'container.runtime', + ignore_above: 1024, + level: 'extended', + name: 'runtime', + normalize: [], + short: 'Runtime managing this container.', + type: 'keyword', + }, + }, + group: 2, + name: 'container', + prefix: 'container.', + short: 'Fields describing the container that generated this event.', + title: 'Container', + type: 'group', + }, + data_stream: { + beta: 'These fields are in beta and are subject to change.', + description: + 'The data_stream fields take part in defining the new data stream naming scheme.\nIn the new data stream naming scheme the value of the data stream fields combine to the name of the actual data stream in the following manner: `{data_stream.type}-{data_stream.dataset}-{data_stream.namespace}`. This means the fields can only contain characters that are valid as part of names of data streams. More details about this can be found in this https://www.elastic.co/blog/an-introduction-to-the-elastic-data-stream-naming-scheme[blog post].\nAn Elasticsearch data stream consists of one or more backing indices, and a data stream name forms part of the backing indices names. Due to this convention, data streams must also follow index naming restrictions. For example, data stream names cannot include `\\`, `/`, `*`, `?`, `"`, `<`, `>`, `|`, ` ` (space character), `,`, or `#`. Please see the Elasticsearch reference for additional https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params[restrictions].', + fields: { + 'data_stream.dataset': { + dashed_name: 'data-stream-dataset', + description: + 'The field can contain anything that makes sense to signify the source of the data.\nExamples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`.\nBeyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters', + example: 'nginx.access', + flat_name: 'data_stream.dataset', + level: 'extended', + name: 'dataset', + normalize: [], + short: 'The field can contain anything that makes sense to signify the source of the data.', + type: 'constant_keyword', + }, + 'data_stream.namespace': { + dashed_name: 'data-stream-namespace', + description: + 'A user defined namespace. Namespaces are useful to allow grouping of data.\nMany users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`.\nBeyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions:\n * Must not contain `-`\n * No longer than 100 characters', + example: 'production', + flat_name: 'data_stream.namespace', + level: 'extended', + name: 'namespace', + normalize: [], + short: 'A user defined namespace. Namespaces are useful to allow grouping of data.', + type: 'constant_keyword', + }, + 'data_stream.type': { + dashed_name: 'data-stream-type', + description: + 'An overarching type for the data stream.\nCurrently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future.', + example: 'logs', + flat_name: 'data_stream.type', + level: 'extended', + name: 'type', + normalize: [], + short: 'An overarching type for the data stream.', + type: 'constant_keyword', + }, + }, + group: 2, + name: 'data_stream', + prefix: 'data_stream.', + short: 'The data_stream fields take part in defining the new data stream naming scheme.', + title: 'Data Stream', + type: 'group', + }, + destination: { + description: + 'Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.', + fields: { + 'destination.address': { + dashed_name: 'destination-address', + description: + 'Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'destination.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Destination network address.', + type: 'keyword', + }, + 'destination.as.number': { + dashed_name: 'destination-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'destination.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'destination.as.organization.name': { + dashed_name: 'destination-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'destination.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'destination.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'destination.bytes': { + dashed_name: 'destination-bytes', + description: 'Bytes sent from the destination to the source.', + example: 184, + flat_name: 'destination.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the destination to the source.', + type: 'long', + }, + 'destination.domain': { + dashed_name: 'destination-domain', + description: + 'The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'destination.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the destination.', + type: 'keyword', + }, + 'destination.geo.city_name': { + dashed_name: 'destination-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'destination.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'destination.geo.continent_code': { + dashed_name: 'destination-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'destination.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'destination.geo.continent_name': { + dashed_name: 'destination-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'destination.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'destination.geo.country_iso_code': { + dashed_name: 'destination-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'destination.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'destination.geo.country_name': { + dashed_name: 'destination-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'destination.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'destination.geo.location': { + dashed_name: 'destination-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'destination.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'destination.geo.name': { + dashed_name: 'destination-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'destination.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'destination.geo.postal_code': { + dashed_name: 'destination-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'destination.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'destination.geo.region_iso_code': { + dashed_name: 'destination-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'destination.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'destination.geo.region_name': { + dashed_name: 'destination-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'destination.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'destination.geo.timezone': { + dashed_name: 'destination-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'destination.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'destination.ip': { + dashed_name: 'destination-ip', + description: 'IP address of the destination (IPv4 or IPv6).', + flat_name: 'destination.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the destination.', + type: 'ip', + }, + 'destination.mac': { + dashed_name: 'destination-mac', + description: + 'MAC address of the destination.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'destination.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the destination.', + type: 'keyword', + }, + 'destination.nat.ip': { + dashed_name: 'destination-nat-ip', + description: + 'Translated ip of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'destination.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Destination NAT ip', + type: 'ip', + }, + 'destination.nat.port': { + dashed_name: 'destination-nat-port', + description: + 'Port the source session is translated to by NAT Device.\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'destination.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Destination NAT Port', + type: 'long', + }, + 'destination.packets': { + dashed_name: 'destination-packets', + description: 'Packets sent from the destination to the source.', + example: 12, + flat_name: 'destination.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the destination to the source.', + type: 'long', + }, + 'destination.port': { + dashed_name: 'destination-port', + description: 'Port of the destination.', + flat_name: 'destination.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the destination.', + type: 'long', + }, + 'destination.registered_domain': { + dashed_name: 'destination-registered-domain', + description: + 'The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'destination.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered destination domain, stripped of the subdomain.', + type: 'keyword', + }, + 'destination.subdomain': { + dashed_name: 'destination-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'destination.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'destination.top_level_domain': { + dashed_name: 'destination-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'destination.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'destination.user.domain': { + dashed_name: 'destination-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'destination.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'destination.user.email': { + dashed_name: 'destination-user-email', + description: 'User email address.', + flat_name: 'destination.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'destination.user.full_name': { + dashed_name: 'destination-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'destination.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'destination.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'destination.user.group.domain': { + dashed_name: 'destination-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'destination.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'destination.user.group.id': { + dashed_name: 'destination-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'destination.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'destination.user.group.name': { + dashed_name: 'destination-user-group-name', + description: 'Name of the group.', + flat_name: 'destination.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'destination.user.hash': { + dashed_name: 'destination-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'destination.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'destination.user.id': { + dashed_name: 'destination-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'destination.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'destination.user.name': { + dashed_name: 'destination-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'destination.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'destination.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'destination.user.roles': { + dashed_name: 'destination-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'destination.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'destination', + nestings: ['destination.as', 'destination.geo', 'destination.user'], + prefix: 'destination.', + reused_here: [ + { + full: 'destination.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'destination.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'destination.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the destination side of a network connection, used with source.', + title: 'Destination', + type: 'group', + }, + device: { + beta: 'These fields are in beta and are subject to change.', + description: + 'Fields that describe a device instance and its characteristics. Data collected for applications and processes running on a (mobile) device can be enriched with these fields to describe the identity, type and other characteristics of the device.\nThis field group definition is based on the Device namespace of the OpenTelemetry Semantic Conventions (https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/device/).', + fields: { + 'device.id': { + dashed_name: 'device-id', + description: + 'The unique identifier of a device. The identifier must not change across application sessions but stay fixex for an instance of a (mobile) device. \nOn iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application.\nFor GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user.', + example: '00000000-54b3-e7c7-0000-000046bffd97', + flat_name: 'device.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'The unique identifier of a device.', + type: 'keyword', + }, + 'device.manufacturer': { + dashed_name: 'device-manufacturer', + description: 'The vendor name of the device manufacturer.', + example: 'Samsung', + flat_name: 'device.manufacturer', + ignore_above: 1024, + level: 'extended', + name: 'manufacturer', + normalize: [], + short: 'The vendor name of the device manufacturer.', + type: 'keyword', + }, + 'device.model.identifier': { + dashed_name: 'device-model-identifier', + description: 'The machine readable identifier of the device model.', + example: 'SM-G920F', + flat_name: 'device.model.identifier', + ignore_above: 1024, + level: 'extended', + name: 'model.identifier', + normalize: [], + short: 'The machine readable identifier of the device model.', + type: 'keyword', + }, + 'device.model.name': { + dashed_name: 'device-model-name', + description: 'The human readable marketing name of the device model.', + example: 'Samsung Galaxy S6', + flat_name: 'device.model.name', + ignore_above: 1024, + level: 'extended', + name: 'model.name', + normalize: [], + short: 'The human readable marketing name of the device model.', + type: 'keyword', + }, + }, + group: 2, + name: 'device', + prefix: 'device.', + short: 'Fields characterizing a (mobile) device a process or application is running on.', + title: 'Device', + type: 'group', + }, + dll: { + description: + 'These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS', + fields: { + 'dll.code_signature.digest_algorithm': { + dashed_name: 'dll-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'dll.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.exists': { + dashed_name: 'dll-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'dll.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'dll.code_signature.signing_id': { + dashed_name: 'dll-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'dll.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.status': { + dashed_name: 'dll-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'dll.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'dll.code_signature.subject_name': { + dashed_name: 'dll-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'dll.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'dll.code_signature.team_id': { + dashed_name: 'dll-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'dll.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'dll.code_signature.timestamp': { + dashed_name: 'dll-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'dll.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'dll.code_signature.trusted': { + dashed_name: 'dll-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'dll.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'dll.code_signature.valid': { + dashed_name: 'dll-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'dll.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'dll.hash.md5': { + dashed_name: 'dll-hash-md5', + description: 'MD5 hash.', + flat_name: 'dll.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'dll.hash.sha1': { + dashed_name: 'dll-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'dll.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'dll.hash.sha256': { + dashed_name: 'dll-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'dll.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'dll.hash.sha384': { + dashed_name: 'dll-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'dll.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'dll.hash.sha512': { + dashed_name: 'dll-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'dll.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'dll.hash.ssdeep': { + dashed_name: 'dll-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'dll.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'dll.hash.tlsh': { + dashed_name: 'dll-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'dll.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'dll.name': { + dashed_name: 'dll-name', + description: 'Name of the library.\nThis generally maps to the name of the file on disk.', + example: 'kernel32.dll', + flat_name: 'dll.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the library.', + type: 'keyword', + }, + 'dll.path': { + dashed_name: 'dll-path', + description: 'Full file path of the library.', + example: 'C:\\Windows\\System32\\kernel32.dll', + flat_name: 'dll.path', + ignore_above: 1024, + level: 'extended', + name: 'path', + normalize: [], + short: 'Full file path of the library.', + type: 'keyword', + }, + 'dll.pe.architecture': { + dashed_name: 'dll-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'dll.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'dll.pe.company': { + dashed_name: 'dll-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'dll.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.description': { + dashed_name: 'dll-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'dll.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.file_version': { + dashed_name: 'dll-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'dll.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'dll.pe.imphash': { + dashed_name: 'dll-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'dll.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'dll.pe.original_file_name': { + dashed_name: 'dll-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'dll.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'dll.pe.pehash': { + dashed_name: 'dll-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'dll.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'dll.pe.product': { + dashed_name: 'dll-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'dll.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + }, + group: 2, + name: 'dll', + nestings: ['dll.code_signature', 'dll.hash', 'dll.pe'], + prefix: 'dll.', + reused_here: [ + { + full: 'dll.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + { + full: 'dll.pe', + schema_name: 'pe', + short: 'These fields contain Windows Portable Executable (PE) metadata.', + }, + { + full: 'dll.code_signature', + schema_name: 'code_signature', + short: 'These fields contain information about binary code signatures.', + }, + ], + short: + 'These fields contain information about code libraries dynamically loaded into processes.', + title: 'DLL', + type: 'group', + }, + dns: { + description: + 'Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).', + fields: { + 'dns.answers': { + dashed_name: 'dns-answers', + description: + 'An array containing an object for each answer section returned by the server.\nThe main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.\nNot all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields.', + flat_name: 'dns.answers', + level: 'extended', + name: 'answers', + normalize: ['array'], + short: 'Array of DNS answers.', + type: 'object', + }, + 'dns.answers.class': { + dashed_name: 'dns-answers-class', + description: 'The class of DNS data contained in this resource record.', + example: 'IN', + flat_name: 'dns.answers.class', + ignore_above: 1024, + level: 'extended', + name: 'answers.class', + normalize: [], + short: 'The class of DNS data contained in this resource record.', + type: 'keyword', + }, + 'dns.answers.data': { + dashed_name: 'dns-answers-data', + description: + 'The data describing the resource.\nThe meaning of this data depends on the type and class of the resource record.', + example: '10.10.10.10', + flat_name: 'dns.answers.data', + ignore_above: 1024, + level: 'extended', + name: 'answers.data', + normalize: [], + short: 'The data describing the resource.', + type: 'keyword', + }, + 'dns.answers.name': { + dashed_name: 'dns-answers-name', + description: + "The domain name to which this resource record pertains.\nIf a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated.", + example: 'www.example.com', + flat_name: 'dns.answers.name', + ignore_above: 1024, + level: 'extended', + name: 'answers.name', + normalize: [], + short: 'The domain name to which this resource record pertains.', + type: 'keyword', + }, + 'dns.answers.ttl': { + dashed_name: 'dns-answers-ttl', + description: + 'The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached.', + example: 180, + flat_name: 'dns.answers.ttl', + level: 'extended', + name: 'answers.ttl', + normalize: [], + short: + 'The time interval in seconds that this resource record may be cached before it should be discarded.', + type: 'long', + }, + 'dns.answers.type': { + dashed_name: 'dns-answers-type', + description: 'The type of data contained in this resource record.', + example: 'CNAME', + flat_name: 'dns.answers.type', + ignore_above: 1024, + level: 'extended', + name: 'answers.type', + normalize: [], + short: 'The type of data contained in this resource record.', + type: 'keyword', + }, + 'dns.header_flags': { + dashed_name: 'dns-header-flags', + description: 'Array of 2 letter DNS header flags.', + example: '["RD", "RA"]', + expected_values: ['AA', 'TC', 'RD', 'RA', 'AD', 'CD', 'DO'], + flat_name: 'dns.header_flags', + ignore_above: 1024, + level: 'extended', + name: 'header_flags', + normalize: ['array'], + short: 'Array of DNS header flags.', + type: 'keyword', + }, + 'dns.id': { + dashed_name: 'dns-id', + description: + 'The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.', + example: 62111, + flat_name: 'dns.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: + 'The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.', + type: 'keyword', + }, + 'dns.op_code': { + dashed_name: 'dns-op-code', + description: + 'The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.', + example: 'QUERY', + flat_name: 'dns.op_code', + ignore_above: 1024, + level: 'extended', + name: 'op_code', + normalize: [], + short: 'The DNS operation code that specifies the kind of query in the message.', + type: 'keyword', + }, + 'dns.question.class': { + dashed_name: 'dns-question-class', + description: 'The class of records being queried.', + example: 'IN', + flat_name: 'dns.question.class', + ignore_above: 1024, + level: 'extended', + name: 'question.class', + normalize: [], + short: 'The class of records being queried.', + type: 'keyword', + }, + 'dns.question.name': { + dashed_name: 'dns-question-name', + description: + 'The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.', + example: 'www.example.com', + flat_name: 'dns.question.name', + ignore_above: 1024, + level: 'extended', + name: 'question.name', + normalize: [], + short: 'The name being queried.', + type: 'keyword', + }, + 'dns.question.registered_domain': { + dashed_name: 'dns-question-registered-domain', + description: + 'The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'dns.question.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'question.registered_domain', + normalize: [], + short: 'The highest registered domain, stripped of the subdomain.', + type: 'keyword', + }, + 'dns.question.subdomain': { + dashed_name: 'dns-question-subdomain', + description: + 'The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'www', + flat_name: 'dns.question.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'question.subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'dns.question.top_level_domain': { + dashed_name: 'dns-question-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'dns.question.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'question.top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'dns.question.type': { + dashed_name: 'dns-question-type', + description: 'The type of record being queried.', + example: 'AAAA', + flat_name: 'dns.question.type', + ignore_above: 1024, + level: 'extended', + name: 'question.type', + normalize: [], + short: 'The type of record being queried.', + type: 'keyword', + }, + 'dns.resolved_ip': { + dashed_name: 'dns-resolved-ip', + description: + 'Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.', + example: '["10.10.10.10", "10.10.10.11"]', + flat_name: 'dns.resolved_ip', + level: 'extended', + name: 'resolved_ip', + normalize: ['array'], + short: 'Array containing all IPs seen in answers.data', + type: 'ip', + }, + 'dns.response_code': { + dashed_name: 'dns-response-code', + description: 'The DNS response code.', + example: 'NOERROR', + flat_name: 'dns.response_code', + ignore_above: 1024, + level: 'extended', + name: 'response_code', + normalize: [], + short: 'The DNS response code.', + type: 'keyword', + }, + 'dns.type': { + dashed_name: 'dns-type', + description: + 'The type of DNS event captured, query or answer.\nIf your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`.\nIf your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers.', + example: 'answer', + flat_name: 'dns.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'The type of DNS event captured, query or answer.', + type: 'keyword', + }, + }, + group: 2, + name: 'dns', + prefix: 'dns.', + short: 'Fields describing DNS queries and answers.', + title: 'DNS', + type: 'group', + }, + ecs: { + description: 'Meta-information specific to ECS.', + fields: { + 'ecs.version': { + dashed_name: 'ecs-version', + description: + 'ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.', + example: '1.0.0', + flat_name: 'ecs.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + required: true, + short: 'ECS version this event conforms to.', + type: 'keyword', + }, + }, + group: 2, + name: 'ecs', + prefix: 'ecs.', + short: 'Meta-information specific to ECS.', + title: 'ECS', + type: 'group', + }, + elf: { + beta: 'These fields are in beta and are subject to change.', + description: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + fields: { + 'elf.architecture': { + dashed_name: 'elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'elf.byte_order': { + dashed_name: 'elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'elf.cpu_type': { + dashed_name: 'elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'elf.creation_date': { + dashed_name: 'elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + short: 'Build or compile date.', + type: 'date', + }, + 'elf.exports': { + dashed_name: 'elf-exports', + description: 'List of exported element names and types.', + flat_name: 'elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'elf.header.abi_version': { + dashed_name: 'elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'elf.header.class': { + dashed_name: 'elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'elf.header.data': { + dashed_name: 'elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'elf.header.entrypoint': { + dashed_name: 'elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'elf.header.object_version': { + dashed_name: 'elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'elf.header.os_abi': { + dashed_name: 'elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'elf.header.type': { + dashed_name: 'elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'elf.header.version': { + dashed_name: 'elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'elf.imports': { + dashed_name: 'elf-imports', + description: 'List of imported element names and types.', + flat_name: 'elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'elf.sections': { + dashed_name: 'elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'elf.sections.chi2': { + dashed_name: 'elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'elf.sections.entropy': { + dashed_name: 'elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'elf.sections.flags': { + dashed_name: 'elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'elf.sections.name': { + dashed_name: 'elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + short: 'ELF Section List name.', + type: 'keyword', + }, + 'elf.sections.physical_offset': { + dashed_name: 'elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'elf.sections.physical_size': { + dashed_name: 'elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + short: 'ELF Section List physical size.', + type: 'long', + }, + 'elf.sections.type': { + dashed_name: 'elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + short: 'ELF Section List type.', + type: 'keyword', + }, + 'elf.sections.virtual_address': { + dashed_name: 'elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'elf.sections.virtual_size': { + dashed_name: 'elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'elf.segments': { + dashed_name: 'elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + short: 'ELF object segment list.', + type: 'nested', + }, + 'elf.segments.sections': { + dashed_name: 'elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'elf.segments.type': { + dashed_name: 'elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + short: 'ELF object segment type.', + type: 'keyword', + }, + 'elf.shared_libraries': { + dashed_name: 'elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'elf.telfhash': { + dashed_name: 'elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + }, + group: 2, + name: 'elf', + prefix: 'elf.', + reusable: { + expected: [ + { + as: 'elf', + at: 'file', + beta: 'This field reuse is beta and subject to change.', + full: 'file.elf', + }, + { + as: 'elf', + at: 'process', + beta: 'This field reuse is beta and subject to change.', + full: 'process.elf', + }, + ], + top_level: false, + }, + short: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + title: 'ELF Header', + type: 'group', + }, + email: { + description: + 'Event details relating to an email transaction.\nThis field set focuses on the email message header, body, and attachments. Network protocols that send and receive email messages such as SMTP are outside the scope of the `email.*` fields.', + fields: { + 'email.attachments': { + dashed_name: 'email-attachments', + description: + 'A list of objects describing the attachment files sent along with an email message.', + flat_name: 'email.attachments', + level: 'extended', + name: 'attachments', + normalize: ['array'], + short: 'List of objects describing the attachments.', + type: 'nested', + }, + 'email.attachments.file.extension': { + dashed_name: 'email-attachments-file-extension', + description: 'Attachment file extension, excluding the leading dot.', + example: 'txt', + flat_name: 'email.attachments.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.extension', + normalize: [], + short: 'Attachment file extension.', + type: 'keyword', + }, + 'email.attachments.file.hash.md5': { + dashed_name: 'email-attachments-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'email.attachments.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha1': { + dashed_name: 'email-attachments-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'email.attachments.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha256': { + dashed_name: 'email-attachments-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'email.attachments.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha384': { + dashed_name: 'email-attachments-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'email.attachments.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.sha512': { + dashed_name: 'email-attachments-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'email.attachments.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.ssdeep': { + dashed_name: 'email-attachments-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'email.attachments.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'email.attachments.file.hash.tlsh': { + dashed_name: 'email-attachments-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'email.attachments.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'email.attachments.file.mime_type': { + dashed_name: 'email-attachments-file-mime-type', + description: + 'The MIME media type of the attachment.\nThis value will typically be extracted from the `Content-Type` MIME header field.', + example: 'text/plain', + flat_name: 'email.attachments.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.mime_type', + normalize: [], + short: 'MIME type of the attachment file.', + type: 'keyword', + }, + 'email.attachments.file.name': { + dashed_name: 'email-attachments-file-name', + description: 'Name of the attachment file including the file extension.', + example: 'attachment.txt', + flat_name: 'email.attachments.file.name', + ignore_above: 1024, + level: 'extended', + name: 'attachments.file.name', + normalize: [], + short: 'Name of the attachment file.', + type: 'keyword', + }, + 'email.attachments.file.size': { + dashed_name: 'email-attachments-file-size', + description: 'Attachment file size in bytes.', + example: 64329, + flat_name: 'email.attachments.file.size', + level: 'extended', + name: 'attachments.file.size', + normalize: [], + short: 'Attachment file size.', + type: 'long', + }, + 'email.bcc.address': { + dashed_name: 'email-bcc-address', + description: 'The email address of BCC recipient', + example: 'bcc.user1@example.com', + flat_name: 'email.bcc.address', + ignore_above: 1024, + level: 'extended', + name: 'bcc.address', + normalize: ['array'], + short: 'Email address of BCC recipient', + type: 'keyword', + }, + 'email.cc.address': { + dashed_name: 'email-cc-address', + description: 'The email address of CC recipient', + example: 'cc.user1@example.com', + flat_name: 'email.cc.address', + ignore_above: 1024, + level: 'extended', + name: 'cc.address', + normalize: ['array'], + short: 'Email address of CC recipient', + type: 'keyword', + }, + 'email.content_type': { + dashed_name: 'email-content-type', + description: + 'Information about how the message is to be displayed.\nTypically a MIME type.', + example: 'text/plain', + flat_name: 'email.content_type', + ignore_above: 1024, + level: 'extended', + name: 'content_type', + normalize: [], + short: 'MIME type of the email message.', + type: 'keyword', + }, + 'email.delivery_timestamp': { + dashed_name: 'email-delivery-timestamp', + description: + 'The date and time when the email message was received by the service or client.', + example: '2020-11-10T22:12:34.8196921Z', + flat_name: 'email.delivery_timestamp', + level: 'extended', + name: 'delivery_timestamp', + normalize: [], + short: 'Date and time when message was delivered.', + type: 'date', + }, + 'email.direction': { + dashed_name: 'email-direction', + description: 'The direction of the message based on the sending and receiving domains.', + example: 'inbound', + flat_name: 'email.direction', + ignore_above: 1024, + level: 'extended', + name: 'direction', + normalize: [], + short: 'Direction of the message.', + type: 'keyword', + }, + 'email.from.address': { + dashed_name: 'email-from-address', + description: + 'The email address of the sender, typically from the RFC 5322 `From:` header field.', + example: 'sender@example.com', + flat_name: 'email.from.address', + ignore_above: 1024, + level: 'extended', + name: 'from.address', + normalize: ['array'], + short: "The sender's email address.", + type: 'keyword', + }, + 'email.local_id': { + dashed_name: 'email-local-id', + description: + 'Unique identifier given to the email by the source that created the event.\nIdentifier is not persistent across hops.', + example: 'c26dbea0-80d5-463b-b93c-4e8b708219ce', + flat_name: 'email.local_id', + ignore_above: 1024, + level: 'extended', + name: 'local_id', + normalize: [], + short: 'Unique identifier given by the source.', + type: 'keyword', + }, + 'email.message_id': { + dashed_name: 'email-message-id', + description: + 'Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message.', + example: '81ce15$8r2j59@mail01.example.com', + flat_name: 'email.message_id', + level: 'extended', + name: 'message_id', + normalize: [], + short: 'Value from the Message-ID header.', + type: 'wildcard', + }, + 'email.origination_timestamp': { + dashed_name: 'email-origination-timestamp', + description: + 'The date and time the email message was composed. Many email clients will fill in this value automatically when the message is sent by a user.', + example: '2020-11-10T22:12:34.8196921Z', + flat_name: 'email.origination_timestamp', + level: 'extended', + name: 'origination_timestamp', + normalize: [], + short: 'Date and time the email was composed.', + type: 'date', + }, + 'email.reply_to.address': { + dashed_name: 'email-reply-to-address', + description: + 'The address that replies should be delivered to based on the value in the RFC 5322 `Reply-To:` header.', + example: 'reply.here@example.com', + flat_name: 'email.reply_to.address', + ignore_above: 1024, + level: 'extended', + name: 'reply_to.address', + normalize: ['array'], + short: 'Address replies should be delivered to.', + type: 'keyword', + }, + 'email.sender.address': { + dashed_name: 'email-sender-address', + description: + 'Per RFC 5322, specifies the address responsible for the actual transmission of the message.', + flat_name: 'email.sender.address', + ignore_above: 1024, + level: 'extended', + name: 'sender.address', + normalize: [], + short: 'Address of the message sender.', + type: 'keyword', + }, + 'email.subject': { + dashed_name: 'email-subject', + description: 'A brief summary of the topic of the message.', + example: 'Please see this important message.', + flat_name: 'email.subject', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'email.subject.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'subject', + normalize: [], + short: 'The subject of the email message.', + type: 'keyword', + }, + 'email.to.address': { + dashed_name: 'email-to-address', + description: 'The email address of recipient', + example: 'user1@example.com', + flat_name: 'email.to.address', + ignore_above: 1024, + level: 'extended', + name: 'to.address', + normalize: ['array'], + short: 'Email address of recipient', + type: 'keyword', + }, + 'email.x_mailer': { + dashed_name: 'email-x-mailer', + description: + 'The name of the application that was used to draft and send the original email message.', + example: 'Spambot v2.5', + flat_name: 'email.x_mailer', + ignore_above: 1024, + level: 'extended', + name: 'x_mailer', + normalize: [], + short: 'Application that drafted email.', + type: 'keyword', + }, + }, + group: 2, + name: 'email', + nestings: ['email.attachments.file.hash'], + prefix: 'email.', + reused_here: [ + { + full: 'email.attachments.file.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + ], + short: 'Describes an email transaction.', + title: 'Email', + type: 'group', + }, + error: { + description: + 'These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.', + fields: { + 'error.code': { + dashed_name: 'error-code', + description: 'Error code describing the error.', + flat_name: 'error.code', + ignore_above: 1024, + level: 'core', + name: 'code', + normalize: [], + short: 'Error code describing the error.', + type: 'keyword', + }, + 'error.id': { + dashed_name: 'error-id', + description: 'Unique identifier for the error.', + flat_name: 'error.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier for the error.', + type: 'keyword', + }, + 'error.message': { + dashed_name: 'error-message', + description: 'Error message.', + flat_name: 'error.message', + level: 'core', + name: 'message', + normalize: [], + short: 'Error message.', + type: 'match_only_text', + }, + 'error.stack_trace': { + dashed_name: 'error-stack-trace', + description: 'The stack trace of this error in plain text.', + flat_name: 'error.stack_trace', + level: 'extended', + multi_fields: [ + { + flat_name: 'error.stack_trace.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'stack_trace', + normalize: [], + short: 'The stack trace of this error in plain text.', + type: 'wildcard', + }, + 'error.type': { + dashed_name: 'error-type', + description: 'The type of the error, for example the class name of the exception.', + example: 'java.lang.NullPointerException', + flat_name: 'error.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'The type of the error, for example the class name of the exception.', + type: 'keyword', + }, + }, + group: 2, + name: 'error', + prefix: 'error.', + short: 'Fields about errors of any kind.', + title: 'Error', + type: 'group', + }, + event: { + description: + 'The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.', + fields: { + 'event.action': { + dashed_name: 'event-action', + description: + 'The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.', + example: 'user-password-change', + flat_name: 'event.action', + ignore_above: 1024, + level: 'core', + name: 'action', + normalize: [], + short: 'The action captured by the event.', + type: 'keyword', + }, + 'event.agent_id_status': { + dashed_name: 'event-agent-id-status', + description: + "Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation.\nFor example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used.\nIf no validation is performed then the field should be omitted.\nThe allowed values are:\n`verified` - The `agent.id` field value matches expected value obtained from auth metadata.\n`mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata.\n`missing` - There was no `agent.id` field in the event to validate.\n`auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID.", + example: 'verified', + flat_name: 'event.agent_id_status', + ignore_above: 1024, + level: 'extended', + name: 'agent_id_status', + normalize: [], + short: "Validation status of the event's agent.id field.", + type: 'keyword', + }, + 'event.category': { + allowed_values: [ + { + description: + 'Events in this category are related to the challenge and response process in which credentials are supplied and verified to allow the creation of a session. Common sources for these logs are Windows event logs and ssh logs. Visualize and analyze events in this category to look for failed logins, and other authentication-related activity.', + expected_event_types: ['start', 'end', 'info'], + name: 'authentication', + }, + { + description: + 'Events in the configuration category have to deal with creating, modifying, or deleting the settings or parameters of an application, process, or system.\nExample sources include security policy change logs, configuration auditing logging, and system integrity monitoring.', + expected_event_types: ['access', 'change', 'creation', 'deletion', 'info'], + name: 'configuration', + }, + { + description: + 'The database category denotes events and metrics relating to a data storage and retrieval system. Note that use of this category is not limited to relational database systems. Examples include event logs from MS SQL, MySQL, Elasticsearch, MongoDB, etc. Use this category to visualize and analyze database activity such as accesses and changes.', + expected_event_types: ['access', 'change', 'info', 'error'], + name: 'database', + }, + { + description: + 'Events in the driver category have to do with operating system device drivers and similar software entities such as Windows drivers, kernel extensions, kernel modules, etc.\nUse events and metrics in this category to visualize and analyze driver-related activity and status on hosts.', + expected_event_types: ['change', 'end', 'info', 'start'], + name: 'driver', + }, + { + description: + 'This category is used for events relating to email messages, email attachments, and email network or protocol activity.\nEmails events can be produced by email security gateways, mail transfer agents, email cloud service providers, or mail server monitoring applications.', + expected_event_types: ['info'], + name: 'email', + }, + { + description: + 'Relating to a set of information that has been created on, or has existed on a filesystem. Use this category of events to visualize and analyze the creation, access, and deletions of files. Events in this category can come from both host-based and network-based sources. An example source of a network-based detection of a file transfer would be the Zeek file.log.', + expected_event_types: ['change', 'creation', 'deletion', 'info'], + name: 'file', + }, + { + description: + 'Use this category to visualize and analyze information such as host inventory or host lifecycle events.\nMost of the events in this category can usually be observed from the outside, such as from a hypervisor or a control plane\'s point of view. Some can also be seen from within, such as "start" or "end".\nNote that this category is for information about hosts themselves; it is not meant to capture activity "happening on a host".', + expected_event_types: ['access', 'change', 'end', 'info', 'start'], + name: 'host', + }, + { + description: + 'Identity and access management (IAM) events relating to users, groups, and administration. Use this category to visualize and analyze IAM-related logs and data from active directory, LDAP, Okta, Duo, and other IAM systems.', + expected_event_types: [ + 'admin', + 'change', + 'creation', + 'deletion', + 'group', + 'info', + 'user', + ], + name: 'iam', + }, + { + description: + 'Relating to intrusion detections from IDS/IPS systems and functions, both network and host-based. Use this category to visualize and analyze intrusion detection alerts from systems such as Snort, Suricata, and Palo Alto threat detections.', + expected_event_types: ['allowed', 'denied', 'info'], + name: 'intrusion_detection', + }, + { + description: + 'Malware detection events and alerts. Use this category to visualize and analyze malware detections from EDR/EPP systems such as Elastic Endpoint Security, Symantec Endpoint Protection, Crowdstrike, and network IDS/IPS systems such as Suricata, or other sources of malware-related events such as Palo Alto Networks threat logs and Wildfire logs.', + expected_event_types: ['info'], + name: 'malware', + }, + { + description: + 'Relating to all network activity, including network connection lifecycle, network traffic, and essentially any event that includes an IP address. Many events containing decoded network protocol transactions fit into this category. Use events in this category to visualize or analyze counts of network ports, protocols, addresses, geolocation information, etc.', + expected_event_types: [ + 'access', + 'allowed', + 'connection', + 'denied', + 'end', + 'info', + 'protocol', + 'start', + ], + name: 'network', + }, + { + description: + 'Relating to software packages installed on hosts. Use this category to visualize and analyze inventory of software installed on various hosts, or to determine host vulnerability in the absence of vulnerability scan data.', + expected_event_types: ['access', 'change', 'deletion', 'info', 'installation', 'start'], + name: 'package', + }, + { + description: + 'Use this category of events to visualize and analyze process-specific information such as lifecycle events or process ancestry.', + expected_event_types: ['access', 'change', 'end', 'info', 'start'], + name: 'process', + }, + { + description: + 'Having to do with settings and assets stored in the Windows registry. Use this category to visualize and analyze activity such as registry access and modifications.', + expected_event_types: ['access', 'change', 'creation', 'deletion'], + name: 'registry', + }, + { + description: + 'The session category is applied to events and metrics regarding logical persistent connections to hosts and services. Use this category to visualize and analyze interactive or automated persistent connections between assets. Data for this category may come from Windows Event logs, SSH logs, or stateless sessions such as HTTP cookie-based sessions, etc.', + expected_event_types: ['start', 'end', 'info'], + name: 'session', + }, + { + description: + "Use this category to visualize and analyze events describing threat actors' targets, motives, or behaviors.", + expected_event_types: ['indicator'], + name: 'threat', + }, + { + description: + 'Relating to vulnerability scan results. Use this category to analyze vulnerabilities detected by Tenable, Qualys, internal scanners, and other vulnerability management sources.', + expected_event_types: ['info'], + name: 'vulnerability', + }, + { + description: + 'Relating to web server access. Use this category to create a dashboard of web server/proxy activity from apache, IIS, nginx web servers, etc. Note: events from network observers such as Zeek http log may also be included in this category.', + expected_event_types: ['access', 'error', 'info'], + name: 'web', + }, + ], + dashed_name: 'event-category', + description: + 'This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.', + example: 'authentication', + flat_name: 'event.category', + ignore_above: 1024, + level: 'core', + name: 'category', + normalize: ['array'], + short: 'Event category. The second categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.code': { + dashed_name: 'event-code', + description: + 'Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.', + example: 4648, + flat_name: 'event.code', + ignore_above: 1024, + level: 'extended', + name: 'code', + normalize: [], + short: 'Identification code for this event.', + type: 'keyword', + }, + 'event.created': { + dashed_name: 'event-created', + description: + "event.created contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, @timestamp should be used.", + example: '2016-05-23T08:05:34.857Z', + flat_name: 'event.created', + level: 'core', + name: 'created', + normalize: [], + short: 'Time when the event was first read by an agent or by your pipeline.', + type: 'date', + }, + 'event.dataset': { + dashed_name: 'event-dataset', + description: + "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.", + example: 'apache.access', + flat_name: 'event.dataset', + ignore_above: 1024, + level: 'core', + name: 'dataset', + normalize: [], + short: 'Name of the dataset.', + type: 'keyword', + }, + 'event.duration': { + dashed_name: 'event-duration', + description: + 'Duration of the event in nanoseconds.\nIf event.start and event.end are known this value should be the difference between the end and start time.', + flat_name: 'event.duration', + format: 'duration', + input_format: 'nanoseconds', + level: 'core', + name: 'duration', + normalize: [], + output_format: 'asMilliseconds', + output_precision: 1, + short: 'Duration of the event in nanoseconds.', + type: 'long', + }, + 'event.end': { + dashed_name: 'event-end', + description: + 'event.end contains the date when the event ended or when the activity was last observed.', + flat_name: 'event.end', + level: 'extended', + name: 'end', + normalize: [], + short: + 'event.end contains the date when the event ended or when the activity was last observed.', + type: 'date', + }, + 'event.hash': { + dashed_name: 'event-hash', + description: + 'Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.', + example: '123456789012345678901234567890ABCD', + flat_name: 'event.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + short: + 'Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.', + type: 'keyword', + }, + 'event.id': { + dashed_name: 'event-id', + description: 'Unique ID to describe the event.', + example: '8a4f500d', + flat_name: 'event.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique ID to describe the event.', + type: 'keyword', + }, + 'event.ingested': { + dashed_name: 'event-ingested', + description: + "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.", + example: '2016-05-23T08:05:35.101Z', + flat_name: 'event.ingested', + level: 'core', + name: 'ingested', + normalize: [], + short: 'Timestamp when an event arrived in the central data store.', + type: 'date', + }, + 'event.kind': { + allowed_values: [ + { + description: + 'This value indicates an event such as an alert or notable event, triggered by a detection rule executing externally to the Elastic Stack.\n`event.kind:alert` is often populated for events coming from firewalls, intrusion detection systems, endpoint detection and response systems, and so on.\nThis value is not used by Elastic solutions for alert documents that are created by rules executing within the Kibana alerting framework.', + name: 'alert', + }, + { + description: + 'The `enrichment` value indicates an event collected to provide additional context, often to other events.\nAn example is collecting indicators of compromise (IOCs) from a threat intelligence provider with the intent to use those values to enrich other events. The IOC events from the intelligence provider should be categorized as `event.kind:enrichment`.', + name: 'enrichment', + }, + { + description: + 'This value is the most general and most common value for this field. It is used to represent events that indicate that something happened.', + name: 'event', + }, + { + description: + 'This value is used to indicate that this event describes a numeric measurement taken at given point in time.\nExamples include CPU utilization, memory usage, or device temperature.\nMetric events are often collected on a predictable frequency, such as once every few seconds, or once a minute, but can also be used to describe ad-hoc numeric metric queries.', + name: 'metric', + }, + { + description: + "The state value is similar to metric, indicating that this event describes a measurement taken at given point in time, except that the measurement does not result in a numeric value, but rather one of a fixed set of categorical values that represent conditions or states.\nExamples include periodic events reporting Elasticsearch cluster state (green/yellow/red), the state of a TCP connection (open, closed, fin_wait, etc.), the state of a host with respect to a software vulnerability (vulnerable, not vulnerable), and the state of a system regarding compliance with a regulatory standard (compliant, not compliant).\nNote that an event that describes a change of state would not use `event.kind:state`, but instead would use 'event.kind:event' since a state change fits the more general event definition of something that happened.\nState events are often collected on a predictable frequency, such as once every few seconds, once a minute, once an hour, or once a day, but can also be used to describe ad-hoc state queries.", + name: 'state', + }, + { + description: + 'This value indicates that an error occurred during the ingestion of this event, and that event data may be missing, inconsistent, or incorrect. `event.kind:pipeline_error` is often associated with parsing errors.', + name: 'pipeline_error', + }, + { + description: + 'This value is used by Elastic solutions (e.g., Security, Observability) for alert documents that are created by rules executing within the Kibana alerting framework.\nUsage of this value is reserved, and data ingestion pipelines must not populate `event.kind` with the value "signal".', + name: 'signal', + }, + ], + dashed_name: 'event-kind', + description: + 'This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not.', + example: 'alert', + flat_name: 'event.kind', + ignore_above: 1024, + level: 'core', + name: 'kind', + normalize: [], + short: 'The kind of the event. The highest categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.module': { + dashed_name: 'event-module', + description: + 'Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.', + example: 'apache', + flat_name: 'event.module', + ignore_above: 1024, + level: 'core', + name: 'module', + normalize: [], + short: 'Name of the module this data is coming from.', + type: 'keyword', + }, + 'event.original': { + dashed_name: 'event-original', + description: + 'Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex.\nThis field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`.', + doc_values: false, + example: + 'Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232', + flat_name: 'event.original', + index: false, + level: 'core', + name: 'original', + normalize: [], + short: 'Raw text message of entire event.', + type: 'keyword', + }, + 'event.outcome': { + allowed_values: [ + { + description: + 'Indicates that this event describes a failed result. A common example is `event.category:file AND event.type:access AND event.outcome:failure` to indicate that a file access was attempted, but was not successful.', + name: 'failure', + }, + { + description: + 'Indicates that this event describes a successful result. A common example is `event.category:file AND event.type:create AND event.outcome:success` to indicate that a file was successfully created.', + name: 'success', + }, + { + description: + "Indicates that this event describes only an attempt for which the result is unknown from the perspective of the event producer. For example, if the event contains information only about the request side of a transaction that results in a response, populating `event.outcome:unknown` in the request event is appropriate. The unknown value should not be used when an outcome doesn't make logical sense for the event. In such cases `event.outcome` should not be populated.", + name: 'unknown', + }, + ], + dashed_name: 'event-outcome', + description: + 'This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.', + example: 'success', + flat_name: 'event.outcome', + ignore_above: 1024, + level: 'core', + name: 'outcome', + normalize: [], + short: 'The outcome of the event. The lowest level categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.provider': { + dashed_name: 'event-provider', + description: + 'Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).', + example: 'kernel', + flat_name: 'event.provider', + ignore_above: 1024, + level: 'extended', + name: 'provider', + normalize: [], + short: 'Source of the event.', + type: 'keyword', + }, + 'event.reason': { + dashed_name: 'event-reason', + description: + 'Reason why this event happened, according to the source.\nThis describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`).', + example: 'Terminated an unexpected process', + flat_name: 'event.reason', + ignore_above: 1024, + level: 'extended', + name: 'reason', + normalize: [], + short: 'Reason why this event happened, according to the source', + type: 'keyword', + }, + 'event.reference': { + dashed_name: 'event-reference', + description: + 'Reference URL linking to additional information about this event.\nThis URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field.', + example: 'https://system.example.com/event/#0001234', + flat_name: 'event.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Event reference URL', + type: 'keyword', + }, + 'event.risk_score': { + dashed_name: 'event-risk-score', + description: + "Risk score or priority of the event (e.g. security solutions). Use your system's original value here.", + flat_name: 'event.risk_score', + level: 'core', + name: 'risk_score', + normalize: [], + short: + "Risk score or priority of the event (e.g. security solutions). Use your system's original value here.", + type: 'float', + }, + 'event.risk_score_norm': { + dashed_name: 'event-risk-score-norm', + description: + 'Normalized risk score or priority of the event, on a scale of 0 to 100.\nThis is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems.', + flat_name: 'event.risk_score_norm', + level: 'extended', + name: 'risk_score_norm', + normalize: [], + short: 'Normalized risk score or priority of the event (0-100).', + type: 'float', + }, + 'event.sequence': { + dashed_name: 'event-sequence', + description: + 'Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.', + flat_name: 'event.sequence', + format: 'string', + level: 'extended', + name: 'sequence', + normalize: [], + short: 'Sequence number of the event.', + type: 'long', + }, + 'event.severity': { + dashed_name: 'event-severity', + description: + "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.", + example: 7, + flat_name: 'event.severity', + format: 'string', + level: 'core', + name: 'severity', + normalize: [], + short: 'Numeric severity of the event.', + type: 'long', + }, + 'event.start': { + dashed_name: 'event-start', + description: + 'event.start contains the date when the event started or when the activity was first observed.', + flat_name: 'event.start', + level: 'extended', + name: 'start', + normalize: [], + short: + 'event.start contains the date when the event started or when the activity was first observed.', + type: 'date', + }, + 'event.timezone': { + dashed_name: 'event-timezone', + description: + 'This field should be populated when the event\'s timestamp does not include timezone information already (e.g. default Syslog timestamps). It\'s optional otherwise.\nAcceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").', + flat_name: 'event.timezone', + ignore_above: 1024, + level: 'extended', + name: 'timezone', + normalize: [], + short: 'Event time zone.', + type: 'keyword', + }, + 'event.type': { + allowed_values: [ + { + description: + 'The access event type is used for the subset of events within a category that indicate that something was accessed. Common examples include `event.category:database AND event.type:access`, or `event.category:file AND event.type:access`. Note for file access, both directory listings and file opens should be included in this subcategory. You can further distinguish access operations using the ECS `event.action` field.', + name: 'access', + }, + { + description: + 'The admin event type is used for the subset of events within a category that are related to admin objects. For example, administrative changes within an IAM framework that do not specifically affect a user or group (e.g., adding new applications to a federation solution or connecting discrete forests in Active Directory) would fall into this subcategory. Common example: `event.category:iam AND event.type:change AND event.type:admin`. You can further distinguish admin operations using the ECS `event.action` field.', + name: 'admin', + }, + { + description: + 'The allowed event type is used for the subset of events within a category that indicate that something was allowed. Common examples include `event.category:network AND event.type:connection AND event.type:allowed` (to indicate a network firewall event for which the firewall disposition was to allow the connection to complete) and `event.category:intrusion_detection AND event.type:allowed` (to indicate a network intrusion prevention system event for which the IPS disposition was to allow the connection to complete). You can further distinguish allowed operations using the ECS `event.action` field, populating with values of your choosing, such as "allow", "detect", or "pass".', + name: 'allowed', + }, + { + description: + 'The change event type is used for the subset of events within a category that indicate that something has changed. If semantics best describe an event as modified, then include them in this subcategory. Common examples include `event.category:process AND event.type:change`, and `event.category:file AND event.type:change`. You can further distinguish change operations using the ECS `event.action` field.', + name: 'change', + }, + { + description: + 'Used primarily with `event.category:network` this value is used for the subset of network traffic that includes sufficient information for the event to be included in flow or connection analysis. Events in this subcategory will contain at least source and destination IP addresses, source and destination TCP/UDP ports, and will usually contain counts of bytes and/or packets transferred. Events in this subcategory may contain unidirectional or bidirectional information, including summary information. Use this subcategory to visualize and analyze network connections. Flow analysis, including Netflow, IPFIX, and other flow-related events fit in this subcategory. Note that firewall events from many Next-Generation Firewall (NGFW) devices will also fit into this subcategory. A common filter for flow/connection information would be `event.category:network AND event.type:connection AND event.type:end` (to view or analyze all completed network connections, ignoring mid-flow reports). You can further distinguish connection events using the ECS `event.action` field, populating with values of your choosing, such as "timeout", or "reset".', + name: 'connection', + }, + { + description: + 'The "creation" event type is used for the subset of events within a category that indicate that something was created. A common example is `event.category:file AND event.type:creation`.', + name: 'creation', + }, + { + description: + 'The deletion event type is used for the subset of events within a category that indicate that something was deleted. A common example is `event.category:file AND event.type:deletion` to indicate that a file has been deleted.', + name: 'deletion', + }, + { + description: + 'The denied event type is used for the subset of events within a category that indicate that something was denied. Common examples include `event.category:network AND event.type:denied` (to indicate a network firewall event for which the firewall disposition was to deny the connection) and `event.category:intrusion_detection AND event.type:denied` (to indicate a network intrusion prevention system event for which the IPS disposition was to deny the connection to complete). You can further distinguish denied operations using the ECS `event.action` field, populating with values of your choosing, such as "blocked", "dropped", or "quarantined".', + name: 'denied', + }, + { + description: + 'The end event type is used for the subset of events within a category that indicate something has ended. A common example is `event.category:process AND event.type:end`.', + name: 'end', + }, + { + description: + 'The error event type is used for the subset of events within a category that indicate or describe an error. A common example is `event.category:database AND event.type:error`. Note that pipeline errors that occur during the event ingestion process should not use this `event.type` value. Instead, they should use `event.kind:pipeline_error`.', + name: 'error', + }, + { + description: + 'The group event type is used for the subset of events within a category that are related to group objects. Common example: `event.category:iam AND event.type:creation AND event.type:group`. You can further distinguish group operations using the ECS `event.action` field.', + name: 'group', + }, + { + description: + 'The indicator event type is used for the subset of events within a category that contain details about indicators of compromise (IOCs).\nA common example is `event.category:threat AND event.type:indicator`.', + name: 'indicator', + }, + { + description: + 'The info event type is used for the subset of events within a category that indicate that they are purely informational, and don\'t report a state change, or any type of action. For example, an initial run of a file integrity monitoring system (FIM), where an agent reports all files under management, would fall into the "info" subcategory. Similarly, an event containing a dump of all currently running processes (as opposed to reporting that a process started/ended) would fall into the "info" subcategory. An additional common examples is `event.category:intrusion_detection AND event.type:info`.', + name: 'info', + }, + { + description: + 'The installation event type is used for the subset of events within a category that indicate that something was installed. A common example is `event.category:package` AND `event.type:installation`.', + name: 'installation', + }, + { + description: + 'The protocol event type is used for the subset of events within a category that indicate that they contain protocol details or analysis, beyond simply identifying the protocol. Generally, network events that contain specific protocol details will fall into this subcategory. A common example is `event.category:network AND event.type:protocol AND event.type:connection AND event.type:end` (to indicate that the event is a network connection event sent at the end of a connection that also includes a protocol detail breakdown). Note that events that only indicate the name or id of the protocol should not use the protocol value. Further note that when the protocol subcategory is used, the identified protocol is populated in the ECS `network.protocol` field.', + name: 'protocol', + }, + { + description: + 'The start event type is used for the subset of events within a category that indicate something has started. A common example is `event.category:process AND event.type:start`.', + name: 'start', + }, + { + description: + 'The user event type is used for the subset of events within a category that are related to user objects. Common example: `event.category:iam AND event.type:deletion AND event.type:user`. You can further distinguish user operations using the ECS `event.action` field.', + name: 'user', + }, + ], + dashed_name: 'event-type', + description: + 'This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.', + flat_name: 'event.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: ['array'], + short: 'Event type. The third categorization field in the hierarchy.', + type: 'keyword', + }, + 'event.url': { + dashed_name: 'event-url', + description: + 'URL linking to an external system to continue investigation of this event.\nThis URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field.', + example: 'https://mysystem.example.com/alert/5271dedb-f5b0-4218-87f0-4ac4870a38fe', + flat_name: 'event.url', + ignore_above: 1024, + level: 'extended', + name: 'url', + normalize: [], + short: 'Event investigation URL', + type: 'keyword', + }, + }, + group: 2, + name: 'event', + prefix: 'event.', + short: 'Fields breaking down the event details.', + title: 'Event', + type: 'group', + }, + faas: { + beta: 'These fields are in beta and are subject to change.', + description: + 'The user fields describe information about the function as a service (FaaS) that is relevant to the event.', + fields: { + 'faas.coldstart': { + dashed_name: 'faas-coldstart', + description: 'Boolean value indicating a cold start of a function.', + flat_name: 'faas.coldstart', + level: 'extended', + name: 'coldstart', + normalize: [], + short: 'Boolean value indicating a cold start of a function.', + type: 'boolean', + }, + 'faas.execution': { + dashed_name: 'faas-execution', + description: 'The execution ID of the current function execution.', + example: 'af9d5aa4-a685-4c5f-a22b-444f80b3cc28', + flat_name: 'faas.execution', + ignore_above: 1024, + level: 'extended', + name: 'execution', + normalize: [], + short: 'The execution ID of the current function execution.', + type: 'keyword', + }, + 'faas.id': { + dashed_name: 'faas-id', + description: + "The unique identifier of a serverless function.\nFor AWS Lambda it's the function ARN (Amazon Resource Name) without a version or alias suffix.", + example: 'arn:aws:lambda:us-west-2:123456789012:function:my-function', + flat_name: 'faas.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'The unique identifier of a serverless function.', + type: 'keyword', + }, + 'faas.name': { + dashed_name: 'faas-name', + description: 'The name of a serverless function.', + example: 'my-function', + flat_name: 'faas.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'The name of a serverless function.', + type: 'keyword', + }, + 'faas.trigger': { + dashed_name: 'faas-trigger', + description: 'Details about the function trigger.', + flat_name: 'faas.trigger', + level: 'extended', + name: 'trigger', + normalize: [], + short: 'Details about the function trigger.', + type: 'nested', + }, + 'faas.trigger.request_id': { + dashed_name: 'faas-trigger-request-id', + description: 'The ID of the trigger request , message, event, etc.', + example: 123456789, + flat_name: 'faas.trigger.request_id', + ignore_above: 1024, + level: 'extended', + name: 'trigger.request_id', + normalize: [], + short: 'The ID of the trigger request , message, event, etc.', + type: 'keyword', + }, + 'faas.trigger.type': { + dashed_name: 'faas-trigger-type', + description: 'The trigger for the function execution.', + example: 'http', + expected_values: ['http', 'pubsub', 'datasource', 'timer', 'other'], + flat_name: 'faas.trigger.type', + ignore_above: 1024, + level: 'extended', + name: 'trigger.type', + normalize: [], + short: 'The trigger for the function execution.', + type: 'keyword', + }, + 'faas.version': { + dashed_name: 'faas-version', + description: 'The version of a serverless function.', + example: '123', + flat_name: 'faas.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'The version of a serverless function.', + type: 'keyword', + }, + }, + group: 2, + name: 'faas', + prefix: 'faas.', + short: 'Fields describing functions as a service.', + title: 'FaaS', + type: 'group', + }, + file: { + description: + 'A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.', + fields: { + 'file.accessed': { + dashed_name: 'file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + short: 'Last time the file was accessed.', + type: 'date', + }, + 'file.attributes': { + dashed_name: 'file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + short: 'Array of file attributes.', + type: 'keyword', + }, + 'file.code_signature.digest_algorithm': { + dashed_name: 'file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.exists': { + dashed_name: 'file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'file.code_signature.signing_id': { + dashed_name: 'file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.status': { + dashed_name: 'file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'file.code_signature.subject_name': { + dashed_name: 'file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'file.code_signature.team_id': { + dashed_name: 'file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'file.code_signature.timestamp': { + dashed_name: 'file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'file.code_signature.trusted': { + dashed_name: 'file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'file.code_signature.valid': { + dashed_name: 'file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'file.created': { + dashed_name: 'file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'file.created', + level: 'extended', + name: 'created', + normalize: [], + short: 'File creation time.', + type: 'date', + }, + 'file.ctime': { + dashed_name: 'file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'file.device': { + dashed_name: 'file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'file.directory': { + dashed_name: 'file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'file.drive_letter': { + dashed_name: 'file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'file.elf.architecture': { + dashed_name: 'file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'file.elf.byte_order': { + dashed_name: 'file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'file.elf.cpu_type': { + dashed_name: 'file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'file.elf.creation_date': { + dashed_name: 'file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'file.elf.exports': { + dashed_name: 'file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'file.elf.header.abi_version': { + dashed_name: 'file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'file.elf.header.class': { + dashed_name: 'file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'file.elf.header.data': { + dashed_name: 'file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'file.elf.header.entrypoint': { + dashed_name: 'file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'file.elf.header.object_version': { + dashed_name: 'file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'file.elf.header.os_abi': { + dashed_name: 'file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'file.elf.header.type': { + dashed_name: 'file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'file.elf.header.version': { + dashed_name: 'file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'file.elf.imports': { + dashed_name: 'file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'file.elf.sections': { + dashed_name: 'file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'file.elf.sections.chi2': { + dashed_name: 'file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'file.elf.sections.entropy': { + dashed_name: 'file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'file.elf.sections.flags': { + dashed_name: 'file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'file.elf.sections.name': { + dashed_name: 'file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'file.elf.sections.physical_offset': { + dashed_name: 'file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'file.elf.sections.physical_size': { + dashed_name: 'file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'file.elf.sections.type': { + dashed_name: 'file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'file.elf.sections.virtual_address': { + dashed_name: 'file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'file.elf.sections.virtual_size': { + dashed_name: 'file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'file.elf.segments': { + dashed_name: 'file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'file.elf.segments.sections': { + dashed_name: 'file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'file.elf.segments.type': { + dashed_name: 'file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'file.elf.shared_libraries': { + dashed_name: 'file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'file.elf.telfhash': { + dashed_name: 'file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'file.extension': { + dashed_name: 'file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'file.fork_name': { + dashed_name: 'file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'file.gid': { + dashed_name: 'file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'file.group': { + dashed_name: 'file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'file.hash.md5': { + dashed_name: 'file-hash-md5', + description: 'MD5 hash.', + flat_name: 'file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'file.hash.sha1': { + dashed_name: 'file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'file.hash.sha256': { + dashed_name: 'file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'file.hash.sha384': { + dashed_name: 'file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'file.hash.sha512': { + dashed_name: 'file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'file.hash.ssdeep': { + dashed_name: 'file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'file.hash.tlsh': { + dashed_name: 'file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'file.inode': { + dashed_name: 'file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'file.mime_type': { + dashed_name: 'file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'file.mode': { + dashed_name: 'file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'file.mtime': { + dashed_name: 'file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + short: 'Last time the file content was modified.', + type: 'date', + }, + 'file.name': { + dashed_name: 'file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'file.owner': { + dashed_name: 'file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + short: "File owner's username.", + type: 'keyword', + }, + 'file.path': { + dashed_name: 'file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'file.pe.architecture': { + dashed_name: 'file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'file.pe.company': { + dashed_name: 'file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.description': { + dashed_name: 'file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.file_version': { + dashed_name: 'file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'file.pe.imphash': { + dashed_name: 'file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'file.pe.original_file_name': { + dashed_name: 'file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.pe.pehash': { + dashed_name: 'file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'file.pe.product': { + dashed_name: 'file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'file.size': { + dashed_name: 'file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'file.size', + level: 'extended', + name: 'size', + normalize: [], + short: 'File size in bytes.', + type: 'long', + }, + 'file.target_path': { + dashed_name: 'file-target-path', + description: 'Target path for symlinks.', + flat_name: 'file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'file.type': { + dashed_name: 'file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'file.uid': { + dashed_name: 'file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'file.x509.alternative_names': { + dashed_name: 'file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'file.x509.issuer.common_name': { + dashed_name: 'file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.country': { + dashed_name: 'file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'file.x509.issuer.distinguished_name': { + dashed_name: 'file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.locality': { + dashed_name: 'file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'file.x509.issuer.organization': { + dashed_name: 'file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.organizational_unit': { + dashed_name: 'file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'file.x509.issuer.state_or_province': { + dashed_name: 'file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'file.x509.not_after': { + dashed_name: 'file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'file.x509.not_before': { + dashed_name: 'file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'file.x509.public_key_algorithm': { + dashed_name: 'file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'file.x509.public_key_curve': { + dashed_name: 'file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'file.x509.public_key_exponent': { + dashed_name: 'file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'file.x509.public_key_size': { + dashed_name: 'file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'file.x509.serial_number': { + dashed_name: 'file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'file.x509.signature_algorithm': { + dashed_name: 'file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'file.x509.subject.common_name': { + dashed_name: 'file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'file.x509.subject.country': { + dashed_name: 'file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'file.x509.subject.distinguished_name': { + dashed_name: 'file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'file.x509.subject.locality': { + dashed_name: 'file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'file.x509.subject.organization': { + dashed_name: 'file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'file.x509.subject.organizational_unit': { + dashed_name: 'file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'file.x509.subject.state_or_province': { + dashed_name: 'file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'file.x509.version_number': { + dashed_name: 'file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + }, + group: 2, + name: 'file', + nestings: ['file.code_signature', 'file.elf', 'file.hash', 'file.pe', 'file.x509'], + prefix: 'file.', + reusable: { + expected: [ + { as: 'file', at: 'threat.indicator', full: 'threat.indicator.file' }, + { + as: 'file', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.file', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'file.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + { + full: 'file.pe', + schema_name: 'pe', + short: 'These fields contain Windows Portable Executable (PE) metadata.', + }, + { + full: 'file.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'file.code_signature', + schema_name: 'code_signature', + short: 'These fields contain information about binary code signatures.', + }, + { + beta: 'This field reuse is beta and subject to change.', + full: 'file.elf', + schema_name: 'elf', + short: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + }, + ], + short: 'Fields describing files.', + title: 'File', + type: 'group', + }, + geo: { + description: + 'Geo fields can carry data about a specific location related to an event.\nThis geolocation information can be derived from techniques such as Geo IP, or be user-supplied.', + fields: { + 'geo.city_name': { + dashed_name: 'geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + short: 'City name.', + type: 'keyword', + }, + 'geo.continent_code': { + dashed_name: 'geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + short: 'Continent code.', + type: 'keyword', + }, + 'geo.continent_name': { + dashed_name: 'geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + short: 'Name of the continent.', + type: 'keyword', + }, + 'geo.country_iso_code': { + dashed_name: 'geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + short: 'Country ISO code.', + type: 'keyword', + }, + 'geo.country_name': { + dashed_name: 'geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + short: 'Country name.', + type: 'keyword', + }, + 'geo.location': { + dashed_name: 'geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'geo.location', + level: 'core', + name: 'location', + normalize: [], + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'geo.name': { + dashed_name: 'geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'geo.postal_code': { + dashed_name: 'geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + short: 'Postal code.', + type: 'keyword', + }, + 'geo.region_iso_code': { + dashed_name: 'geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + short: 'Region ISO code.', + type: 'keyword', + }, + 'geo.region_name': { + dashed_name: 'geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + short: 'Region name.', + type: 'keyword', + }, + 'geo.timezone': { + dashed_name: 'geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + short: 'Time zone.', + type: 'keyword', + }, + }, + group: 2, + name: 'geo', + prefix: 'geo.', + reusable: { + expected: [ + { as: 'geo', at: 'client', full: 'client.geo' }, + { as: 'geo', at: 'destination', full: 'destination.geo' }, + { as: 'geo', at: 'observer', full: 'observer.geo' }, + { as: 'geo', at: 'host', full: 'host.geo' }, + { as: 'geo', at: 'server', full: 'server.geo' }, + { as: 'geo', at: 'source', full: 'source.geo' }, + { as: 'geo', at: 'threat.indicator', full: 'threat.indicator.geo' }, + { + as: 'geo', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.geo', + }, + ], + top_level: false, + }, + short: 'Fields describing a location.', + title: 'Geo', + type: 'group', + }, + group: { + description: 'The group fields are meant to represent groups that are relevant to the event.', + fields: { + 'group.domain': { + dashed_name: 'group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'group.id': { + dashed_name: 'group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'group.name': { + dashed_name: 'group-name', + description: 'Name of the group.', + flat_name: 'group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the group.', + type: 'keyword', + }, + }, + group: 2, + name: 'group', + prefix: 'group.', + reusable: { + expected: [ + { as: 'group', at: 'user', full: 'user.group' }, + { + as: 'group', + at: 'process', + full: 'process.group', + short_override: 'The effective group (egid).', + }, + { + as: 'real_group', + at: 'process', + full: 'process.real_group', + short_override: 'The real group (rgid).', + }, + { + as: 'saved_group', + at: 'process', + full: 'process.saved_group', + short_override: 'The saved group (sgid).', + }, + { + as: 'supplemental_groups', + at: 'process', + full: 'process.supplemental_groups', + normalize: ['array'], + short_override: 'An array of supplemental groups.', + }, + { + as: 'attested_groups', + at: 'process', + beta: 'Reusing the `group` fields in this location is currently considered beta.', + full: 'process.attested_groups', + normalize: ['array'], + short_override: + 'The externally attested groups based on an external source such as the Kube API.', + }, + ], + top_level: true, + }, + short: "User's group relevant to the event.", + title: 'Group', + type: 'group', + }, + hash: { + description: + 'The hash fields represent different bitwise hash algorithms and their values.\nField names for common hashes (e.g. MD5, SHA1) are predefined. Add fields for other hashes by lowercasing the hash algorithm name and using underscore separators as appropriate (snake case, e.g. sha3_512).\nNote that this fieldset is used for common hashes that may be computed over a range of generic bytes. Entity-specific hashes such as ja3 or imphash are placed in the fieldsets to which they relate (tls and pe, respectively).', + fields: { + 'hash.md5': { + dashed_name: 'hash-md5', + description: 'MD5 hash.', + flat_name: 'hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + short: 'MD5 hash.', + type: 'keyword', + }, + 'hash.sha1': { + dashed_name: 'hash-sha1', + description: 'SHA1 hash.', + flat_name: 'hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + short: 'SHA1 hash.', + type: 'keyword', + }, + 'hash.sha256': { + dashed_name: 'hash-sha256', + description: 'SHA256 hash.', + flat_name: 'hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + short: 'SHA256 hash.', + type: 'keyword', + }, + 'hash.sha384': { + dashed_name: 'hash-sha384', + description: 'SHA384 hash.', + flat_name: 'hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + short: 'SHA384 hash.', + type: 'keyword', + }, + 'hash.sha512': { + dashed_name: 'hash-sha512', + description: 'SHA512 hash.', + flat_name: 'hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + short: 'SHA512 hash.', + type: 'keyword', + }, + 'hash.ssdeep': { + dashed_name: 'hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'hash.tlsh': { + dashed_name: 'hash-tlsh', + description: 'TLSH hash.', + flat_name: 'hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + short: 'TLSH hash.', + type: 'keyword', + }, + }, + group: 2, + name: 'hash', + prefix: 'hash.', + reusable: { + expected: [ + { as: 'hash', at: 'file', full: 'file.hash' }, + { as: 'hash', at: 'process', full: 'process.hash' }, + { as: 'hash', at: 'dll', full: 'dll.hash' }, + { + as: 'hash', + at: 'email.attachments.file', + full: 'email.attachments.file.hash', + }, + ], + top_level: false, + }, + short: 'Hashes, usually file hashes.', + title: 'Hash', + type: 'group', + }, + host: { + description: + 'A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.', + fields: { + 'host.architecture': { + dashed_name: 'host-architecture', + description: 'Operating system architecture.', + example: 'x86_64', + flat_name: 'host.architecture', + ignore_above: 1024, + level: 'core', + name: 'architecture', + normalize: [], + short: 'Operating system architecture.', + type: 'keyword', + }, + 'host.boot.id': { + beta: 'This field is beta and subject to change.', + dashed_name: 'host-boot-id', + description: + 'Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.', + example: '88a1f0ed-5ae5-41ee-af6b-41921c311872', + flat_name: 'host.boot.id', + ignore_above: 1024, + level: 'extended', + name: 'boot.id', + normalize: [], + short: 'Linux boot uuid taken from /proc/sys/kernel/random/boot_id', + type: 'keyword', + }, + 'host.cpu.usage': { + dashed_name: 'host-cpu-usage', + description: + 'Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1.\nScaling factor: 1000.\nFor example: For a two core host, this value should be the average of the two cores, between 0 and 1.', + flat_name: 'host.cpu.usage', + level: 'extended', + name: 'cpu.usage', + normalize: [], + scaling_factor: 1000, + short: 'Percent CPU used, between 0 and 1.', + type: 'scaled_float', + }, + 'host.disk.read.bytes': { + dashed_name: 'host-disk-read-bytes', + description: + 'The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'host.disk.read.bytes', + level: 'extended', + name: 'disk.read.bytes', + normalize: [], + short: 'The number of bytes read by all disks.', + type: 'long', + }, + 'host.disk.write.bytes': { + dashed_name: 'host-disk-write-bytes', + description: + 'The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection.', + flat_name: 'host.disk.write.bytes', + level: 'extended', + name: 'disk.write.bytes', + normalize: [], + short: 'The number of bytes written on all disks.', + type: 'long', + }, + 'host.domain': { + dashed_name: 'host-domain', + description: + "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.", + example: 'CONTOSO', + flat_name: 'host.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'host.geo.city_name': { + dashed_name: 'host-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'host.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'host.geo.continent_code': { + dashed_name: 'host-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'host.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'host.geo.continent_name': { + dashed_name: 'host-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'host.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'host.geo.country_iso_code': { + dashed_name: 'host-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'host.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'host.geo.country_name': { + dashed_name: 'host-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'host.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'host.geo.location': { + dashed_name: 'host-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'host.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'host.geo.name': { + dashed_name: 'host-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'host.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'host.geo.postal_code': { + dashed_name: 'host-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'host.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'host.geo.region_iso_code': { + dashed_name: 'host-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'host.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'host.geo.region_name': { + dashed_name: 'host-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'host.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'host.geo.timezone': { + dashed_name: 'host-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'host.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'host.hostname': { + dashed_name: 'host-hostname', + description: + 'Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.', + flat_name: 'host.hostname', + ignore_above: 1024, + level: 'core', + name: 'hostname', + normalize: [], + short: 'Hostname of the host.', + type: 'keyword', + }, + 'host.id': { + dashed_name: 'host-id', + description: + 'Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.', + flat_name: 'host.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique host id.', + type: 'keyword', + }, + 'host.ip': { + dashed_name: 'host-ip', + description: 'Host ip addresses.', + flat_name: 'host.ip', + level: 'core', + name: 'ip', + normalize: ['array'], + short: 'Host ip addresses.', + type: 'ip', + }, + 'host.mac': { + dashed_name: 'host-mac', + description: + 'Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]', + flat_name: 'host.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: ['array'], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'Host MAC addresses.', + type: 'keyword', + }, + 'host.name': { + dashed_name: 'host-name', + description: + 'Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.', + flat_name: 'host.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the host.', + type: 'keyword', + }, + 'host.network.egress.bytes': { + dashed_name: 'host-network-egress-bytes', + description: + 'The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.egress.bytes', + level: 'extended', + name: 'network.egress.bytes', + normalize: [], + short: 'The number of bytes sent on all network interfaces.', + type: 'long', + }, + 'host.network.egress.packets': { + dashed_name: 'host-network-egress-packets', + description: + 'The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.egress.packets', + level: 'extended', + name: 'network.egress.packets', + normalize: [], + short: 'The number of packets sent on all network interfaces.', + type: 'long', + }, + 'host.network.ingress.bytes': { + dashed_name: 'host-network-ingress-bytes', + description: + 'The number of bytes received (gauge) on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.ingress.bytes', + level: 'extended', + name: 'network.ingress.bytes', + normalize: [], + short: 'The number of bytes received on all network interfaces.', + type: 'long', + }, + 'host.network.ingress.packets': { + dashed_name: 'host-network-ingress-packets', + description: + 'The number of packets (gauge) received on all network interfaces by the host since the last metric collection.', + flat_name: 'host.network.ingress.packets', + level: 'extended', + name: 'network.ingress.packets', + normalize: [], + short: 'The number of packets received on all network interfaces.', + type: 'long', + }, + 'host.os.family': { + dashed_name: 'host-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'host.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'host.os.full': { + dashed_name: 'host-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'host.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'host.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'host.os.kernel': { + dashed_name: 'host-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'host.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'host.os.name': { + dashed_name: 'host-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'host.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'host.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'host.os.platform': { + dashed_name: 'host-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'host.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'host.os.type': { + dashed_name: 'host-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'host.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'host.os.version': { + dashed_name: 'host-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'host.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'host.pid_ns_ino': { + beta: 'This field is beta and subject to change.', + dashed_name: 'host-pid-ns-ino', + description: + 'This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.', + example: 256383, + flat_name: 'host.pid_ns_ino', + ignore_above: 1024, + level: 'extended', + name: 'pid_ns_ino', + normalize: [], + short: 'Pid namespace inode', + type: 'keyword', + }, + 'host.risk.calculated_level': { + dashed_name: 'host-risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'host.risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'host.risk.calculated_score': { + dashed_name: 'host-risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'host.risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'host.risk.calculated_score_norm': { + dashed_name: 'host-risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'host.risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'host.risk.static_level': { + dashed_name: 'host-risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'host.risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'host.risk.static_score': { + dashed_name: 'host-risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'host.risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'host.risk.static_score_norm': { + dashed_name: 'host-risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'host.risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + 'host.type': { + dashed_name: 'host-type', + description: + 'Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.', + flat_name: 'host.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'Type of host.', + type: 'keyword', + }, + 'host.uptime': { + dashed_name: 'host-uptime', + description: 'Seconds the host has been up.', + example: 1325, + flat_name: 'host.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + short: 'Seconds the host has been up.', + type: 'long', + }, + }, + group: 2, + name: 'host', + nestings: ['host.geo', 'host.os', 'host.risk'], + prefix: 'host.', + reused_here: [ + { + full: 'host.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'host.os', + schema_name: 'os', + short: 'OS fields contain information about the operating system.', + }, + { + full: 'host.risk', + schema_name: 'risk', + short: 'Fields for describing risk score and level.', + }, + ], + short: 'Fields describing the relevant computing instance.', + title: 'Host', + type: 'group', + }, + http: { + description: + 'Fields related to HTTP activity. Use the `url` field set to store the url of the request.', + fields: { + 'http.request.body.bytes': { + dashed_name: 'http-request-body-bytes', + description: 'Size in bytes of the request body.', + example: 887, + flat_name: 'http.request.body.bytes', + format: 'bytes', + level: 'extended', + name: 'request.body.bytes', + normalize: [], + short: 'Size in bytes of the request body.', + type: 'long', + }, + 'http.request.body.content': { + dashed_name: 'http-request-body-content', + description: 'The full HTTP request body.', + example: 'Hello world', + flat_name: 'http.request.body.content', + level: 'extended', + multi_fields: [ + { + flat_name: 'http.request.body.content.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'request.body.content', + normalize: [], + short: 'The full HTTP request body.', + type: 'wildcard', + }, + 'http.request.bytes': { + dashed_name: 'http-request-bytes', + description: 'Total size in bytes of the request (body and headers).', + example: 1437, + flat_name: 'http.request.bytes', + format: 'bytes', + level: 'extended', + name: 'request.bytes', + normalize: [], + short: 'Total size in bytes of the request (body and headers).', + type: 'long', + }, + 'http.request.id': { + dashed_name: 'http-request-id', + description: + 'A unique identifier for each HTTP request to correlate logs between clients and servers in transactions.\nThe id may be contained in a non-standard HTTP header, such as `X-Request-ID` or `X-Correlation-ID`.', + example: '123e4567-e89b-12d3-a456-426614174000', + flat_name: 'http.request.id', + ignore_above: 1024, + level: 'extended', + name: 'request.id', + normalize: [], + short: 'HTTP request ID.', + type: 'keyword', + }, + 'http.request.method': { + dashed_name: 'http-request-method', + description: + 'HTTP request method.\nThe value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field.', + example: 'POST', + flat_name: 'http.request.method', + ignore_above: 1024, + level: 'extended', + name: 'request.method', + normalize: [], + short: 'HTTP request method.', + type: 'keyword', + }, + 'http.request.mime_type': { + dashed_name: 'http-request-mime-type', + description: + "Mime type of the body of the request.\nThis value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients.", + example: 'image/gif', + flat_name: 'http.request.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'request.mime_type', + normalize: [], + short: 'Mime type of the body of the request.', + type: 'keyword', + }, + 'http.request.referrer': { + dashed_name: 'http-request-referrer', + description: 'Referrer for this HTTP request.', + example: 'https://blog.example.com/', + flat_name: 'http.request.referrer', + ignore_above: 1024, + level: 'extended', + name: 'request.referrer', + normalize: [], + short: 'Referrer for this HTTP request.', + type: 'keyword', + }, + 'http.response.body.bytes': { + dashed_name: 'http-response-body-bytes', + description: 'Size in bytes of the response body.', + example: 887, + flat_name: 'http.response.body.bytes', + format: 'bytes', + level: 'extended', + name: 'response.body.bytes', + normalize: [], + short: 'Size in bytes of the response body.', + type: 'long', + }, + 'http.response.body.content': { + dashed_name: 'http-response-body-content', + description: 'The full HTTP response body.', + example: 'Hello world', + flat_name: 'http.response.body.content', + level: 'extended', + multi_fields: [ + { + flat_name: 'http.response.body.content.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'response.body.content', + normalize: [], + short: 'The full HTTP response body.', + type: 'wildcard', + }, + 'http.response.bytes': { + dashed_name: 'http-response-bytes', + description: 'Total size in bytes of the response (body and headers).', + example: 1437, + flat_name: 'http.response.bytes', + format: 'bytes', + level: 'extended', + name: 'response.bytes', + normalize: [], + short: 'Total size in bytes of the response (body and headers).', + type: 'long', + }, + 'http.response.mime_type': { + dashed_name: 'http-response-mime-type', + description: + "Mime type of the body of the response.\nThis value must only be populated based on the content of the response body, not on the `Content-Type` header. Comparing the mime type of a response with the response's Content-Type header can be helpful in detecting misconfigured servers.", + example: 'image/gif', + flat_name: 'http.response.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'response.mime_type', + normalize: [], + short: 'Mime type of the body of the response.', + type: 'keyword', + }, + 'http.response.status_code': { + dashed_name: 'http-response-status-code', + description: 'HTTP response status code.', + example: 404, + flat_name: 'http.response.status_code', + format: 'string', + level: 'extended', + name: 'response.status_code', + normalize: [], + short: 'HTTP response status code.', + type: 'long', + }, + 'http.version': { + dashed_name: 'http-version', + description: 'HTTP version.', + example: 1.1, + flat_name: 'http.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'HTTP version.', + type: 'keyword', + }, + }, + group: 2, + name: 'http', + prefix: 'http.', + short: 'Fields describing an HTTP request.', + title: 'HTTP', + type: 'group', + }, + interface: { + description: + 'The interface fields are used to record ingress and egress interface information when reported by an observer (e.g. firewall, router, load balancer) in the context of the observer handling a network connection. In the case of a single observer interface (e.g. network sensor on a span port) only the observer.ingress information should be populated.', + fields: { + 'interface.alias': { + dashed_name: 'interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + short: 'Interface alias', + type: 'keyword', + }, + 'interface.id': { + dashed_name: 'interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Interface ID', + type: 'keyword', + }, + 'interface.name': { + dashed_name: 'interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Interface name', + type: 'keyword', + }, + }, + group: 2, + name: 'interface', + prefix: 'interface.', + reusable: { + expected: [ + { + as: 'interface', + at: 'observer.ingress', + full: 'observer.ingress.interface', + }, + { + as: 'interface', + at: 'observer.egress', + full: 'observer.egress.interface', + }, + ], + top_level: false, + }, + short: 'Fields to describe observer interface information.', + title: 'Interface', + type: 'group', + }, + log: { + description: + "Details about the event's logging mechanism or logging transport.\nThe log.* fields are typically populated with details about the logging mechanism used to create and/or transport the event. For example, syslog details belong under `log.syslog.*`.\nThe details specific to your event source are typically not logged under `log.*`, but rather in `event.*` or in other ECS fields.", + fields: { + 'log.file.path': { + dashed_name: 'log-file-path', + description: + "Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate.\nIf the event wasn't read from a log file, do not populate this field.", + example: '/var/log/fun-times.log', + flat_name: 'log.file.path', + ignore_above: 1024, + level: 'extended', + name: 'file.path', + normalize: [], + short: 'Full path to the log file this event came from.', + type: 'keyword', + }, + 'log.level': { + dashed_name: 'log-level', + description: + "Original log level of the log event.\nIf the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity).\nSome examples are `warn`, `err`, `i`, `informational`.", + example: 'error', + flat_name: 'log.level', + ignore_above: 1024, + level: 'core', + name: 'level', + normalize: [], + short: 'Log level of the log event.', + type: 'keyword', + }, + 'log.logger': { + dashed_name: 'log-logger', + description: + 'The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name.', + example: 'org.elasticsearch.bootstrap.Bootstrap', + flat_name: 'log.logger', + ignore_above: 1024, + level: 'core', + name: 'logger', + normalize: [], + short: 'Name of the logger.', + type: 'keyword', + }, + 'log.origin.file.line': { + dashed_name: 'log-origin-file-line', + description: + 'The line number of the file containing the source code which originated the log event.', + example: 42, + flat_name: 'log.origin.file.line', + level: 'extended', + name: 'origin.file.line', + normalize: [], + short: 'The line number of the file which originated the log event.', + type: 'long', + }, + 'log.origin.file.name': { + dashed_name: 'log-origin-file-name', + description: + 'The name of the file containing the source code which originated the log event.\nNote that this field is not meant to capture the log file. The correct field to capture the log file is `log.file.path`.', + example: 'Bootstrap.java', + flat_name: 'log.origin.file.name', + ignore_above: 1024, + level: 'extended', + name: 'origin.file.name', + normalize: [], + short: 'The code file which originated the log event.', + type: 'keyword', + }, + 'log.origin.function': { + dashed_name: 'log-origin-function', + description: 'The name of the function or method which originated the log event.', + example: 'init', + flat_name: 'log.origin.function', + ignore_above: 1024, + level: 'extended', + name: 'origin.function', + normalize: [], + short: 'The function which originated the log event.', + type: 'keyword', + }, + 'log.syslog': { + dashed_name: 'log-syslog', + description: + 'The Syslog metadata of the event, if the event was transmitted via Syslog. Please see RFCs 5424 or 3164.', + flat_name: 'log.syslog', + level: 'extended', + name: 'syslog', + normalize: [], + short: 'Syslog metadata', + type: 'object', + }, + 'log.syslog.appname': { + dashed_name: 'log-syslog-appname', + description: 'The device or application that originated the Syslog message, if available.', + example: 'sshd', + flat_name: 'log.syslog.appname', + ignore_above: 1024, + level: 'extended', + name: 'syslog.appname', + normalize: [], + short: 'The device or application that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.facility.code': { + dashed_name: 'log-syslog-facility-code', + description: + 'The Syslog numeric facility of the log event, if available.\nAccording to RFCs 5424 and 3164, this value should be an integer between 0 and 23.', + example: 23, + flat_name: 'log.syslog.facility.code', + format: 'string', + level: 'extended', + name: 'syslog.facility.code', + normalize: [], + short: 'Syslog numeric facility of the event.', + type: 'long', + }, + 'log.syslog.facility.name': { + dashed_name: 'log-syslog-facility-name', + description: 'The Syslog text-based facility of the log event, if available.', + example: 'local7', + flat_name: 'log.syslog.facility.name', + ignore_above: 1024, + level: 'extended', + name: 'syslog.facility.name', + normalize: [], + short: 'Syslog text-based facility of the event.', + type: 'keyword', + }, + 'log.syslog.hostname': { + dashed_name: 'log-syslog-hostname', + description: + 'The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector.', + example: 'example-host', + flat_name: 'log.syslog.hostname', + ignore_above: 1024, + level: 'extended', + name: 'syslog.hostname', + normalize: [], + short: 'The host that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.msgid': { + dashed_name: 'log-syslog-msgid', + description: + 'An identifier for the type of Syslog message, if available. Only applicable for RFC 5424 messages.', + example: 'ID47', + flat_name: 'log.syslog.msgid', + ignore_above: 1024, + level: 'extended', + name: 'syslog.msgid', + normalize: [], + short: 'An identifier for the type of Syslog message.', + type: 'keyword', + }, + 'log.syslog.priority': { + dashed_name: 'log-syslog-priority', + description: + 'Syslog numeric priority of the event, if available.\nAccording to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.', + example: 135, + flat_name: 'log.syslog.priority', + format: 'string', + level: 'extended', + name: 'syslog.priority', + normalize: [], + short: 'Syslog priority of the event.', + type: 'long', + }, + 'log.syslog.procid': { + dashed_name: 'log-syslog-procid', + description: 'The process name or ID that originated the Syslog message, if available.', + example: 12345, + flat_name: 'log.syslog.procid', + ignore_above: 1024, + level: 'extended', + name: 'syslog.procid', + normalize: [], + short: 'The process name or ID that originated the Syslog message.', + type: 'keyword', + }, + 'log.syslog.severity.code': { + dashed_name: 'log-syslog-severity-code', + description: + "The Syslog numeric severity of the log event, if available.\nIf the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`.", + example: 3, + flat_name: 'log.syslog.severity.code', + level: 'extended', + name: 'syslog.severity.code', + normalize: [], + short: 'Syslog numeric severity of the event.', + type: 'long', + }, + 'log.syslog.severity.name': { + dashed_name: 'log-syslog-severity-name', + description: + "The Syslog numeric severity of the log event, if available.\nIf the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`.", + example: 'Error', + flat_name: 'log.syslog.severity.name', + ignore_above: 1024, + level: 'extended', + name: 'syslog.severity.name', + normalize: [], + short: 'Syslog text-based severity of the event.', + type: 'keyword', + }, + 'log.syslog.structured_data': { + dashed_name: 'log-syslog-structured-data', + description: + 'Structured data expressed in RFC 5424 messages, if available. These are key-value pairs formed from the structured data portion of the syslog message, as defined in RFC 5424 Section 6.3.', + flat_name: 'log.syslog.structured_data', + level: 'extended', + name: 'syslog.structured_data', + normalize: [], + short: 'Structured data expressed in RFC 5424 messages.', + type: 'flattened', + }, + 'log.syslog.version': { + dashed_name: 'log-syslog-version', + description: + 'The version of the Syslog protocol specification. Only applicable for RFC 5424 messages.', + example: 1, + flat_name: 'log.syslog.version', + ignore_above: 1024, + level: 'extended', + name: 'syslog.version', + normalize: [], + short: 'Syslog protocol version.', + type: 'keyword', + }, + }, + group: 2, + name: 'log', + prefix: 'log.', + short: "Details about the event's logging mechanism.", + title: 'Log', + type: 'group', + }, + network: { + description: + 'The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.', + fields: { + 'network.application': { + dashed_name: 'network-application', + description: + "When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name.\nFor example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`.\nThe field value must be normalized to lowercase for querying.", + example: 'aim', + flat_name: 'network.application', + ignore_above: 1024, + level: 'extended', + name: 'application', + normalize: [], + short: 'Application level protocol name.', + type: 'keyword', + }, + 'network.bytes': { + dashed_name: 'network-bytes', + description: + 'Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.', + example: 368, + flat_name: 'network.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Total bytes transferred in both directions.', + type: 'long', + }, + 'network.community_id': { + dashed_name: 'network-community-id', + description: + 'A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.', + example: '1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=', + flat_name: 'network.community_id', + ignore_above: 1024, + level: 'extended', + name: 'community_id', + normalize: [], + short: 'A hash of source and destination IPs and ports.', + type: 'keyword', + }, + 'network.direction': { + dashed_name: 'network-direction', + description: + 'Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host\'s point of view, using the values "ingress" or "egress".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".\nNote that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.', + example: 'inbound', + expected_values: [ + 'ingress', + 'egress', + 'inbound', + 'outbound', + 'internal', + 'external', + 'unknown', + ], + flat_name: 'network.direction', + ignore_above: 1024, + level: 'core', + name: 'direction', + normalize: [], + short: 'Direction of the network traffic.', + type: 'keyword', + }, + 'network.forwarded_ip': { + dashed_name: 'network-forwarded-ip', + description: 'Host IP address when the source IP address is the proxy.', + example: '192.1.1.2', + flat_name: 'network.forwarded_ip', + level: 'core', + name: 'forwarded_ip', + normalize: [], + short: 'Host IP address when the source IP address is the proxy.', + type: 'ip', + }, + 'network.iana_number': { + dashed_name: 'network-iana-number', + description: + 'IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.', + example: 6, + flat_name: 'network.iana_number', + ignore_above: 1024, + level: 'extended', + name: 'iana_number', + normalize: [], + short: 'IANA Protocol Number.', + type: 'keyword', + }, + 'network.inner': { + dashed_name: 'network-inner', + description: + 'Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)', + flat_name: 'network.inner', + level: 'extended', + name: 'inner', + normalize: [], + short: 'Inner VLAN tag information', + type: 'object', + }, + 'network.inner.vlan.id': { + dashed_name: 'network-inner-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'network.inner.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'network.inner.vlan.name': { + dashed_name: 'network-inner-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'network.inner.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'network.name': { + dashed_name: 'network-name', + description: 'Name given by operators to sections of their network.', + example: 'Guest Wifi', + flat_name: 'network.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name given by operators to sections of their network.', + type: 'keyword', + }, + 'network.packets': { + dashed_name: 'network-packets', + description: + 'Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.', + example: 24, + flat_name: 'network.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Total packets transferred in both directions.', + type: 'long', + }, + 'network.protocol': { + dashed_name: 'network-protocol', + description: + 'In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.', + example: 'http', + flat_name: 'network.protocol', + ignore_above: 1024, + level: 'core', + name: 'protocol', + normalize: [], + short: 'Application protocol name.', + type: 'keyword', + }, + 'network.transport': { + dashed_name: 'network-transport', + description: + 'Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.', + example: 'tcp', + flat_name: 'network.transport', + ignore_above: 1024, + level: 'core', + name: 'transport', + normalize: [], + short: 'Protocol Name corresponding to the field `iana_number`.', + type: 'keyword', + }, + 'network.type': { + dashed_name: 'network-type', + description: + 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.', + example: 'ipv4', + flat_name: 'network.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc', + type: 'keyword', + }, + 'network.vlan.id': { + dashed_name: 'network-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'network.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'network.vlan.name': { + dashed_name: 'network-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'network.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + }, + group: 2, + name: 'network', + nestings: ['network.inner.vlan', 'network.vlan'], + prefix: 'network.', + reused_here: [ + { + full: 'network.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + { + full: 'network.inner.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + ], + short: 'Fields describing the communication path over which the event happened.', + title: 'Network', + type: 'group', + }, + observer: { + description: + 'An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics.\nThis could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS.', + fields: { + 'observer.egress': { + dashed_name: 'observer-egress', + description: + 'Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.', + flat_name: 'observer.egress', + level: 'extended', + name: 'egress', + normalize: [], + short: 'Object field for egress information', + type: 'object', + }, + 'observer.egress.interface.alias': { + dashed_name: 'observer-egress-interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'observer.egress.interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + original_fieldset: 'interface', + short: 'Interface alias', + type: 'keyword', + }, + 'observer.egress.interface.id': { + dashed_name: 'observer-egress-interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'observer.egress.interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'interface', + short: 'Interface ID', + type: 'keyword', + }, + 'observer.egress.interface.name': { + dashed_name: 'observer-egress-interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'observer.egress.interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'interface', + short: 'Interface name', + type: 'keyword', + }, + 'observer.egress.vlan.id': { + dashed_name: 'observer-egress-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'observer.egress.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'observer.egress.vlan.name': { + dashed_name: 'observer-egress-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'observer.egress.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.egress.zone': { + dashed_name: 'observer-egress-zone', + description: + 'Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.', + example: 'Public_Internet', + flat_name: 'observer.egress.zone', + ignore_above: 1024, + level: 'extended', + name: 'egress.zone', + normalize: [], + short: 'Observer Egress zone', + type: 'keyword', + }, + 'observer.geo.city_name': { + dashed_name: 'observer-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'observer.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'observer.geo.continent_code': { + dashed_name: 'observer-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'observer.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'observer.geo.continent_name': { + dashed_name: 'observer-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'observer.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'observer.geo.country_iso_code': { + dashed_name: 'observer-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'observer.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'observer.geo.country_name': { + dashed_name: 'observer-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'observer.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'observer.geo.location': { + dashed_name: 'observer-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'observer.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'observer.geo.name': { + dashed_name: 'observer-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'observer.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'observer.geo.postal_code': { + dashed_name: 'observer-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'observer.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'observer.geo.region_iso_code': { + dashed_name: 'observer-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'observer.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'observer.geo.region_name': { + dashed_name: 'observer-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'observer.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'observer.geo.timezone': { + dashed_name: 'observer-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'observer.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'observer.hostname': { + dashed_name: 'observer-hostname', + description: 'Hostname of the observer.', + flat_name: 'observer.hostname', + ignore_above: 1024, + level: 'core', + name: 'hostname', + normalize: [], + short: 'Hostname of the observer.', + type: 'keyword', + }, + 'observer.ingress': { + dashed_name: 'observer-ingress', + description: + 'Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.', + flat_name: 'observer.ingress', + level: 'extended', + name: 'ingress', + normalize: [], + short: 'Object field for ingress information', + type: 'object', + }, + 'observer.ingress.interface.alias': { + dashed_name: 'observer-ingress-interface-alias', + description: + 'Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.', + example: 'outside', + flat_name: 'observer.ingress.interface.alias', + ignore_above: 1024, + level: 'extended', + name: 'alias', + normalize: [], + original_fieldset: 'interface', + short: 'Interface alias', + type: 'keyword', + }, + 'observer.ingress.interface.id': { + dashed_name: 'observer-ingress-interface-id', + description: 'Interface ID as reported by an observer (typically SNMP interface ID).', + example: 10, + flat_name: 'observer.ingress.interface.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'interface', + short: 'Interface ID', + type: 'keyword', + }, + 'observer.ingress.interface.name': { + dashed_name: 'observer-ingress-interface-name', + description: 'Interface name as reported by the system.', + example: 'eth0', + flat_name: 'observer.ingress.interface.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'interface', + short: 'Interface name', + type: 'keyword', + }, + 'observer.ingress.vlan.id': { + dashed_name: 'observer-ingress-vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'observer.ingress.vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'vlan', + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'observer.ingress.vlan.name': { + dashed_name: 'observer-ingress-vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'observer.ingress.vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'vlan', + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + 'observer.ingress.zone': { + dashed_name: 'observer-ingress-zone', + description: + 'Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.', + example: 'DMZ', + flat_name: 'observer.ingress.zone', + ignore_above: 1024, + level: 'extended', + name: 'ingress.zone', + normalize: [], + short: 'Observer ingress zone', + type: 'keyword', + }, + 'observer.ip': { + dashed_name: 'observer-ip', + description: 'IP addresses of the observer.', + flat_name: 'observer.ip', + level: 'core', + name: 'ip', + normalize: ['array'], + short: 'IP addresses of the observer.', + type: 'ip', + }, + 'observer.mac': { + dashed_name: 'observer-mac', + description: + 'MAC addresses of the observer.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]', + flat_name: 'observer.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: ['array'], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC addresses of the observer.', + type: 'keyword', + }, + 'observer.name': { + dashed_name: 'observer-name', + description: + 'Custom name of the observer.\nThis is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization.\nIf no custom name is needed, the field can be left empty.', + example: '1_proxySG', + flat_name: 'observer.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Custom name of the observer.', + type: 'keyword', + }, + 'observer.os.family': { + dashed_name: 'observer-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'observer.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'observer.os.full': { + dashed_name: 'observer-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'observer.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'observer.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'observer.os.kernel': { + dashed_name: 'observer-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'observer.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'observer.os.name': { + dashed_name: 'observer-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'observer.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'observer.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'observer.os.platform': { + dashed_name: 'observer-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'observer.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'observer.os.type': { + dashed_name: 'observer-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'observer.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'observer.os.version': { + dashed_name: 'observer-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'observer.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'observer.product': { + dashed_name: 'observer-product', + description: 'The product name of the observer.', + example: 's200', + flat_name: 'observer.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + short: 'The product name of the observer.', + type: 'keyword', + }, + 'observer.serial_number': { + dashed_name: 'observer-serial-number', + description: 'Observer serial number.', + flat_name: 'observer.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + short: 'Observer serial number.', + type: 'keyword', + }, + 'observer.type': { + dashed_name: 'observer-type', + description: + 'The type of the observer the data is coming from.\nThere is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.', + example: 'firewall', + flat_name: 'observer.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'The type of the observer the data is coming from.', + type: 'keyword', + }, + 'observer.vendor': { + dashed_name: 'observer-vendor', + description: 'Vendor name of the observer.', + example: 'Symantec', + flat_name: 'observer.vendor', + ignore_above: 1024, + level: 'core', + name: 'vendor', + normalize: [], + short: 'Vendor name of the observer.', + type: 'keyword', + }, + 'observer.version': { + dashed_name: 'observer-version', + description: 'Observer version.', + flat_name: 'observer.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Observer version.', + type: 'keyword', + }, + }, + group: 2, + name: 'observer', + nestings: [ + 'observer.egress.interface', + 'observer.egress.vlan', + 'observer.geo', + 'observer.ingress.interface', + 'observer.ingress.vlan', + 'observer.os', + ], + prefix: 'observer.', + reused_here: [ + { + full: 'observer.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'observer.ingress.interface', + schema_name: 'interface', + short: 'Fields to describe observer interface information.', + }, + { + full: 'observer.egress.interface', + schema_name: 'interface', + short: 'Fields to describe observer interface information.', + }, + { + full: 'observer.os', + schema_name: 'os', + short: 'OS fields contain information about the operating system.', + }, + { + full: 'observer.ingress.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + { + full: 'observer.egress.vlan', + schema_name: 'vlan', + short: 'Fields to describe observed VLAN information.', + }, + ], + short: 'Fields describing an entity observing the event from outside the host.', + title: 'Observer', + type: 'group', + }, + orchestrator: { + description: + 'Fields that describe the resources which container orchestrators manage or act upon.', + fields: { + 'orchestrator.api_version': { + dashed_name: 'orchestrator-api-version', + description: 'API version being used to carry out the action', + example: 'v1beta1', + flat_name: 'orchestrator.api_version', + ignore_above: 1024, + level: 'extended', + name: 'api_version', + normalize: [], + short: 'API version being used to carry out the action', + type: 'keyword', + }, + 'orchestrator.cluster.id': { + dashed_name: 'orchestrator-cluster-id', + description: 'Unique ID of the cluster.', + flat_name: 'orchestrator.cluster.id', + ignore_above: 1024, + level: 'extended', + name: 'cluster.id', + normalize: [], + short: 'Unique ID of the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.name': { + dashed_name: 'orchestrator-cluster-name', + description: 'Name of the cluster.', + flat_name: 'orchestrator.cluster.name', + ignore_above: 1024, + level: 'extended', + name: 'cluster.name', + normalize: [], + short: 'Name of the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.url': { + dashed_name: 'orchestrator-cluster-url', + description: 'URL of the API used to manage the cluster.', + flat_name: 'orchestrator.cluster.url', + ignore_above: 1024, + level: 'extended', + name: 'cluster.url', + normalize: [], + short: 'URL of the API used to manage the cluster.', + type: 'keyword', + }, + 'orchestrator.cluster.version': { + dashed_name: 'orchestrator-cluster-version', + description: 'The version of the cluster.', + flat_name: 'orchestrator.cluster.version', + ignore_above: 1024, + level: 'extended', + name: 'cluster.version', + normalize: [], + short: 'The version of the cluster.', + type: 'keyword', + }, + 'orchestrator.namespace': { + dashed_name: 'orchestrator-namespace', + description: 'Namespace in which the action is taking place.', + example: 'kube-system', + flat_name: 'orchestrator.namespace', + ignore_above: 1024, + level: 'extended', + name: 'namespace', + normalize: [], + short: 'Namespace in which the action is taking place.', + type: 'keyword', + }, + 'orchestrator.organization': { + dashed_name: 'orchestrator-organization', + description: 'Organization affected by the event (for multi-tenant orchestrator setups).', + example: 'elastic', + flat_name: 'orchestrator.organization', + ignore_above: 1024, + level: 'extended', + name: 'organization', + normalize: [], + short: 'Organization affected by the event (for multi-tenant orchestrator setups).', + type: 'keyword', + }, + 'orchestrator.resource.id': { + dashed_name: 'orchestrator-resource-id', + description: 'Unique ID of the resource being acted upon.', + flat_name: 'orchestrator.resource.id', + ignore_above: 1024, + level: 'extended', + name: 'resource.id', + normalize: [], + short: 'Unique ID of the resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.resource.ip': { + dashed_name: 'orchestrator-resource-ip', + description: + 'IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).', + flat_name: 'orchestrator.resource.ip', + level: 'extended', + name: 'resource.ip', + normalize: ['array'], + short: 'IP address assigned to the resource associated with the event being observed.', + type: 'ip', + }, + 'orchestrator.resource.name': { + dashed_name: 'orchestrator-resource-name', + description: 'Name of the resource being acted upon.', + example: 'test-pod-cdcws', + flat_name: 'orchestrator.resource.name', + ignore_above: 1024, + level: 'extended', + name: 'resource.name', + normalize: [], + short: 'Name of the resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.resource.parent.type': { + dashed_name: 'orchestrator-resource-parent-type', + description: + 'Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).', + example: 'DaemonSet', + flat_name: 'orchestrator.resource.parent.type', + ignore_above: 1024, + level: 'extended', + name: 'resource.parent.type', + normalize: [], + short: 'Type or kind of the parent resource associated with the event being observed.', + type: 'keyword', + }, + 'orchestrator.resource.type': { + dashed_name: 'orchestrator-resource-type', + description: 'Type of resource being acted upon.', + example: 'service', + flat_name: 'orchestrator.resource.type', + ignore_above: 1024, + level: 'extended', + name: 'resource.type', + normalize: [], + short: 'Type of resource being acted upon.', + type: 'keyword', + }, + 'orchestrator.type': { + dashed_name: 'orchestrator-type', + description: 'Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).', + example: 'kubernetes', + flat_name: 'orchestrator.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).', + type: 'keyword', + }, + }, + group: 2, + name: 'orchestrator', + prefix: 'orchestrator.', + short: 'Fields relevant to container orchestrators.', + title: 'Orchestrator', + type: 'group', + }, + organization: { + description: + 'The organization fields enrich data with information about the company or entity the data is associated with.\nThese fields help you arrange or filter data stored in an index by one or multiple organizations.', + fields: { + 'organization.id': { + dashed_name: 'organization-id', + description: 'Unique identifier for the organization.', + flat_name: 'organization.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Unique identifier for the organization.', + type: 'keyword', + }, + 'organization.name': { + dashed_name: 'organization-name', + description: 'Organization name.', + flat_name: 'organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Organization name.', + type: 'keyword', + }, + }, + group: 2, + name: 'organization', + prefix: 'organization.', + short: 'Fields describing the organization or company the event is associated with.', + title: 'Organization', + type: 'group', + }, + os: { + description: 'The OS fields contain information about the operating system.', + fields: { + 'os.family': { + dashed_name: 'os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'os.full': { + dashed_name: 'os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'os.full.text', name: 'text', type: 'match_only_text' }], + name: 'full', + normalize: [], + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'os.kernel': { + dashed_name: 'os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'os.name': { + dashed_name: 'os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [{ flat_name: 'os.name.text', name: 'text', type: 'match_only_text' }], + name: 'name', + normalize: [], + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'os.platform': { + dashed_name: 'os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'os.type': { + dashed_name: 'os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'os.version': { + dashed_name: 'os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + }, + group: 2, + name: 'os', + prefix: 'os.', + reusable: { + expected: [ + { as: 'os', at: 'observer', full: 'observer.os' }, + { as: 'os', at: 'host', full: 'host.os' }, + { as: 'os', at: 'user_agent', full: 'user_agent.os' }, + ], + top_level: false, + }, + short: 'OS fields contain information about the operating system.', + title: 'Operating System', + type: 'group', + }, + package: { + description: + 'These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.', + fields: { + 'package.architecture': { + dashed_name: 'package-architecture', + description: 'Package architecture.', + example: 'x86_64', + flat_name: 'package.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'Package architecture.', + type: 'keyword', + }, + 'package.build_version': { + dashed_name: 'package-build-version', + description: + 'Additional information about the build version of the installed package.\nFor example use the commit SHA of a non-released package.', + example: '36f4f7e89dd61b0988b12ee000b98966867710cd', + flat_name: 'package.build_version', + ignore_above: 1024, + level: 'extended', + name: 'build_version', + normalize: [], + short: 'Build version information', + type: 'keyword', + }, + 'package.checksum': { + dashed_name: 'package-checksum', + description: 'Checksum of the installed package for verification.', + example: '68b329da9893e34099c7d8ad5cb9c940', + flat_name: 'package.checksum', + ignore_above: 1024, + level: 'extended', + name: 'checksum', + normalize: [], + short: 'Checksum of the installed package for verification.', + type: 'keyword', + }, + 'package.description': { + dashed_name: 'package-description', + description: 'Description of the package.', + example: 'Open source programming language to build simple/reliable/efficient software.', + flat_name: 'package.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Description of the package.', + type: 'keyword', + }, + 'package.install_scope': { + dashed_name: 'package-install-scope', + description: 'Indicating how the package was installed, e.g. user-local, global.', + example: 'global', + flat_name: 'package.install_scope', + ignore_above: 1024, + level: 'extended', + name: 'install_scope', + normalize: [], + short: 'Indicating how the package was installed, e.g. user-local, global.', + type: 'keyword', + }, + 'package.installed': { + dashed_name: 'package-installed', + description: 'Time when package was installed.', + flat_name: 'package.installed', + level: 'extended', + name: 'installed', + normalize: [], + short: 'Time when package was installed.', + type: 'date', + }, + 'package.license': { + dashed_name: 'package-license', + description: + 'License under which the package was released.\nUse a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/).', + example: 'Apache License 2.0', + flat_name: 'package.license', + ignore_above: 1024, + level: 'extended', + name: 'license', + normalize: [], + short: 'Package license', + type: 'keyword', + }, + 'package.name': { + dashed_name: 'package-name', + description: 'Package name', + example: 'go', + flat_name: 'package.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Package name', + type: 'keyword', + }, + 'package.path': { + dashed_name: 'package-path', + description: 'Path where the package is installed.', + example: '/usr/local/Cellar/go/1.12.9/', + flat_name: 'package.path', + ignore_above: 1024, + level: 'extended', + name: 'path', + normalize: [], + short: 'Path where the package is installed.', + type: 'keyword', + }, + 'package.reference': { + dashed_name: 'package-reference', + description: 'Home page or reference URL of the software in this package, if available.', + example: 'https://golang.org', + flat_name: 'package.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Package home page or reference URL', + type: 'keyword', + }, + 'package.size': { + dashed_name: 'package-size', + description: 'Package size in bytes.', + example: 62231, + flat_name: 'package.size', + format: 'string', + level: 'extended', + name: 'size', + normalize: [], + short: 'Package size in bytes.', + type: 'long', + }, + 'package.type': { + dashed_name: 'package-type', + description: + 'Type of package.\nThis should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.', + example: 'rpm', + flat_name: 'package.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + short: 'Package type', + type: 'keyword', + }, + 'package.version': { + dashed_name: 'package-version', + description: 'Package version', + example: '1.12.9', + flat_name: 'package.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Package version', + type: 'keyword', + }, + }, + group: 2, + name: 'package', + prefix: 'package.', + short: 'These fields contain information about an installed software package.', + title: 'Package', + type: 'group', + }, + pe: { + description: 'These fields contain Windows Portable Executable (PE) metadata.', + fields: { + 'pe.architecture': { + dashed_name: 'pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'pe.company': { + dashed_name: 'pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'pe.description': { + dashed_name: 'pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'pe.file_version': { + dashed_name: 'pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + short: 'Process name.', + type: 'keyword', + }, + 'pe.imphash': { + dashed_name: 'pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'pe.original_file_name': { + dashed_name: 'pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'pe.pehash': { + dashed_name: 'pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'pe.product': { + dashed_name: 'pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + }, + group: 2, + name: 'pe', + prefix: 'pe.', + reusable: { + expected: [ + { as: 'pe', at: 'file', full: 'file.pe' }, + { as: 'pe', at: 'dll', full: 'dll.pe' }, + { as: 'pe', at: 'process', full: 'process.pe' }, + ], + top_level: false, + }, + short: 'These fields contain Windows Portable Executable (PE) metadata.', + title: 'PE Header', + type: 'group', + }, + process: { + description: + 'These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation.', + fields: { + 'process.args': { + dashed_name: 'process-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.args_count': { + dashed_name: 'process-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.code_signature.digest_algorithm': { + dashed_name: 'process-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'process.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.exists': { + dashed_name: 'process-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'process.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'process.code_signature.signing_id': { + dashed_name: 'process-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'process.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.status': { + dashed_name: 'process-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'process.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'process.code_signature.subject_name': { + dashed_name: 'process-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'process.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'process.code_signature.team_id': { + dashed_name: 'process-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'process.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'process.code_signature.timestamp': { + dashed_name: 'process-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'process.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'process.code_signature.trusted': { + dashed_name: 'process-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'process.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'process.code_signature.valid': { + dashed_name: 'process-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'process.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'process.command_line': { + dashed_name: 'process-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.elf.architecture': { + dashed_name: 'process-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'process.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'process.elf.byte_order': { + dashed_name: 'process-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'process.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'process.elf.cpu_type': { + dashed_name: 'process-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'process.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'process.elf.creation_date': { + dashed_name: 'process-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'process.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'process.elf.exports': { + dashed_name: 'process-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'process.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'process.elf.header.abi_version': { + dashed_name: 'process-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'process.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'process.elf.header.class': { + dashed_name: 'process-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'process.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'process.elf.header.data': { + dashed_name: 'process-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'process.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'process.elf.header.entrypoint': { + dashed_name: 'process-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'process.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'process.elf.header.object_version': { + dashed_name: 'process-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'process.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'process.elf.header.os_abi': { + dashed_name: 'process-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'process.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'process.elf.header.type': { + dashed_name: 'process-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'process.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'process.elf.header.version': { + dashed_name: 'process-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'process.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'process.elf.imports': { + dashed_name: 'process-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'process.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'process.elf.sections': { + dashed_name: 'process-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'process.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'process.elf.sections.chi2': { + dashed_name: 'process-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'process.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'process.elf.sections.entropy': { + dashed_name: 'process-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'process.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'process.elf.sections.flags': { + dashed_name: 'process-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'process.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'process.elf.sections.name': { + dashed_name: 'process-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'process.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'process.elf.sections.physical_offset': { + dashed_name: 'process-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'process.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'process.elf.sections.physical_size': { + dashed_name: 'process-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'process.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'process.elf.sections.type': { + dashed_name: 'process-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'process.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'process.elf.sections.virtual_address': { + dashed_name: 'process-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'process.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'process.elf.sections.virtual_size': { + dashed_name: 'process-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'process.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'process.elf.segments': { + dashed_name: 'process-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'process.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'process.elf.segments.sections': { + dashed_name: 'process-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'process.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'process.elf.segments.type': { + dashed_name: 'process-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'process.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'process.elf.shared_libraries': { + dashed_name: 'process-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'process.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'process.elf.telfhash': { + dashed_name: 'process-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'process.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'process.end': { + dashed_name: 'process-end', + description: 'The time the process ended.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.end', + level: 'extended', + name: 'end', + normalize: [], + short: 'The time the process ended.', + type: 'date', + }, + 'process.entity_id': { + dashed_name: 'process-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.args': { + dashed_name: 'process-entry-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.entry_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.entry_leader.args_count': { + dashed_name: 'process-entry-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.entry_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.entry_leader.attested_groups.name': { + dashed_name: 'process-entry-leader-attested-groups-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.attested_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.attested_user.id': { + dashed_name: 'process-entry-leader-attested-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.attested_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.attested_user.name': { + dashed_name: 'process-entry-leader-attested-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.attested_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.attested_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.command_line': { + dashed_name: 'process-entry-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.entry_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.entry_leader.entity_id': { + dashed_name: 'process-entry-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.entry_meta.source.ip': { + dashed_name: 'process-entry-leader-entry-meta-source-ip', + description: 'IP address of the source (IPv4 or IPv6).', + flat_name: 'process.entry_leader.entry_meta.source.ip', + level: 'core', + name: 'ip', + normalize: [], + original_fieldset: 'source', + short: 'IP address of the source.', + type: 'ip', + }, + 'process.entry_leader.entry_meta.type': { + dashed_name: 'process-entry-leader-entry-meta-type', + description: + 'The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader.', + flat_name: 'process.entry_leader.entry_meta.type', + ignore_above: 1024, + level: 'extended', + name: 'entry_meta.type', + normalize: [], + original_fieldset: 'process', + short: 'The entry type for the entry session leader.', + type: 'keyword', + }, + 'process.entry_leader.executable': { + dashed_name: 'process-entry-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.entry_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.entry_leader.group.id': { + dashed_name: 'process-entry-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.group.name': { + dashed_name: 'process-entry-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.interactive': { + dashed_name: 'process-entry-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.entry_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.entry_leader.name': { + dashed_name: 'process-entry-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.entry_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.entry_leader.parent.entity_id': { + dashed_name: 'process-entry-leader-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.parent.pid': { + dashed_name: 'process-entry-leader-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.parent.session_leader.entity_id': { + dashed_name: 'process-entry-leader-parent-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.entry_leader.parent.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.entry_leader.parent.session_leader.pid': { + dashed_name: 'process-entry-leader-parent-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.parent.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.parent.session_leader.start': { + dashed_name: 'process-entry-leader-parent-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.parent.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.parent.start': { + dashed_name: 'process-entry-leader-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.pid': { + dashed_name: 'process-entry-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.entry_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.entry_leader.real_group.id': { + dashed_name: 'process-entry-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.real_group.name': { + dashed_name: 'process-entry-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.real_user.id': { + dashed_name: 'process-entry-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.real_user.name': { + dashed_name: 'process-entry-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.same_as_process': { + dashed_name: 'process-entry-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.entry_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.entry_leader.saved_group.id': { + dashed_name: 'process-entry-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.saved_group.name': { + dashed_name: 'process-entry-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.saved_user.id': { + dashed_name: 'process-entry-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.saved_user.name': { + dashed_name: 'process-entry-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.start': { + dashed_name: 'process-entry-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.entry_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.entry_leader.supplemental_groups.id': { + dashed_name: 'process-entry-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.entry_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.entry_leader.supplemental_groups.name': { + dashed_name: 'process-entry-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.entry_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.entry_leader.tty': { + dashed_name: 'process-entry-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.entry_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.entry_leader.tty.char_device.major': { + dashed_name: 'process-entry-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.entry_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.entry_leader.tty.char_device.minor': { + dashed_name: 'process-entry-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.entry_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.entry_leader.user.id': { + dashed_name: 'process-entry-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.entry_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.entry_leader.user.name': { + dashed_name: 'process-entry-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.entry_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.entry_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.entry_leader.working_directory': { + dashed_name: 'process-entry-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.entry_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.entry_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.env_vars': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-env-vars', + description: + 'Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.', + example: '["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]', + flat_name: 'process.env_vars', + ignore_above: 1024, + level: 'extended', + name: 'env_vars', + normalize: ['array'], + short: 'Array of environment variable bindings.', + type: 'keyword', + }, + 'process.executable': { + dashed_name: 'process-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.exit_code': { + dashed_name: 'process-exit-code', + description: + 'The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).', + example: 137, + flat_name: 'process.exit_code', + level: 'extended', + name: 'exit_code', + normalize: [], + short: 'The exit code of the process.', + type: 'long', + }, + 'process.group_leader.args': { + dashed_name: 'process-group-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.group_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.group_leader.args_count': { + dashed_name: 'process-group-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.group_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.group_leader.command_line': { + dashed_name: 'process-group-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.group_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.group_leader.entity_id': { + dashed_name: 'process-group-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.group_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.group_leader.executable': { + dashed_name: 'process-group-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.group_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.group_leader.group.id': { + dashed_name: 'process-group-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.group.name': { + dashed_name: 'process-group-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.interactive': { + dashed_name: 'process-group-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.group_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.group_leader.name': { + dashed_name: 'process-group-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.group_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.group_leader.pid': { + dashed_name: 'process-group-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.group_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.group_leader.real_group.id': { + dashed_name: 'process-group-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.real_group.name': { + dashed_name: 'process-group-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.real_user.id': { + dashed_name: 'process-group-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.real_user.name': { + dashed_name: 'process-group-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.same_as_process': { + dashed_name: 'process-group-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.group_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.group_leader.saved_group.id': { + dashed_name: 'process-group-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.saved_group.name': { + dashed_name: 'process-group-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.saved_user.id': { + dashed_name: 'process-group-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.saved_user.name': { + dashed_name: 'process-group-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.start': { + dashed_name: 'process-group-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.group_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.group_leader.supplemental_groups.id': { + dashed_name: 'process-group-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.group_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.group_leader.supplemental_groups.name': { + dashed_name: 'process-group-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.group_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.group_leader.tty': { + dashed_name: 'process-group-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.group_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.group_leader.tty.char_device.major': { + dashed_name: 'process-group-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.group_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.group_leader.tty.char_device.minor': { + dashed_name: 'process-group-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.group_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.group_leader.user.id': { + dashed_name: 'process-group-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.group_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.group_leader.user.name': { + dashed_name: 'process-group-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.group_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.group_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.group_leader.working_directory': { + dashed_name: 'process-group-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.group_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.group_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.hash.md5': { + dashed_name: 'process-hash-md5', + description: 'MD5 hash.', + flat_name: 'process.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'process.hash.sha1': { + dashed_name: 'process-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'process.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'process.hash.sha256': { + dashed_name: 'process-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'process.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'process.hash.sha384': { + dashed_name: 'process-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'process.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'process.hash.sha512': { + dashed_name: 'process-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'process.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'process.hash.ssdeep': { + dashed_name: 'process-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'process.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'process.hash.tlsh': { + dashed_name: 'process-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'process.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'process.interactive': { + dashed_name: 'process-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.io': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io', + description: + 'A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input.', + flat_name: 'process.io', + level: 'extended', + name: 'io', + normalize: [], + short: 'A chunk of input or output (IO) from a single process.', + type: 'object', + }, + 'process.io.bytes_skipped': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped', + description: + 'An array of byte offsets and lengths denoting where IO data has been skipped.', + flat_name: 'process.io.bytes_skipped', + level: 'extended', + name: 'io.bytes_skipped', + normalize: ['array'], + short: 'An array of byte offsets and lengths denoting where IO data has been skipped.', + type: 'object', + }, + 'process.io.bytes_skipped.length': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped-length', + description: 'The length of bytes skipped.', + flat_name: 'process.io.bytes_skipped.length', + level: 'extended', + name: 'io.bytes_skipped.length', + normalize: [], + short: 'The length of bytes skipped.', + type: 'long', + }, + 'process.io.bytes_skipped.offset': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-bytes-skipped-offset', + description: + "The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.", + flat_name: 'process.io.bytes_skipped.offset', + level: 'extended', + name: 'io.bytes_skipped.offset', + normalize: [], + short: + "The byte offset into this event's io.text (or io.bytes in the future) where length bytes were skipped.", + type: 'long', + }, + 'process.io.max_bytes_per_process_exceeded': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-max-bytes-per-process-exceeded', + description: + 'If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.', + flat_name: 'process.io.max_bytes_per_process_exceeded', + level: 'extended', + name: 'io.max_bytes_per_process_exceeded', + normalize: [], + short: + 'If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.', + type: 'boolean', + }, + 'process.io.text': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-text', + description: + 'A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.', + flat_name: 'process.io.text', + level: 'extended', + name: 'io.text', + normalize: [], + short: 'A chunk of output or input sanitized to UTF-8.', + type: 'wildcard', + }, + 'process.io.total_bytes_captured': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-total-bytes-captured', + description: 'The total number of bytes captured in this event.', + flat_name: 'process.io.total_bytes_captured', + level: 'extended', + name: 'io.total_bytes_captured', + normalize: [], + short: 'The total number of bytes captured in this event.', + type: 'long', + }, + 'process.io.total_bytes_skipped': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-total-bytes-skipped', + description: + 'The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero', + flat_name: 'process.io.total_bytes_skipped', + level: 'extended', + name: 'io.total_bytes_skipped', + normalize: [], + short: + 'The total number of bytes that were not captured due to implementation restrictions such as buffer size limits.', + type: 'long', + }, + 'process.io.type': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-io-type', + description: + "The type of object on which the IO action (read or write) was taken.\nCurrently only 'tty' is supported. Other types may be added in the future for 'file' and 'socket' support.", + flat_name: 'process.io.type', + ignore_above: 1024, + level: 'extended', + name: 'io.type', + normalize: [], + short: 'The type of object on which the IO action (read or write) was taken.', + type: 'keyword', + }, + 'process.name': { + dashed_name: 'process-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.args': { + dashed_name: 'process-parent-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.parent.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.parent.args_count': { + dashed_name: 'process-parent-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.parent.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.parent.code_signature.digest_algorithm': { + dashed_name: 'process-parent-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'process.parent.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.exists': { + dashed_name: 'process-parent-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'process.parent.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'process.parent.code_signature.signing_id': { + dashed_name: 'process-parent-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'process.parent.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.status': { + dashed_name: 'process-parent-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'process.parent.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'process.parent.code_signature.subject_name': { + dashed_name: 'process-parent-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'process.parent.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'process.parent.code_signature.team_id': { + dashed_name: 'process-parent-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'process.parent.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'process.parent.code_signature.timestamp': { + dashed_name: 'process-parent-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'process.parent.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'process.parent.code_signature.trusted': { + dashed_name: 'process-parent-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'process.parent.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'process.parent.code_signature.valid': { + dashed_name: 'process-parent-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'process.parent.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'process.parent.command_line': { + dashed_name: 'process-parent-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.parent.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.parent.elf.architecture': { + dashed_name: 'process-parent-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'process.parent.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.byte_order': { + dashed_name: 'process-parent-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'process.parent.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'process.parent.elf.cpu_type': { + dashed_name: 'process-parent-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'process.parent.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.creation_date': { + dashed_name: 'process-parent-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'process.parent.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'process.parent.elf.exports': { + dashed_name: 'process-parent-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'process.parent.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'process.parent.elf.header.abi_version': { + dashed_name: 'process-parent-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'process.parent.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'process.parent.elf.header.class': { + dashed_name: 'process-parent-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'process.parent.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.header.data': { + dashed_name: 'process-parent-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'process.parent.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'process.parent.elf.header.entrypoint': { + dashed_name: 'process-parent-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'process.parent.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'process.parent.elf.header.object_version': { + dashed_name: 'process-parent-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'process.parent.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'process.parent.elf.header.os_abi': { + dashed_name: 'process-parent-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'process.parent.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'process.parent.elf.header.type': { + dashed_name: 'process-parent-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'process.parent.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'process.parent.elf.header.version': { + dashed_name: 'process-parent-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'process.parent.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'process.parent.elf.imports': { + dashed_name: 'process-parent-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'process.parent.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'process.parent.elf.sections': { + dashed_name: 'process-parent-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'process.parent.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'process.parent.elf.sections.chi2': { + dashed_name: 'process-parent-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'process.parent.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'process.parent.elf.sections.entropy': { + dashed_name: 'process-parent-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'process.parent.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'process.parent.elf.sections.flags': { + dashed_name: 'process-parent-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'process.parent.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'process.parent.elf.sections.name': { + dashed_name: 'process-parent-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'process.parent.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'process.parent.elf.sections.physical_offset': { + dashed_name: 'process-parent-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'process.parent.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'process.parent.elf.sections.physical_size': { + dashed_name: 'process-parent-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'process.parent.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'process.parent.elf.sections.type': { + dashed_name: 'process-parent-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'process.parent.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'process.parent.elf.sections.virtual_address': { + dashed_name: 'process-parent-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'process.parent.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'process.parent.elf.sections.virtual_size': { + dashed_name: 'process-parent-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'process.parent.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'process.parent.elf.segments': { + dashed_name: 'process-parent-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'process.parent.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'process.parent.elf.segments.sections': { + dashed_name: 'process-parent-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'process.parent.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'process.parent.elf.segments.type': { + dashed_name: 'process-parent-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'process.parent.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'process.parent.elf.shared_libraries': { + dashed_name: 'process-parent-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'process.parent.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'process.parent.elf.telfhash': { + dashed_name: 'process-parent-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'process.parent.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'process.parent.end': { + dashed_name: 'process-parent-end', + description: 'The time the process ended.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.end', + level: 'extended', + name: 'end', + normalize: [], + original_fieldset: 'process', + short: 'The time the process ended.', + type: 'date', + }, + 'process.parent.entity_id': { + dashed_name: 'process-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.parent.executable': { + dashed_name: 'process-parent-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.parent.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.parent.exit_code': { + dashed_name: 'process-parent-exit-code', + description: + 'The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).', + example: 137, + flat_name: 'process.parent.exit_code', + level: 'extended', + name: 'exit_code', + normalize: [], + original_fieldset: 'process', + short: 'The exit code of the process.', + type: 'long', + }, + 'process.parent.group.id': { + dashed_name: 'process-parent-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.group.name': { + dashed_name: 'process-parent-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.group_leader.entity_id': { + dashed_name: 'process-parent-group-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.parent.group_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.parent.group_leader.pid': { + dashed_name: 'process-parent-group-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.parent.group_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.parent.group_leader.start': { + dashed_name: 'process-parent-group-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.group_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.parent.hash.md5': { + dashed_name: 'process-parent-hash-md5', + description: 'MD5 hash.', + flat_name: 'process.parent.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha1': { + dashed_name: 'process-parent-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'process.parent.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha256': { + dashed_name: 'process-parent-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'process.parent.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha384': { + dashed_name: 'process-parent-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'process.parent.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'process.parent.hash.sha512': { + dashed_name: 'process-parent-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'process.parent.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'process.parent.hash.ssdeep': { + dashed_name: 'process-parent-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'process.parent.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'process.parent.hash.tlsh': { + dashed_name: 'process-parent-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'process.parent.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'process.parent.interactive': { + dashed_name: 'process-parent-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.parent.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.parent.name': { + dashed_name: 'process-parent-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.parent.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.pe.architecture': { + dashed_name: 'process-parent-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'process.parent.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'process.parent.pe.company': { + dashed_name: 'process-parent-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'process.parent.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.description': { + dashed_name: 'process-parent-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'process.parent.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.file_version': { + dashed_name: 'process-parent-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'process.parent.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'process.parent.pe.imphash': { + dashed_name: 'process-parent-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'process.parent.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'process.parent.pe.original_file_name': { + dashed_name: 'process-parent-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'process.parent.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pe.pehash': { + dashed_name: 'process-parent-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'process.parent.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'process.parent.pe.product': { + dashed_name: 'process-parent-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'process.parent.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.parent.pgid': { + dashed_name: 'process-parent-pgid', + description: + 'Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.', + flat_name: 'process.parent.pgid', + format: 'string', + level: 'extended', + name: 'pgid', + normalize: [], + original_fieldset: 'process', + short: 'Deprecated identifier of the group of processes the process belongs to.', + type: 'long', + }, + 'process.parent.pid': { + dashed_name: 'process-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.parent.real_group.id': { + dashed_name: 'process-parent-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.real_group.name': { + dashed_name: 'process-parent-real-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.real_user.id': { + dashed_name: 'process-parent-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.real_user.name': { + dashed_name: 'process-parent-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.saved_group.id': { + dashed_name: 'process-parent-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.saved_group.name': { + dashed_name: 'process-parent-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.parent.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.saved_user.id': { + dashed_name: 'process-parent-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.saved_user.name': { + dashed_name: 'process-parent-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.start': { + dashed_name: 'process-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.parent.supplemental_groups.id': { + dashed_name: 'process-parent-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.parent.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.parent.supplemental_groups.name': { + dashed_name: 'process-parent-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.parent.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.parent.thread.id': { + dashed_name: 'process-parent-thread-id', + description: 'Thread ID.', + example: 4242, + flat_name: 'process.parent.thread.id', + format: 'string', + level: 'extended', + name: 'thread.id', + normalize: [], + original_fieldset: 'process', + short: 'Thread ID.', + type: 'long', + }, + 'process.parent.thread.name': { + dashed_name: 'process-parent-thread-name', + description: 'Thread name.', + example: 'thread-0', + flat_name: 'process.parent.thread.name', + ignore_above: 1024, + level: 'extended', + name: 'thread.name', + normalize: [], + original_fieldset: 'process', + short: 'Thread name.', + type: 'keyword', + }, + 'process.parent.title': { + dashed_name: 'process-parent-title', + description: + 'Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.', + flat_name: 'process.parent.title', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.title.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'title', + normalize: [], + original_fieldset: 'process', + short: 'Process title.', + type: 'keyword', + }, + 'process.parent.tty': { + dashed_name: 'process-parent-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.parent.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.parent.tty.char_device.major': { + dashed_name: 'process-parent-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.parent.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.parent.tty.char_device.minor': { + dashed_name: 'process-parent-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.parent.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.parent.uptime': { + dashed_name: 'process-parent-uptime', + description: 'Seconds the process has been up.', + example: 1325, + flat_name: 'process.parent.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + original_fieldset: 'process', + short: 'Seconds the process has been up.', + type: 'long', + }, + 'process.parent.user.id': { + dashed_name: 'process-parent-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.parent.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.parent.user.name': { + dashed_name: 'process-parent-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.parent.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.parent.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.parent.working_directory': { + dashed_name: 'process-parent-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.parent.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.parent.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.pe.architecture': { + dashed_name: 'process-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'process.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'process.pe.company': { + dashed_name: 'process-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'process.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.description': { + dashed_name: 'process-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'process.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.file_version': { + dashed_name: 'process-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'process.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'process.pe.imphash': { + dashed_name: 'process-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'process.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'process.pe.original_file_name': { + dashed_name: 'process-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'process.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pe.pehash': { + dashed_name: 'process-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'process.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'process.pe.product': { + dashed_name: 'process-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'process.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'process.pgid': { + dashed_name: 'process-pgid', + description: + 'Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.', + flat_name: 'process.pgid', + format: 'string', + level: 'extended', + name: 'pgid', + normalize: [], + short: 'Deprecated identifier of the group of processes the process belongs to.', + type: 'long', + }, + 'process.pid': { + dashed_name: 'process-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + short: 'Process id.', + type: 'long', + }, + 'process.previous.args': { + dashed_name: 'process-previous-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.previous.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.previous.args_count': { + dashed_name: 'process-previous-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.previous.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.previous.executable': { + dashed_name: 'process-previous-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.previous.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.previous.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.real_group.id': { + dashed_name: 'process-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.real_group.name': { + dashed_name: 'process-real-group-name', + description: 'Name of the group.', + flat_name: 'process.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.real_user.id': { + dashed_name: 'process-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.real_user.name': { + dashed_name: 'process-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.saved_group.id': { + dashed_name: 'process-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.saved_group.name': { + dashed_name: 'process-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.saved_user.id': { + dashed_name: 'process-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.saved_user.name': { + dashed_name: 'process-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.args': { + dashed_name: 'process-session-leader-args', + description: + 'Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.', + example: '["/usr/bin/ssh", "-l", "user", "10.0.0.16"]', + flat_name: 'process.session_leader.args', + ignore_above: 1024, + level: 'extended', + name: 'args', + normalize: ['array'], + original_fieldset: 'process', + short: 'Array of process arguments.', + type: 'keyword', + }, + 'process.session_leader.args_count': { + dashed_name: 'process-session-leader-args-count', + description: + 'Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.', + example: 4, + flat_name: 'process.session_leader.args_count', + level: 'extended', + name: 'args_count', + normalize: [], + original_fieldset: 'process', + short: 'Length of the process.args array.', + type: 'long', + }, + 'process.session_leader.command_line': { + dashed_name: 'process-session-leader-command-line', + description: + 'Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.', + example: '/usr/bin/ssh -l user 10.0.0.16', + flat_name: 'process.session_leader.command_line', + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.command_line.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'command_line', + normalize: [], + original_fieldset: 'process', + short: 'Full command line that started the process.', + type: 'wildcard', + }, + 'process.session_leader.entity_id': { + dashed_name: 'process-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.executable': { + dashed_name: 'process-session-leader-executable', + description: 'Absolute path to the process executable.', + example: '/usr/bin/ssh', + flat_name: 'process.session_leader.executable', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.executable.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'executable', + normalize: [], + original_fieldset: 'process', + short: 'Absolute path to the process executable.', + type: 'keyword', + }, + 'process.session_leader.group.id': { + dashed_name: 'process-session-leader-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.group.name': { + dashed_name: 'process-session-leader-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.interactive': { + dashed_name: 'process-session-leader-interactive', + description: + 'Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.', + example: true, + flat_name: 'process.session_leader.interactive', + level: 'extended', + name: 'interactive', + normalize: [], + original_fieldset: 'process', + short: 'Whether the process is connected to an interactive shell.', + type: 'boolean', + }, + 'process.session_leader.name': { + dashed_name: 'process-session-leader-name', + description: 'Process name.\nSometimes called program name or similar.', + example: 'ssh', + flat_name: 'process.session_leader.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'process', + short: 'Process name.', + type: 'keyword', + }, + 'process.session_leader.parent.entity_id': { + dashed_name: 'process-session-leader-parent-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.parent.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.parent.pid': { + dashed_name: 'process-session-leader-parent-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.parent.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.parent.session_leader.entity_id': { + dashed_name: 'process-session-leader-parent-session-leader-entity-id', + description: + 'Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.', + example: 'c2c455d9f99375d', + flat_name: 'process.session_leader.parent.session_leader.entity_id', + ignore_above: 1024, + level: 'extended', + name: 'entity_id', + normalize: [], + original_fieldset: 'process', + short: 'Unique identifier for the process.', + type: 'keyword', + }, + 'process.session_leader.parent.session_leader.pid': { + dashed_name: 'process-session-leader-parent-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.parent.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.parent.session_leader.start': { + dashed_name: 'process-session-leader-parent-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.parent.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.parent.start': { + dashed_name: 'process-session-leader-parent-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.parent.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.pid': { + dashed_name: 'process-session-leader-pid', + description: 'Process id.', + example: 4242, + flat_name: 'process.session_leader.pid', + format: 'string', + level: 'core', + name: 'pid', + normalize: [], + original_fieldset: 'process', + short: 'Process id.', + type: 'long', + }, + 'process.session_leader.real_group.id': { + dashed_name: 'process-session-leader-real-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.real_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.real_group.name': { + dashed_name: 'process-session-leader-real-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.real_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.real_user.id': { + dashed_name: 'process-session-leader-real-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.real_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.real_user.name': { + dashed_name: 'process-session-leader-real-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.real_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.real_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.same_as_process': { + dashed_name: 'process-session-leader-same-as-process', + description: + "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.", + example: true, + flat_name: 'process.session_leader.same_as_process', + level: 'extended', + name: 'same_as_process', + normalize: [], + original_fieldset: 'process', + short: + 'This boolean is used to identify if a leader process is the same as the top level process.', + type: 'boolean', + }, + 'process.session_leader.saved_group.id': { + dashed_name: 'process-session-leader-saved-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.saved_group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.saved_group.name': { + dashed_name: 'process-session-leader-saved-group-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.saved_group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.saved_user.id': { + dashed_name: 'process-session-leader-saved-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.saved_user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.saved_user.name': { + dashed_name: 'process-session-leader-saved-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.saved_user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.saved_user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.start': { + dashed_name: 'process-session-leader-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.session_leader.start', + level: 'extended', + name: 'start', + normalize: [], + original_fieldset: 'process', + short: 'The time the process started.', + type: 'date', + }, + 'process.session_leader.supplemental_groups.id': { + dashed_name: 'process-session-leader-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.session_leader.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.session_leader.supplemental_groups.name': { + dashed_name: 'process-session-leader-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.session_leader.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.session_leader.tty': { + dashed_name: 'process-session-leader-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.session_leader.tty', + level: 'extended', + name: 'tty', + normalize: [], + original_fieldset: 'process', + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.session_leader.tty.char_device.major': { + dashed_name: 'process-session-leader-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.session_leader.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.session_leader.tty.char_device.minor': { + dashed_name: 'process-session-leader-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.session_leader.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + original_fieldset: 'process', + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.session_leader.user.id': { + dashed_name: 'process-session-leader-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.session_leader.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.session_leader.user.name': { + dashed_name: 'process-session-leader-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.session_leader.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.session_leader.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.session_leader.working_directory': { + dashed_name: 'process-session-leader-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.session_leader.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.session_leader.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + original_fieldset: 'process', + short: 'The working directory of the process.', + type: 'keyword', + }, + 'process.start': { + dashed_name: 'process-start', + description: 'The time the process started.', + example: '2016-05-23T08:05:34.853Z', + flat_name: 'process.start', + level: 'extended', + name: 'start', + normalize: [], + short: 'The time the process started.', + type: 'date', + }, + 'process.supplemental_groups.id': { + dashed_name: 'process-supplemental-groups-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'process.supplemental_groups.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'process.supplemental_groups.name': { + dashed_name: 'process-supplemental-groups-name', + description: 'Name of the group.', + flat_name: 'process.supplemental_groups.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'process.thread.id': { + dashed_name: 'process-thread-id', + description: 'Thread ID.', + example: 4242, + flat_name: 'process.thread.id', + format: 'string', + level: 'extended', + name: 'thread.id', + normalize: [], + short: 'Thread ID.', + type: 'long', + }, + 'process.thread.name': { + dashed_name: 'process-thread-name', + description: 'Thread name.', + example: 'thread-0', + flat_name: 'process.thread.name', + ignore_above: 1024, + level: 'extended', + name: 'thread.name', + normalize: [], + short: 'Thread name.', + type: 'keyword', + }, + 'process.title': { + dashed_name: 'process-title', + description: + 'Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.', + flat_name: 'process.title', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.title.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'title', + normalize: [], + short: 'Process title.', + type: 'keyword', + }, + 'process.tty': { + dashed_name: 'process-tty', + description: + 'Information about the controlling TTY device. If set, the process belongs to an interactive session.', + flat_name: 'process.tty', + level: 'extended', + name: 'tty', + normalize: [], + short: 'Information about the controlling TTY device.', + type: 'object', + }, + 'process.tty.char_device.major': { + dashed_name: 'process-tty-char-device-major', + description: + 'The major number identifies the driver associated with the device. The character device\'s major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.', + example: 4, + flat_name: 'process.tty.char_device.major', + level: 'extended', + name: 'tty.char_device.major', + normalize: [], + short: "The TTY character device's major number.", + type: 'long', + }, + 'process.tty.char_device.minor': { + dashed_name: 'process-tty-char-device-minor', + description: + 'The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.', + example: 1, + flat_name: 'process.tty.char_device.minor', + level: 'extended', + name: 'tty.char_device.minor', + normalize: [], + short: "The TTY character device's minor number.", + type: 'long', + }, + 'process.tty.columns': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-tty-columns', + description: + "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'", + example: 80, + flat_name: 'process.tty.columns', + level: 'extended', + name: 'tty.columns', + normalize: [], + short: 'The number of character columns per line. e.g terminal width', + type: 'long', + }, + 'process.tty.rows': { + beta: 'This field is beta and subject to change.', + dashed_name: 'process-tty-rows', + description: + "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'", + example: 24, + flat_name: 'process.tty.rows', + level: 'extended', + name: 'tty.rows', + normalize: [], + short: 'The number of character rows in the terminal. e.g terminal height', + type: 'long', + }, + 'process.uptime': { + dashed_name: 'process-uptime', + description: 'Seconds the process has been up.', + example: 1325, + flat_name: 'process.uptime', + level: 'extended', + name: 'uptime', + normalize: [], + short: 'Seconds the process has been up.', + type: 'long', + }, + 'process.user.id': { + dashed_name: 'process-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'process.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'process.user.name': { + dashed_name: 'process-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'process.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'process.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'process.working_directory': { + dashed_name: 'process-working-directory', + description: 'The working directory of the process.', + example: '/home/alice', + flat_name: 'process.working_directory', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'process.working_directory.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'working_directory', + normalize: [], + short: 'The working directory of the process.', + type: 'keyword', + }, + }, + group: 2, + name: 'process', + nestings: [ + 'process.attested_groups', + 'process.attested_user', + 'process.code_signature', + 'process.elf', + 'process.entry_leader', + 'process.entry_leader.parent', + 'process.entry_leader.parent.session_leader', + 'process.entry_meta.source', + 'process.group', + 'process.group_leader', + 'process.hash', + 'process.parent', + 'process.parent.group_leader', + 'process.pe', + 'process.previous', + 'process.real_group', + 'process.real_user', + 'process.saved_group', + 'process.saved_user', + 'process.session_leader', + 'process.session_leader.parent', + 'process.session_leader.parent.session_leader', + 'process.supplemental_groups', + 'process.user', + ], + prefix: 'process.', + reusable: { + expected: [ + { + as: 'parent', + at: 'process', + full: 'process.parent', + short_override: 'Information about the parent process.', + }, + { + as: 'entry_leader', + at: 'process', + full: 'process.entry_leader', + short_override: + 'First process from terminal or remote access via SSH, SSM, etc OR a service directly started by the init process.', + }, + { + as: 'session_leader', + at: 'process', + full: 'process.session_leader', + short_override: + 'Often the same as entry_leader. When it differs, it represents a session started within another session. e.g. using tmux', + }, + { + as: 'group_leader', + at: 'process', + full: 'process.group_leader', + short_override: + 'Information about the process group leader. In some cases this may be the same as the top level process.', + }, + { + as: 'group_leader', + at: 'process.parent', + full: 'process.parent.group_leader', + short_override: + "Information about the parent's process group leader. Only pid, start and entity_id fields are set.", + }, + { + as: 'parent', + at: 'process.entry_leader', + full: 'process.entry_leader.parent', + short_override: + "Information about the entry leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + as: 'parent', + at: 'process.session_leader', + full: 'process.session_leader.parent', + short_override: + "Information about the session leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + as: 'session_leader', + at: 'process.entry_leader.parent', + full: 'process.entry_leader.parent.session_leader', + short_override: + 'Information about the parent session of the entry leader. Only pid, start and entity_id fields are set.', + }, + { + as: 'session_leader', + at: 'process.session_leader.parent', + full: 'process.session_leader.parent.session_leader', + short_override: + 'Information about the parent session of the session leader. Only pid, start and entity_id fields are set.', + }, + { + as: 'previous', + at: 'process', + full: 'process.previous', + normalize: ['array'], + short_override: + 'An array of previous executions for the process, including the initial fork. Only executable and args are set.', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'process.group', + schema_name: 'group', + short: 'The effective group (egid).', + }, + { + full: 'process.real_group', + schema_name: 'group', + short: 'The real group (rgid).', + }, + { + full: 'process.saved_group', + schema_name: 'group', + short: 'The saved group (sgid).', + }, + { + full: 'process.supplemental_groups', + normalize: ['array'], + schema_name: 'group', + short: 'An array of supplemental groups.', + }, + { + beta: 'Reusing the `group` fields in this location is currently considered beta.', + full: 'process.attested_groups', + normalize: ['array'], + schema_name: 'group', + short: 'The externally attested groups based on an external source such as the Kube API.', + }, + { + full: 'process.hash', + schema_name: 'hash', + short: 'Hashes, usually file hashes.', + }, + { + full: 'process.pe', + schema_name: 'pe', + short: 'These fields contain Windows Portable Executable (PE) metadata.', + }, + { + full: 'process.code_signature', + schema_name: 'code_signature', + short: 'These fields contain information about binary code signatures.', + }, + { + beta: 'This field reuse is beta and subject to change.', + full: 'process.elf', + schema_name: 'elf', + short: 'These fields contain Linux Executable Linkable Format (ELF) metadata.', + }, + { + full: 'process.entry_meta.source', + schema_name: 'source', + short: 'Remote client information such as ip, port and geo location.', + }, + { + full: 'process.user', + schema_name: 'user', + short: 'The effective user (euid).', + }, + { + full: 'process.saved_user', + schema_name: 'user', + short: 'The saved user (suid).', + }, + { + full: 'process.real_user', + schema_name: 'user', + short: 'The real user (ruid). Identifies the real owner of the process.', + }, + { + beta: 'Reusing the `user` fields in this location is currently considered beta.', + full: 'process.attested_user', + schema_name: 'user', + short: 'The externally attested user based on an external source such as the Kube API.', + }, + { + full: 'process.parent', + schema_name: 'process', + short: 'Information about the parent process.', + }, + { + full: 'process.entry_leader', + schema_name: 'process', + short: + 'First process from terminal or remote access via SSH, SSM, etc OR a service directly started by the init process.', + }, + { + full: 'process.session_leader', + schema_name: 'process', + short: + 'Often the same as entry_leader. When it differs, it represents a session started within another session. e.g. using tmux', + }, + { + full: 'process.group_leader', + schema_name: 'process', + short: + 'Information about the process group leader. In some cases this may be the same as the top level process.', + }, + { + full: 'process.parent.group_leader', + schema_name: 'process', + short: + "Information about the parent's process group leader. Only pid, start and entity_id fields are set.", + }, + { + full: 'process.entry_leader.parent', + schema_name: 'process', + short: + "Information about the entry leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + full: 'process.session_leader.parent', + schema_name: 'process', + short: + "Information about the session leader's parent process. Only pid, start and entity_id fields are set.", + }, + { + full: 'process.entry_leader.parent.session_leader', + schema_name: 'process', + short: + 'Information about the parent session of the entry leader. Only pid, start and entity_id fields are set.', + }, + { + full: 'process.session_leader.parent.session_leader', + schema_name: 'process', + short: + 'Information about the parent session of the session leader. Only pid, start and entity_id fields are set.', + }, + { + full: 'process.previous', + normalize: ['array'], + schema_name: 'process', + short: + 'An array of previous executions for the process, including the initial fork. Only executable and args are set.', + }, + ], + short: 'These fields contain information about a process.', + title: 'Process', + type: 'group', + }, + registry: { + description: 'Fields related to Windows Registry operations.', + fields: { + 'registry.data.bytes': { + dashed_name: 'registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'registry.data.strings': { + dashed_name: 'registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'registry.data.type': { + dashed_name: 'registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'registry.hive': { + dashed_name: 'registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'registry.key': { + dashed_name: 'registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'registry.path': { + dashed_name: 'registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'registry.value': { + dashed_name: 'registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + short: 'Name of the value written.', + type: 'keyword', + }, + }, + group: 2, + name: 'registry', + prefix: 'registry.', + reusable: { + expected: [ + { + as: 'registry', + at: 'threat.indicator', + full: 'threat.indicator.registry', + }, + { + as: 'registry', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.registry', + }, + ], + top_level: true, + }, + short: 'Fields related to Windows Registry operations.', + title: 'Registry', + type: 'group', + }, + related: { + description: + 'This field set is meant to facilitate pivoting around a piece of data.\nSome pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`.\nA concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`.', + fields: { + 'related.hash': { + dashed_name: 'related-hash', + description: + "All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search).", + flat_name: 'related.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: ['array'], + short: 'All the hashes seen on your event.', + type: 'keyword', + }, + 'related.hosts': { + dashed_name: 'related-hosts', + description: + 'All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases.', + flat_name: 'related.hosts', + ignore_above: 1024, + level: 'extended', + name: 'hosts', + normalize: ['array'], + short: 'All the host identifiers seen on your event.', + type: 'keyword', + }, + 'related.ip': { + dashed_name: 'related-ip', + description: 'All of the IPs seen on your event.', + flat_name: 'related.ip', + level: 'extended', + name: 'ip', + normalize: ['array'], + short: 'All of the IPs seen on your event.', + type: 'ip', + }, + 'related.user': { + dashed_name: 'related-user', + description: 'All the user names or other user identifiers seen on the event.', + flat_name: 'related.user', + ignore_above: 1024, + level: 'extended', + name: 'user', + normalize: ['array'], + short: 'All the user names or other user identifiers seen on the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'related', + prefix: 'related.', + short: 'Fields meant to facilitate pivoting around a piece of data.', + title: 'Related', + type: 'group', + }, + risk: { + beta: 'These fields are in beta and are subject to change.', + description: + 'Fields for describing risk score and risk level of entities such as hosts and users. These fields are not allowed to be nested under `event.*`. Please continue to use `event.risk_score` and `event.risk_score_norm` for event risk.', + fields: { + 'risk.calculated_level': { + dashed_name: 'risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'risk.calculated_score': { + dashed_name: 'risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'risk.calculated_score_norm': { + dashed_name: 'risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'risk.static_level': { + dashed_name: 'risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'risk.static_score': { + dashed_name: 'risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'risk.static_score_norm': { + dashed_name: 'risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + }, + group: 2, + name: 'risk', + prefix: 'risk.', + reusable: { + expected: [ + { as: 'risk', at: 'host', full: 'host.risk' }, + { as: 'risk', at: 'user', full: 'user.risk' }, + ], + top_level: false, + }, + short: 'Fields for describing risk score and level.', + title: 'Risk information', + type: 'group', + }, + rule: { + description: + 'Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.', + fields: { + 'rule.author': { + dashed_name: 'rule-author', + description: + 'Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.', + example: '["Star-Lord"]', + flat_name: 'rule.author', + ignore_above: 1024, + level: 'extended', + name: 'author', + normalize: ['array'], + short: 'Rule author', + type: 'keyword', + }, + 'rule.category': { + dashed_name: 'rule-category', + description: + 'A categorization value keyword used by the entity using the rule for detection of this event.', + example: 'Attempted Information Leak', + flat_name: 'rule.category', + ignore_above: 1024, + level: 'extended', + name: 'category', + normalize: [], + short: 'Rule category', + type: 'keyword', + }, + 'rule.description': { + dashed_name: 'rule-description', + description: 'The description of the rule generating the event.', + example: 'Block requests to public DNS over HTTPS / TLS protocols', + flat_name: 'rule.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + short: 'Rule description', + type: 'keyword', + }, + 'rule.id': { + dashed_name: 'rule-id', + description: + 'A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.', + example: 101, + flat_name: 'rule.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'Rule ID', + type: 'keyword', + }, + 'rule.license': { + dashed_name: 'rule-license', + description: + 'Name of the license under which the rule used to generate this event is made available.', + example: 'Apache 2.0', + flat_name: 'rule.license', + ignore_above: 1024, + level: 'extended', + name: 'license', + normalize: [], + short: 'Rule license', + type: 'keyword', + }, + 'rule.name': { + dashed_name: 'rule-name', + description: 'The name of the rule or signature generating the event.', + example: 'BLOCK_DNS_over_TLS', + flat_name: 'rule.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Rule name', + type: 'keyword', + }, + 'rule.reference': { + dashed_name: 'rule-reference', + description: + "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.", + example: 'https://en.wikipedia.org/wiki/DNS_over_TLS', + flat_name: 'rule.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Rule reference URL', + type: 'keyword', + }, + 'rule.ruleset': { + dashed_name: 'rule-ruleset', + description: + 'Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.', + example: 'Standard_Protocol_Filters', + flat_name: 'rule.ruleset', + ignore_above: 1024, + level: 'extended', + name: 'ruleset', + normalize: [], + short: 'Rule ruleset', + type: 'keyword', + }, + 'rule.uuid': { + dashed_name: 'rule-uuid', + description: + 'A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.', + example: 1100110011, + flat_name: 'rule.uuid', + ignore_above: 1024, + level: 'extended', + name: 'uuid', + normalize: [], + short: 'Rule UUID', + type: 'keyword', + }, + 'rule.version': { + dashed_name: 'rule-version', + description: 'The version / revision of the rule being used for analysis.', + example: 1.1, + flat_name: 'rule.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Rule version', + type: 'keyword', + }, + }, + group: 2, + name: 'rule', + prefix: 'rule.', + short: 'Fields to capture details about rules used to generate alerts or other notable events.', + title: 'Rule', + type: 'group', + }, + server: { + description: + 'A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records.\nFor TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term "responder" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events.\nClient / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately.', + fields: { + 'server.address': { + dashed_name: 'server-address', + description: + 'Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'server.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Server network address.', + type: 'keyword', + }, + 'server.as.number': { + dashed_name: 'server-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'server.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'server.as.organization.name': { + dashed_name: 'server-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'server.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'server.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'server.bytes': { + dashed_name: 'server-bytes', + description: 'Bytes sent from the server to the client.', + example: 184, + flat_name: 'server.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the server to the client.', + type: 'long', + }, + 'server.domain': { + dashed_name: 'server-domain', + description: + 'The domain name of the server system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'server.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the server.', + type: 'keyword', + }, + 'server.geo.city_name': { + dashed_name: 'server-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'server.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'server.geo.continent_code': { + dashed_name: 'server-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'server.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'server.geo.continent_name': { + dashed_name: 'server-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'server.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'server.geo.country_iso_code': { + dashed_name: 'server-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'server.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'server.geo.country_name': { + dashed_name: 'server-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'server.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'server.geo.location': { + dashed_name: 'server-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'server.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'server.geo.name': { + dashed_name: 'server-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'server.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'server.geo.postal_code': { + dashed_name: 'server-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'server.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'server.geo.region_iso_code': { + dashed_name: 'server-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'server.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'server.geo.region_name': { + dashed_name: 'server-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'server.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'server.geo.timezone': { + dashed_name: 'server-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'server.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'server.ip': { + dashed_name: 'server-ip', + description: 'IP address of the server (IPv4 or IPv6).', + flat_name: 'server.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the server.', + type: 'ip', + }, + 'server.mac': { + dashed_name: 'server-mac', + description: + 'MAC address of the server.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'server.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the server.', + type: 'keyword', + }, + 'server.nat.ip': { + dashed_name: 'server-nat-ip', + description: + 'Translated ip of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'server.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Server NAT ip', + type: 'ip', + }, + 'server.nat.port': { + dashed_name: 'server-nat-port', + description: + 'Translated port of destination based NAT sessions (e.g. internet to private DMZ)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'server.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Server NAT port', + type: 'long', + }, + 'server.packets': { + dashed_name: 'server-packets', + description: 'Packets sent from the server to the client.', + example: 12, + flat_name: 'server.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the server to the client.', + type: 'long', + }, + 'server.port': { + dashed_name: 'server-port', + description: 'Port of the server.', + flat_name: 'server.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the server.', + type: 'long', + }, + 'server.registered_domain': { + dashed_name: 'server-registered-domain', + description: + 'The highest registered server domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'server.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered server domain, stripped of the subdomain.', + type: 'keyword', + }, + 'server.subdomain': { + dashed_name: 'server-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'server.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'server.top_level_domain': { + dashed_name: 'server-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'server.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'server.user.domain': { + dashed_name: 'server-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'server.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'server.user.email': { + dashed_name: 'server-user-email', + description: 'User email address.', + flat_name: 'server.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'server.user.full_name': { + dashed_name: 'server-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'server.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'server.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'server.user.group.domain': { + dashed_name: 'server-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'server.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'server.user.group.id': { + dashed_name: 'server-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'server.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'server.user.group.name': { + dashed_name: 'server-user-group-name', + description: 'Name of the group.', + flat_name: 'server.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'server.user.hash': { + dashed_name: 'server-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'server.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'server.user.id': { + dashed_name: 'server-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'server.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'server.user.name': { + dashed_name: 'server-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'server.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'server.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'server.user.roles': { + dashed_name: 'server-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'server.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'server', + nestings: ['server.as', 'server.geo', 'server.user'], + prefix: 'server.', + reused_here: [ + { + full: 'server.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'server.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'server.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the server side of a network connection, used with client.', + title: 'Server', + type: 'group', + }, + service: { + description: + 'The service fields describe the service for or from which the data was collected.\nThese fields help you find and correlate logs for a specific service and version.', + fields: { + 'service.address': { + dashed_name: 'service-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Address of this service.', + type: 'keyword', + }, + 'service.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.ephemeral_id': { + dashed_name: 'service-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.id': { + dashed_name: 'service-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.name': { + dashed_name: 'service-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + short: 'Name of the service.', + type: 'keyword', + }, + 'service.node.name': { + dashed_name: 'service-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.node.role': { + dashed_name: 'service-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.node.roles': { + dashed_name: 'service-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.origin.address': { + dashed_name: 'service-origin-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.origin.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + original_fieldset: 'service', + short: 'Address of this service.', + type: 'keyword', + }, + 'service.origin.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-origin-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.origin.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + original_fieldset: 'service', + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.origin.ephemeral_id': { + dashed_name: 'service-origin-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.origin.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + original_fieldset: 'service', + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.origin.id': { + dashed_name: 'service-origin-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.origin.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'service', + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.origin.name': { + dashed_name: 'service-origin-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.origin.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service.', + type: 'keyword', + }, + 'service.origin.node.name': { + dashed_name: 'service-origin-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.origin.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.origin.node.role': { + dashed_name: 'service-origin-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.origin.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + original_fieldset: 'service', + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.origin.node.roles': { + dashed_name: 'service-origin-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.origin.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + original_fieldset: 'service', + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.origin.state': { + dashed_name: 'service-origin-state', + description: 'Current state of the service.', + flat_name: 'service.origin.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + original_fieldset: 'service', + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.origin.type': { + dashed_name: 'service-origin-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.origin.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + original_fieldset: 'service', + short: 'The type of the service.', + type: 'keyword', + }, + 'service.origin.version': { + dashed_name: 'service-origin-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.origin.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + original_fieldset: 'service', + short: 'Version of the service.', + type: 'keyword', + }, + 'service.state': { + dashed_name: 'service-state', + description: 'Current state of the service.', + flat_name: 'service.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.target.address': { + dashed_name: 'service-target-address', + description: + 'Address where data about this service was collected from.\nThis should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets).', + example: '172.26.0.2:5432', + flat_name: 'service.target.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + original_fieldset: 'service', + short: 'Address of this service.', + type: 'keyword', + }, + 'service.target.environment': { + beta: 'This field is beta and subject to change.', + dashed_name: 'service-target-environment', + description: + 'Identifies the environment where the service is running.\nIf the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment.', + example: 'production', + flat_name: 'service.target.environment', + ignore_above: 1024, + level: 'extended', + name: 'environment', + normalize: [], + original_fieldset: 'service', + short: 'Environment of the service.', + type: 'keyword', + }, + 'service.target.ephemeral_id': { + dashed_name: 'service-target-ephemeral-id', + description: + 'Ephemeral identifier of this service (if one exists).\nThis id normally changes across restarts, but `service.id` does not.', + example: '8a4f500f', + flat_name: 'service.target.ephemeral_id', + ignore_above: 1024, + level: 'extended', + name: 'ephemeral_id', + normalize: [], + original_fieldset: 'service', + short: 'Ephemeral identifier of this service.', + type: 'keyword', + }, + 'service.target.id': { + dashed_name: 'service-target-id', + description: + 'Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes.\nThis id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event.\nNote that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead.', + example: 'd37e5ebfe0ae6c4972dbe9f0174a1637bb8247f6', + flat_name: 'service.target.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'service', + short: 'Unique identifier of the running service.', + type: 'keyword', + }, + 'service.target.name': { + dashed_name: 'service-target-name', + description: + 'Name of the service data is collected from.\nThe name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name.\nIn the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified.', + example: 'elasticsearch-metrics', + flat_name: 'service.target.name', + ignore_above: 1024, + level: 'core', + name: 'name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service.', + type: 'keyword', + }, + 'service.target.node.name': { + dashed_name: 'service-target-node-name', + description: + "Name of a service node.\nThis allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service.\nIn the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set.", + example: 'instance-0000000016', + flat_name: 'service.target.node.name', + ignore_above: 1024, + level: 'extended', + name: 'node.name', + normalize: [], + original_fieldset: 'service', + short: 'Name of the service node.', + type: 'keyword', + }, + 'service.target.node.role': { + dashed_name: 'service-target-node-role', + description: + 'Deprecated for removal in next major version release. This field will be superseded by `node.roles`.\nRole of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data`.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: 'background_tasks', + flat_name: 'service.target.node.role', + ignore_above: 1024, + level: 'extended', + name: 'node.role', + normalize: [], + original_fieldset: 'service', + short: 'Deprecated role (singular) of the service node.', + type: 'keyword', + }, + 'service.target.node.roles': { + dashed_name: 'service-target-node-roles', + description: + 'Roles of a service node.\nThis allows for distinction between different running roles of the same service.\nIn the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both.\nIn the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both.\nOther services could use this to distinguish between a `web` and `worker` role running as part of the service.', + example: '["ui", "background_tasks"]', + flat_name: 'service.target.node.roles', + ignore_above: 1024, + level: 'extended', + name: 'node.roles', + normalize: ['array'], + original_fieldset: 'service', + short: 'Roles of the service node.', + type: 'keyword', + }, + 'service.target.state': { + dashed_name: 'service-target-state', + description: 'Current state of the service.', + flat_name: 'service.target.state', + ignore_above: 1024, + level: 'core', + name: 'state', + normalize: [], + original_fieldset: 'service', + short: 'Current state of the service.', + type: 'keyword', + }, + 'service.target.type': { + dashed_name: 'service-target-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.target.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + original_fieldset: 'service', + short: 'The type of the service.', + type: 'keyword', + }, + 'service.target.version': { + dashed_name: 'service-target-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.target.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + original_fieldset: 'service', + short: 'Version of the service.', + type: 'keyword', + }, + 'service.type': { + dashed_name: 'service-type', + description: + 'The type of the service data is collected from.\nThe type can be used to group and correlate logs and metrics from one service type.\nExample: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`.', + example: 'elasticsearch', + flat_name: 'service.type', + ignore_above: 1024, + level: 'core', + name: 'type', + normalize: [], + short: 'The type of the service.', + type: 'keyword', + }, + 'service.version': { + dashed_name: 'service-version', + description: + 'Version of the service the data was collected from.\nThis allows to look at a data set only for a specific version of a service.', + example: '3.2.4', + flat_name: 'service.version', + ignore_above: 1024, + level: 'core', + name: 'version', + normalize: [], + short: 'Version of the service.', + type: 'keyword', + }, + }, + footnote: + 'The service fields may be self-nested under service.origin.* and service.target.* to describe origin or target services in the context of incoming or outgoing requests, respectively. However, the fieldsets service.origin.* and service.target.* must not be confused with the root service fieldset that is used to describe the actual service under observation. The fieldset service.origin.* may only be used in the context of incoming requests or events to describe the originating service of the request. The fieldset service.target.* may only be used in the context of outgoing requests or events to describe the target service of the request.', + group: 2, + name: 'service', + nestings: ['service.origin', 'service.target'], + prefix: 'service.', + reusable: { + expected: [ + { + as: 'origin', + at: 'service', + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.origin', + short_override: 'Describes the origin service in case of an incoming request or event.', + }, + { + as: 'target', + at: 'service', + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.target', + short_override: 'Describes the target service in case of an outgoing request or event.', + }, + ], + top_level: true, + }, + reused_here: [ + { + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.origin', + schema_name: 'service', + short: 'Describes the origin service in case of an incoming request or event.', + }, + { + beta: 'Reusing the `service` fields in this location is currently considered beta.', + full: 'service.target', + schema_name: 'service', + short: 'Describes the target service in case of an outgoing request or event.', + }, + ], + short: 'Fields describing the service for or from which the data was collected.', + title: 'Service', + type: 'group', + }, + source: { + description: + 'Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.', + fields: { + 'source.address': { + dashed_name: 'source-address', + description: + 'Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is.', + flat_name: 'source.address', + ignore_above: 1024, + level: 'extended', + name: 'address', + normalize: [], + short: 'Source network address.', + type: 'keyword', + }, + 'source.as.number': { + dashed_name: 'source-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'source.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'source.as.organization.name': { + dashed_name: 'source-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'source.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'source.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'source.bytes': { + dashed_name: 'source-bytes', + description: 'Bytes sent from the source to the destination.', + example: 184, + flat_name: 'source.bytes', + format: 'bytes', + level: 'core', + name: 'bytes', + normalize: [], + short: 'Bytes sent from the source to the destination.', + type: 'long', + }, + 'source.domain': { + dashed_name: 'source-domain', + description: + 'The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.', + example: 'foo.example.com', + flat_name: 'source.domain', + ignore_above: 1024, + level: 'core', + name: 'domain', + normalize: [], + short: 'The domain name of the source.', + type: 'keyword', + }, + 'source.geo.city_name': { + dashed_name: 'source-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'source.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'source.geo.continent_code': { + dashed_name: 'source-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'source.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'source.geo.continent_name': { + dashed_name: 'source-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'source.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'source.geo.country_iso_code': { + dashed_name: 'source-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'source.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'source.geo.country_name': { + dashed_name: 'source-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'source.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'source.geo.location': { + dashed_name: 'source-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'source.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'source.geo.name': { + dashed_name: 'source-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'source.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'source.geo.postal_code': { + dashed_name: 'source-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'source.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'source.geo.region_iso_code': { + dashed_name: 'source-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'source.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'source.geo.region_name': { + dashed_name: 'source-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'source.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'source.geo.timezone': { + dashed_name: 'source-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'source.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'source.ip': { + dashed_name: 'source-ip', + description: 'IP address of the source (IPv4 or IPv6).', + flat_name: 'source.ip', + level: 'core', + name: 'ip', + normalize: [], + short: 'IP address of the source.', + type: 'ip', + }, + 'source.mac': { + dashed_name: 'source-mac', + description: + 'MAC address of the source.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.', + example: '00-00-5E-00-53-23', + flat_name: 'source.mac', + ignore_above: 1024, + level: 'core', + name: 'mac', + normalize: [], + pattern: '^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$', + short: 'MAC address of the source.', + type: 'keyword', + }, + 'source.nat.ip': { + dashed_name: 'source-nat-ip', + description: + 'Translated ip of source based NAT sessions (e.g. internal client to internet)\nTypically connections traversing load balancers, firewalls, or routers.', + flat_name: 'source.nat.ip', + level: 'extended', + name: 'nat.ip', + normalize: [], + short: 'Source NAT ip', + type: 'ip', + }, + 'source.nat.port': { + dashed_name: 'source-nat-port', + description: + 'Translated port of source based NAT sessions. (e.g. internal client to internet)\nTypically used with load balancers, firewalls, or routers.', + flat_name: 'source.nat.port', + format: 'string', + level: 'extended', + name: 'nat.port', + normalize: [], + short: 'Source NAT port', + type: 'long', + }, + 'source.packets': { + dashed_name: 'source-packets', + description: 'Packets sent from the source to the destination.', + example: 12, + flat_name: 'source.packets', + level: 'core', + name: 'packets', + normalize: [], + short: 'Packets sent from the source to the destination.', + type: 'long', + }, + 'source.port': { + dashed_name: 'source-port', + description: 'Port of the source.', + flat_name: 'source.port', + format: 'string', + level: 'core', + name: 'port', + normalize: [], + short: 'Port of the source.', + type: 'long', + }, + 'source.registered_domain': { + dashed_name: 'source-registered-domain', + description: + 'The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'source.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered source domain, stripped of the subdomain.', + type: 'keyword', + }, + 'source.subdomain': { + dashed_name: 'source-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'source.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'source.top_level_domain': { + dashed_name: 'source-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'source.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'source.user.domain': { + dashed_name: 'source-user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'source.user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'source.user.email': { + dashed_name: 'source-user-email', + description: 'User email address.', + flat_name: 'source.user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'source.user.full_name': { + dashed_name: 'source-user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'source.user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'source.user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'source.user.group.domain': { + dashed_name: 'source-user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'source.user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'source.user.group.id': { + dashed_name: 'source-user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'source.user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'source.user.group.name': { + dashed_name: 'source-user-group-name', + description: 'Name of the group.', + flat_name: 'source.user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'source.user.hash': { + dashed_name: 'source-user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'source.user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'source.user.id': { + dashed_name: 'source-user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'source.user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'source.user.name': { + dashed_name: 'source-user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'source.user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'source.user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'source.user.roles': { + dashed_name: 'source-user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'source.user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'source', + nestings: ['source.as', 'source.geo', 'source.user'], + prefix: 'source.', + reusable: { + expected: [ + { + as: 'source', + at: 'process.entry_meta', + full: 'process.entry_meta.source', + short_override: 'Remote client information such as ip, port and geo location.', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'source.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'source.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'source.user', + schema_name: 'user', + short: 'Fields to describe the user relevant to the event.', + }, + ], + short: 'Fields about the source side of a network connection, used with destination.', + title: 'Source', + type: 'group', + }, + threat: { + description: + 'Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").', + fields: { + 'threat.enrichments': { + dashed_name: 'threat-enrichments', + description: + 'A list of associated indicators objects enriching the event, and the context of that association/enrichment.', + flat_name: 'threat.enrichments', + level: 'extended', + name: 'enrichments', + normalize: ['array'], + short: 'List of objects containing indicators enriching the event.', + type: 'nested', + }, + 'threat.enrichments.indicator': { + dashed_name: 'threat-enrichments-indicator', + description: 'Object containing associated indicators enriching the event.', + flat_name: 'threat.enrichments.indicator', + level: 'extended', + name: 'enrichments.indicator', + normalize: [], + short: 'Object containing indicators enriching the event.', + type: 'object', + }, + 'threat.enrichments.indicator.as.number': { + dashed_name: 'threat-enrichments-indicator-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'threat.enrichments.indicator.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'threat.enrichments.indicator.as.organization.name': { + dashed_name: 'threat-enrichments-indicator-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'threat.enrichments.indicator.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.confidence': { + dashed_name: 'threat-enrichments-indicator-confidence', + description: + 'Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.', + example: 'Medium', + expected_values: ['Not Specified', 'None', 'Low', 'Medium', 'High'], + flat_name: 'threat.enrichments.indicator.confidence', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.confidence', + normalize: [], + short: 'Indicator confidence rating', + type: 'keyword', + }, + 'threat.enrichments.indicator.description': { + dashed_name: 'threat-enrichments-indicator-description', + description: 'Describes the type of action conducted by the threat.', + example: 'IP x.x.x.x was observed delivering the Angler EK.', + flat_name: 'threat.enrichments.indicator.description', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.description', + normalize: [], + short: 'Indicator description', + type: 'keyword', + }, + 'threat.enrichments.indicator.email.address': { + dashed_name: 'threat-enrichments-indicator-email-address', + description: + 'Identifies a threat indicator as an email address (irrespective of direction).', + example: 'phish@example.com', + flat_name: 'threat.enrichments.indicator.email.address', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.email.address', + normalize: [], + short: 'Indicator email address', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.accessed': { + dashed_name: 'threat-enrichments-indicator-file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'threat.enrichments.indicator.file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file was accessed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.attributes': { + dashed_name: 'threat-enrichments-indicator-file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'threat.enrichments.indicator.file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + original_fieldset: 'file', + short: 'Array of file attributes.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.digest_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'threat.enrichments.indicator.file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.exists': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.code_signature.signing_id': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'threat.enrichments.indicator.file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.status': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'threat.enrichments.indicator.file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.subject_name': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'threat.enrichments.indicator.file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.team_id': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'threat.enrichments.indicator.file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.code_signature.timestamp': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'threat.enrichments.indicator.file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.code_signature.trusted': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.code_signature.valid': { + dashed_name: 'threat-enrichments-indicator-file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'threat.enrichments.indicator.file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'threat.enrichments.indicator.file.created': { + dashed_name: 'threat-enrichments-indicator-file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'threat.enrichments.indicator.file.created', + level: 'extended', + name: 'created', + normalize: [], + original_fieldset: 'file', + short: 'File creation time.', + type: 'date', + }, + 'threat.enrichments.indicator.file.ctime': { + dashed_name: 'threat-enrichments-indicator-file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'threat.enrichments.indicator.file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'threat.enrichments.indicator.file.device': { + dashed_name: 'threat-enrichments-indicator-file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'threat.enrichments.indicator.file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + original_fieldset: 'file', + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.directory': { + dashed_name: 'threat-enrichments-indicator-file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'threat.enrichments.indicator.file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + original_fieldset: 'file', + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.drive_letter': { + dashed_name: 'threat-enrichments-indicator-file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'threat.enrichments.indicator.file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + original_fieldset: 'file', + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.architecture': { + dashed_name: 'threat-enrichments-indicator-file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'threat.enrichments.indicator.file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.byte_order': { + dashed_name: 'threat-enrichments-indicator-file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'threat.enrichments.indicator.file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.cpu_type': { + dashed_name: 'threat-enrichments-indicator-file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'threat.enrichments.indicator.file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.creation_date': { + dashed_name: 'threat-enrichments-indicator-file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'threat.enrichments.indicator.file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'threat.enrichments.indicator.file.elf.exports': { + dashed_name: 'threat-enrichments-indicator-file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'threat.enrichments.indicator.file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'threat.enrichments.indicator.file.elf.header.abi_version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'threat.enrichments.indicator.file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.class': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.data': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'threat.enrichments.indicator.file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.entrypoint': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.header.object_version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'threat.enrichments.indicator.file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.os_abi': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'threat.enrichments.indicator.file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.header.version': { + dashed_name: 'threat-enrichments-indicator-file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'threat.enrichments.indicator.file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.imports': { + dashed_name: 'threat-enrichments-indicator-file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'threat.enrichments.indicator.file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'threat.enrichments.indicator.file.elf.sections': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'threat.enrichments.indicator.file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'threat.enrichments.indicator.file.elf.sections.chi2': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.entropy': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.flags': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.name': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.physical_offset': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.physical_size': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.sections.virtual_address': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.sections.virtual_size': { + dashed_name: 'threat-enrichments-indicator-file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'threat.enrichments.indicator.file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'threat.enrichments.indicator.file.elf.segments': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'threat.enrichments.indicator.file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'threat.enrichments.indicator.file.elf.segments.sections': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'threat.enrichments.indicator.file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.segments.type': { + dashed_name: 'threat-enrichments-indicator-file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'threat.enrichments.indicator.file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.shared_libraries': { + dashed_name: 'threat-enrichments-indicator-file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'threat.enrichments.indicator.file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.elf.telfhash': { + dashed_name: 'threat-enrichments-indicator-file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'threat.enrichments.indicator.file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.extension': { + dashed_name: 'threat-enrichments-indicator-file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.enrichments.indicator.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'file', + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.fork_name': { + dashed_name: 'threat-enrichments-indicator-file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'threat.enrichments.indicator.file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + original_fieldset: 'file', + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.gid': { + dashed_name: 'threat-enrichments-indicator-file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'threat.enrichments.indicator.file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + original_fieldset: 'file', + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.group': { + dashed_name: 'threat-enrichments-indicator-file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'threat.enrichments.indicator.file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + original_fieldset: 'file', + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.md5': { + dashed_name: 'threat-enrichments-indicator-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha1': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha256': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha384': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.sha512': { + dashed_name: 'threat-enrichments-indicator-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'threat.enrichments.indicator.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.ssdeep': { + dashed_name: 'threat-enrichments-indicator-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'threat.enrichments.indicator.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.hash.tlsh': { + dashed_name: 'threat-enrichments-indicator-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'threat.enrichments.indicator.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.inode': { + dashed_name: 'threat-enrichments-indicator-file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'threat.enrichments.indicator.file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + original_fieldset: 'file', + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mime_type': { + dashed_name: 'threat-enrichments-indicator-file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'threat.enrichments.indicator.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + original_fieldset: 'file', + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mode': { + dashed_name: 'threat-enrichments-indicator-file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'threat.enrichments.indicator.file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + original_fieldset: 'file', + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.mtime': { + dashed_name: 'threat-enrichments-indicator-file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'threat.enrichments.indicator.file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file content was modified.', + type: 'date', + }, + 'threat.enrichments.indicator.file.name': { + dashed_name: 'threat-enrichments-indicator-file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'threat.enrichments.indicator.file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'file', + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.owner': { + dashed_name: 'threat-enrichments-indicator-file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'threat.enrichments.indicator.file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + original_fieldset: 'file', + short: "File owner's username.", + type: 'keyword', + }, + 'threat.enrichments.indicator.file.path': { + dashed_name: 'threat-enrichments-indicator-file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'threat.enrichments.indicator.file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + original_fieldset: 'file', + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.architecture': { + dashed_name: 'threat-enrichments-indicator-file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'threat.enrichments.indicator.file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.company': { + dashed_name: 'threat-enrichments-indicator-file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'threat.enrichments.indicator.file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.description': { + dashed_name: 'threat-enrichments-indicator-file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'threat.enrichments.indicator.file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.file_version': { + dashed_name: 'threat-enrichments-indicator-file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'threat.enrichments.indicator.file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.imphash': { + dashed_name: 'threat-enrichments-indicator-file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'threat.enrichments.indicator.file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.original_file_name': { + dashed_name: 'threat-enrichments-indicator-file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'threat.enrichments.indicator.file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.pehash': { + dashed_name: 'threat-enrichments-indicator-file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'threat.enrichments.indicator.file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.pe.product': { + dashed_name: 'threat-enrichments-indicator-file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'threat.enrichments.indicator.file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.size': { + dashed_name: 'threat-enrichments-indicator-file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'threat.enrichments.indicator.file.size', + level: 'extended', + name: 'size', + normalize: [], + original_fieldset: 'file', + short: 'File size in bytes.', + type: 'long', + }, + 'threat.enrichments.indicator.file.target_path': { + dashed_name: 'threat-enrichments-indicator-file-target-path', + description: 'Target path for symlinks.', + flat_name: 'threat.enrichments.indicator.file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + original_fieldset: 'file', + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.type': { + dashed_name: 'threat-enrichments-indicator-file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'threat.enrichments.indicator.file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'file', + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.uid': { + dashed_name: 'threat-enrichments-indicator-file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'threat.enrichments.indicator.file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + original_fieldset: 'file', + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.alternative_names': { + dashed_name: 'threat-enrichments-indicator-file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.enrichments.indicator.file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.common_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.country': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.locality': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.organization': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.issuer.state_or_province': { + dashed_name: 'threat-enrichments-indicator-file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.not_after': { + dashed_name: 'threat-enrichments-indicator-file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.enrichments.indicator.file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.file.x509.not_before': { + dashed_name: 'threat-enrichments-indicator-file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.enrichments.indicator.file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.file.x509.public_key_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.enrichments.indicator.file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.public_key_curve': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.enrichments.indicator.file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.public_key_exponent': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.enrichments.indicator.file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.enrichments.indicator.file.x509.public_key_size': { + dashed_name: 'threat-enrichments-indicator-file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.enrichments.indicator.file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.enrichments.indicator.file.x509.serial_number': { + dashed_name: 'threat-enrichments-indicator-file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.enrichments.indicator.file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.signature_algorithm': { + dashed_name: 'threat-enrichments-indicator-file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.enrichments.indicator.file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.common_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.enrichments.indicator.file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.country': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.enrichments.indicator.file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.enrichments.indicator.file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.locality': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.enrichments.indicator.file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.organization': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.enrichments.indicator.file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.enrichments.indicator.file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.subject.state_or_province': { + dashed_name: 'threat-enrichments-indicator-file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.file.x509.version_number': { + dashed_name: 'threat-enrichments-indicator-file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.enrichments.indicator.file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.enrichments.indicator.first_seen': { + dashed_name: 'threat-enrichments-indicator-first-seen', + description: + 'The date and time when intelligence source first reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.first_seen', + level: 'extended', + name: 'enrichments.indicator.first_seen', + normalize: [], + short: 'Date/time indicator was first reported.', + type: 'date', + }, + 'threat.enrichments.indicator.geo.city_name': { + dashed_name: 'threat-enrichments-indicator-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'threat.enrichments.indicator.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.continent_code': { + dashed_name: 'threat-enrichments-indicator-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'threat.enrichments.indicator.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.continent_name': { + dashed_name: 'threat-enrichments-indicator-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'threat.enrichments.indicator.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.country_iso_code': { + dashed_name: 'threat-enrichments-indicator-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'threat.enrichments.indicator.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.country_name': { + dashed_name: 'threat-enrichments-indicator-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'threat.enrichments.indicator.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.location': { + dashed_name: 'threat-enrichments-indicator-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'threat.enrichments.indicator.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'threat.enrichments.indicator.geo.name': { + dashed_name: 'threat-enrichments-indicator-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'threat.enrichments.indicator.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.postal_code': { + dashed_name: 'threat-enrichments-indicator-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'threat.enrichments.indicator.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.region_iso_code': { + dashed_name: 'threat-enrichments-indicator-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'threat.enrichments.indicator.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.region_name': { + dashed_name: 'threat-enrichments-indicator-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'threat.enrichments.indicator.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'threat.enrichments.indicator.geo.timezone': { + dashed_name: 'threat-enrichments-indicator-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'threat.enrichments.indicator.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'threat.enrichments.indicator.ip': { + dashed_name: 'threat-enrichments-indicator-ip', + description: 'Identifies a threat indicator as an IP address (irrespective of direction).', + example: '1.2.3.4', + flat_name: 'threat.enrichments.indicator.ip', + level: 'extended', + name: 'enrichments.indicator.ip', + normalize: [], + short: 'Indicator IP address', + type: 'ip', + }, + 'threat.enrichments.indicator.last_seen': { + dashed_name: 'threat-enrichments-indicator-last-seen', + description: + 'The date and time when intelligence source last reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.last_seen', + level: 'extended', + name: 'enrichments.indicator.last_seen', + normalize: [], + short: 'Date/time indicator was last reported.', + type: 'date', + }, + 'threat.enrichments.indicator.marking.tlp.version': { + dashed_name: 'threat-enrichments-indicator-marking-tlp-version', + description: 'Traffic Light Protocol version.', + example: 2, + flat_name: 'threat.enrichments.indicator.marking.tlp.version', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.marking.tlp.version', + normalize: [], + short: 'Indicator TLP version', + type: 'keyword', + }, + 'threat.enrichments.indicator.modified_at': { + dashed_name: 'threat-enrichments-indicator-modified-at', + description: + 'The date and time when intelligence source last modified information for this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.enrichments.indicator.modified_at', + level: 'extended', + name: 'enrichments.indicator.modified_at', + normalize: [], + short: 'Date/time indicator was last updated.', + type: 'date', + }, + 'threat.enrichments.indicator.port': { + dashed_name: 'threat-enrichments-indicator-port', + description: 'Identifies a threat indicator as a port number (irrespective of direction).', + example: 443, + flat_name: 'threat.enrichments.indicator.port', + level: 'extended', + name: 'enrichments.indicator.port', + normalize: [], + short: 'Indicator port', + type: 'long', + }, + 'threat.enrichments.indicator.provider': { + dashed_name: 'threat-enrichments-indicator-provider', + description: "The name of the indicator's provider.", + example: 'lrz_urlhaus', + flat_name: 'threat.enrichments.indicator.provider', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.provider', + normalize: [], + short: 'Indicator provider', + type: 'keyword', + }, + 'threat.enrichments.indicator.reference': { + dashed_name: 'threat-enrichments-indicator-reference', + description: 'Reference URL linking to additional information about this indicator.', + example: 'https://system.example.com/indicator/0001234', + flat_name: 'threat.enrichments.indicator.reference', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.reference', + normalize: [], + short: 'Indicator reference URL', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.data.bytes': { + dashed_name: 'threat-enrichments-indicator-registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'threat.enrichments.indicator.registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + original_fieldset: 'registry', + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.data.strings': { + dashed_name: 'threat-enrichments-indicator-registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'threat.enrichments.indicator.registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + original_fieldset: 'registry', + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.registry.data.type': { + dashed_name: 'threat-enrichments-indicator-registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'threat.enrichments.indicator.registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + original_fieldset: 'registry', + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.hive': { + dashed_name: 'threat-enrichments-indicator-registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'threat.enrichments.indicator.registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + original_fieldset: 'registry', + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.key': { + dashed_name: 'threat-enrichments-indicator-registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'threat.enrichments.indicator.registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + original_fieldset: 'registry', + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.path': { + dashed_name: 'threat-enrichments-indicator-registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'threat.enrichments.indicator.registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + original_fieldset: 'registry', + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'threat.enrichments.indicator.registry.value': { + dashed_name: 'threat-enrichments-indicator-registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'threat.enrichments.indicator.registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + original_fieldset: 'registry', + short: 'Name of the value written.', + type: 'keyword', + }, + 'threat.enrichments.indicator.scanner_stats': { + dashed_name: 'threat-enrichments-indicator-scanner-stats', + description: 'Count of AV/EDR vendors that successfully detected malicious file or URL.', + example: 4, + flat_name: 'threat.enrichments.indicator.scanner_stats', + level: 'extended', + name: 'enrichments.indicator.scanner_stats', + normalize: [], + short: 'Scanner statistics', + type: 'long', + }, + 'threat.enrichments.indicator.sightings': { + dashed_name: 'threat-enrichments-indicator-sightings', + description: 'Number of times this indicator was observed conducting threat activity.', + example: 20, + flat_name: 'threat.enrichments.indicator.sightings', + level: 'extended', + name: 'enrichments.indicator.sightings', + normalize: [], + short: 'Number of times indicator observed', + type: 'long', + }, + 'threat.enrichments.indicator.type': { + dashed_name: 'threat-enrichments-indicator-type', + description: 'Type of indicator as represented by Cyber Observable in STIX 2.0.', + example: 'ipv4-addr', + expected_values: [ + 'autonomous-system', + 'artifact', + 'directory', + 'domain-name', + 'email-addr', + 'file', + 'ipv4-addr', + 'ipv6-addr', + 'mac-addr', + 'mutex', + 'port', + 'process', + 'software', + 'url', + 'user-account', + 'windows-registry-key', + 'x509-certificate', + ], + flat_name: 'threat.enrichments.indicator.type', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.indicator.type', + normalize: [], + short: 'Type of indicator', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.domain': { + dashed_name: 'threat-enrichments-indicator-url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'threat.enrichments.indicator.url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'url', + short: 'Domain of the url.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.extension': { + dashed_name: 'threat-enrichments-indicator-url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.enrichments.indicator.url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'url', + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.fragment': { + dashed_name: 'threat-enrichments-indicator-url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'threat.enrichments.indicator.url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + original_fieldset: 'url', + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.full': { + dashed_name: 'threat-enrichments-indicator-url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'threat.enrichments.indicator.url.full', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.url.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'url', + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.original': { + dashed_name: 'threat-enrichments-indicator-url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'threat.enrichments.indicator.url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.enrichments.indicator.url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + original_fieldset: 'url', + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.password': { + dashed_name: 'threat-enrichments-indicator-url-password', + description: 'Password of the request.', + flat_name: 'threat.enrichments.indicator.url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + original_fieldset: 'url', + short: 'Password of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.path': { + dashed_name: 'threat-enrichments-indicator-url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'threat.enrichments.indicator.url.path', + level: 'extended', + name: 'path', + normalize: [], + original_fieldset: 'url', + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'threat.enrichments.indicator.url.port': { + dashed_name: 'threat-enrichments-indicator-url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'threat.enrichments.indicator.url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + original_fieldset: 'url', + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'threat.enrichments.indicator.url.query': { + dashed_name: 'threat-enrichments-indicator-url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'threat.enrichments.indicator.url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + original_fieldset: 'url', + short: 'Query string of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.registered_domain': { + dashed_name: 'threat-enrichments-indicator-url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'threat.enrichments.indicator.url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + original_fieldset: 'url', + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.scheme': { + dashed_name: 'threat-enrichments-indicator-url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'threat.enrichments.indicator.url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + original_fieldset: 'url', + short: 'Scheme of the url.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.subdomain': { + dashed_name: 'threat-enrichments-indicator-url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'threat.enrichments.indicator.url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + original_fieldset: 'url', + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.top_level_domain': { + dashed_name: 'threat-enrichments-indicator-url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'threat.enrichments.indicator.url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + original_fieldset: 'url', + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'threat.enrichments.indicator.url.username': { + dashed_name: 'threat-enrichments-indicator-url-username', + description: 'Username of the request.', + flat_name: 'threat.enrichments.indicator.url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + original_fieldset: 'url', + short: 'Username of the request.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.alternative_names': { + dashed_name: 'threat-enrichments-indicator-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.enrichments.indicator.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.common_name': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.country': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.enrichments.indicator.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.enrichments.indicator.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.locality': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.enrichments.indicator.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.organization': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.enrichments.indicator.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.enrichments.indicator.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.issuer.state_or_province': { + dashed_name: 'threat-enrichments-indicator-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.not_after': { + dashed_name: 'threat-enrichments-indicator-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.enrichments.indicator.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.x509.not_before': { + dashed_name: 'threat-enrichments-indicator-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.enrichments.indicator.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.enrichments.indicator.x509.public_key_algorithm': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.enrichments.indicator.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.public_key_curve': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.enrichments.indicator.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.public_key_exponent': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.enrichments.indicator.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.enrichments.indicator.x509.public_key_size': { + dashed_name: 'threat-enrichments-indicator-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.enrichments.indicator.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.enrichments.indicator.x509.serial_number': { + dashed_name: 'threat-enrichments-indicator-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.enrichments.indicator.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.signature_algorithm': { + dashed_name: 'threat-enrichments-indicator-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.enrichments.indicator.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.common_name': { + dashed_name: 'threat-enrichments-indicator-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.enrichments.indicator.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.country': { + dashed_name: 'threat-enrichments-indicator-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.enrichments.indicator.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.distinguished_name': { + dashed_name: 'threat-enrichments-indicator-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.enrichments.indicator.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.locality': { + dashed_name: 'threat-enrichments-indicator-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.enrichments.indicator.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.organization': { + dashed_name: 'threat-enrichments-indicator-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.enrichments.indicator.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.organizational_unit': { + dashed_name: 'threat-enrichments-indicator-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.enrichments.indicator.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.subject.state_or_province': { + dashed_name: 'threat-enrichments-indicator-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.enrichments.indicator.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.enrichments.indicator.x509.version_number': { + dashed_name: 'threat-enrichments-indicator-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.enrichments.indicator.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.enrichments.matched.atomic': { + dashed_name: 'threat-enrichments-matched-atomic', + description: + 'Identifies the atomic indicator value that matched a local environment endpoint or network event.', + example: 'bad-domain.com', + flat_name: 'threat.enrichments.matched.atomic', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.atomic', + normalize: [], + short: 'Matched indicator value', + type: 'keyword', + }, + 'threat.enrichments.matched.field': { + dashed_name: 'threat-enrichments-matched-field', + description: + 'Identifies the field of the atomic indicator that matched a local environment endpoint or network event.', + example: 'file.hash.sha256', + flat_name: 'threat.enrichments.matched.field', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.field', + normalize: [], + short: 'Matched indicator field', + type: 'keyword', + }, + 'threat.enrichments.matched.id': { + dashed_name: 'threat-enrichments-matched-id', + description: 'Identifies the _id of the indicator document enriching the event.', + example: 'ff93aee5-86a1-4a61-b0e6-0cdc313d01b5', + flat_name: 'threat.enrichments.matched.id', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.id', + normalize: [], + short: 'Matched indicator identifier', + type: 'keyword', + }, + 'threat.enrichments.matched.index': { + dashed_name: 'threat-enrichments-matched-index', + description: 'Identifies the _index of the indicator document enriching the event.', + example: 'filebeat-8.0.0-2021.05.23-000011', + flat_name: 'threat.enrichments.matched.index', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.index', + normalize: [], + short: 'Matched indicator index', + type: 'keyword', + }, + 'threat.enrichments.matched.occurred': { + dashed_name: 'threat-enrichments-matched-occurred', + description: 'Indicates when the indicator match was generated', + example: '2021-10-05T17:00:58.326Z', + flat_name: 'threat.enrichments.matched.occurred', + level: 'extended', + name: 'enrichments.matched.occurred', + normalize: [], + short: 'Date of match', + type: 'date', + }, + 'threat.enrichments.matched.type': { + dashed_name: 'threat-enrichments-matched-type', + description: + 'Identifies the type of match that caused the event to be enriched with the given indicator', + example: 'indicator_match_rule', + flat_name: 'threat.enrichments.matched.type', + ignore_above: 1024, + level: 'extended', + name: 'enrichments.matched.type', + normalize: [], + short: 'Type of indicator match', + type: 'keyword', + }, + 'threat.feed.dashboard_id': { + dashed_name: 'threat-feed-dashboard-id', + description: + 'The saved object ID of the dashboard belonging to the threat feed for displaying dashboard links to threat feeds in Kibana.', + example: '5ba16340-72e6-11eb-a3e3-b3cc7c78a70f', + flat_name: 'threat.feed.dashboard_id', + ignore_above: 1024, + level: 'extended', + name: 'feed.dashboard_id', + normalize: [], + short: 'Feed dashboard ID.', + type: 'keyword', + }, + 'threat.feed.description': { + dashed_name: 'threat-feed-description', + description: 'Description of the threat feed in a UI friendly format.', + example: 'Threat feed from the AlienVault Open Threat eXchange network.', + flat_name: 'threat.feed.description', + ignore_above: 1024, + level: 'extended', + name: 'feed.description', + normalize: [], + short: 'Description of the threat feed.', + type: 'keyword', + }, + 'threat.feed.name': { + dashed_name: 'threat-feed-name', + description: 'The name of the threat feed in UI friendly format.', + example: 'AlienVault OTX', + flat_name: 'threat.feed.name', + ignore_above: 1024, + level: 'extended', + name: 'feed.name', + normalize: [], + short: 'Name of the threat feed.', + type: 'keyword', + }, + 'threat.feed.reference': { + dashed_name: 'threat-feed-reference', + description: 'Reference information for the threat feed in a UI friendly format.', + example: 'https://otx.alienvault.com', + flat_name: 'threat.feed.reference', + ignore_above: 1024, + level: 'extended', + name: 'feed.reference', + normalize: [], + short: 'Reference for the threat feed.', + type: 'keyword', + }, + 'threat.framework': { + dashed_name: 'threat-framework', + description: + 'Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.', + example: 'MITRE ATT&CK', + flat_name: 'threat.framework', + ignore_above: 1024, + level: 'extended', + name: 'framework', + normalize: [], + short: 'Threat classification framework.', + type: 'keyword', + }, + 'threat.group.alias': { + dashed_name: 'threat-group-alias', + description: + 'The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).', + example: '[ "Magecart Group 6" ]', + flat_name: 'threat.group.alias', + ignore_above: 1024, + level: 'extended', + name: 'group.alias', + normalize: ['array'], + short: 'Alias of the group.', + type: 'keyword', + }, + 'threat.group.id': { + dashed_name: 'threat-group-id', + description: + 'The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.', + example: 'G0037', + flat_name: 'threat.group.id', + ignore_above: 1024, + level: 'extended', + name: 'group.id', + normalize: [], + short: 'ID of the group.', + type: 'keyword', + }, + 'threat.group.name': { + dashed_name: 'threat-group-name', + description: + 'The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.', + example: 'FIN6', + flat_name: 'threat.group.name', + ignore_above: 1024, + level: 'extended', + name: 'group.name', + normalize: [], + short: 'Name of the group.', + type: 'keyword', + }, + 'threat.group.reference': { + dashed_name: 'threat-group-reference', + description: + 'The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.', + example: 'https://attack.mitre.org/groups/G0037/', + flat_name: 'threat.group.reference', + ignore_above: 1024, + level: 'extended', + name: 'group.reference', + normalize: [], + short: 'Reference URL of the group.', + type: 'keyword', + }, + 'threat.indicator.as.number': { + dashed_name: 'threat-indicator-as-number', + description: + 'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.', + example: 15169, + flat_name: 'threat.indicator.as.number', + level: 'extended', + name: 'number', + normalize: [], + original_fieldset: 'as', + short: 'Unique number allocated to the autonomous system.', + type: 'long', + }, + 'threat.indicator.as.organization.name': { + dashed_name: 'threat-indicator-as-organization-name', + description: 'Organization name.', + example: 'Google LLC', + flat_name: 'threat.indicator.as.organization.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.as.organization.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'organization.name', + normalize: [], + original_fieldset: 'as', + short: 'Organization name.', + type: 'keyword', + }, + 'threat.indicator.confidence': { + dashed_name: 'threat-indicator-confidence', + description: + 'Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.', + example: 'Medium', + expected_values: ['Not Specified', 'None', 'Low', 'Medium', 'High'], + flat_name: 'threat.indicator.confidence', + ignore_above: 1024, + level: 'extended', + name: 'indicator.confidence', + normalize: [], + short: 'Indicator confidence rating', + type: 'keyword', + }, + 'threat.indicator.description': { + dashed_name: 'threat-indicator-description', + description: 'Describes the type of action conducted by the threat.', + example: 'IP x.x.x.x was observed delivering the Angler EK.', + flat_name: 'threat.indicator.description', + ignore_above: 1024, + level: 'extended', + name: 'indicator.description', + normalize: [], + short: 'Indicator description', + type: 'keyword', + }, + 'threat.indicator.email.address': { + dashed_name: 'threat-indicator-email-address', + description: + 'Identifies a threat indicator as an email address (irrespective of direction).', + example: 'phish@example.com', + flat_name: 'threat.indicator.email.address', + ignore_above: 1024, + level: 'extended', + name: 'indicator.email.address', + normalize: [], + short: 'Indicator email address', + type: 'keyword', + }, + 'threat.indicator.file.accessed': { + dashed_name: 'threat-indicator-file-accessed', + description: + 'Last time the file was accessed.\nNote that not all filesystems keep track of access time.', + flat_name: 'threat.indicator.file.accessed', + level: 'extended', + name: 'accessed', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file was accessed.', + type: 'date', + }, + 'threat.indicator.file.attributes': { + dashed_name: 'threat-indicator-file-attributes', + description: + "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.", + example: '["readonly", "system"]', + flat_name: 'threat.indicator.file.attributes', + ignore_above: 1024, + level: 'extended', + name: 'attributes', + normalize: ['array'], + original_fieldset: 'file', + short: 'Array of file attributes.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.digest_algorithm': { + dashed_name: 'threat-indicator-file-code-signature-digest-algorithm', + description: + 'The hashing algorithm used to sign the process.\nThis value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.', + example: 'sha256', + flat_name: 'threat.indicator.file.code_signature.digest_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'digest_algorithm', + normalize: [], + original_fieldset: 'code_signature', + short: 'Hashing algorithm used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.exists': { + dashed_name: 'threat-indicator-file-code-signature-exists', + description: 'Boolean to capture if a signature is present.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.exists', + level: 'core', + name: 'exists', + normalize: [], + original_fieldset: 'code_signature', + short: 'Boolean to capture if a signature is present.', + type: 'boolean', + }, + 'threat.indicator.file.code_signature.signing_id': { + dashed_name: 'threat-indicator-file-code-signature-signing-id', + description: + 'The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.', + example: 'com.apple.xpc.proxy', + flat_name: 'threat.indicator.file.code_signature.signing_id', + ignore_above: 1024, + level: 'extended', + name: 'signing_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The identifier used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.status': { + dashed_name: 'threat-indicator-file-code-signature-status', + description: + 'Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.', + example: 'ERROR_UNTRUSTED_ROOT', + flat_name: 'threat.indicator.file.code_signature.status', + ignore_above: 1024, + level: 'extended', + name: 'status', + normalize: [], + original_fieldset: 'code_signature', + short: 'Additional information about the certificate status.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.subject_name': { + dashed_name: 'threat-indicator-file-code-signature-subject-name', + description: 'Subject name of the code signer', + example: 'Microsoft Corporation', + flat_name: 'threat.indicator.file.code_signature.subject_name', + ignore_above: 1024, + level: 'core', + name: 'subject_name', + normalize: [], + original_fieldset: 'code_signature', + short: 'Subject name of the code signer', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.team_id': { + dashed_name: 'threat-indicator-file-code-signature-team-id', + description: + 'The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.', + example: 'EQHXZ8M8AV', + flat_name: 'threat.indicator.file.code_signature.team_id', + ignore_above: 1024, + level: 'extended', + name: 'team_id', + normalize: [], + original_fieldset: 'code_signature', + short: 'The team identifier used to sign the process.', + type: 'keyword', + }, + 'threat.indicator.file.code_signature.timestamp': { + dashed_name: 'threat-indicator-file-code-signature-timestamp', + description: 'Date and time when the code signature was generated and signed.', + example: '2021-01-01T12:10:30Z', + flat_name: 'threat.indicator.file.code_signature.timestamp', + level: 'extended', + name: 'timestamp', + normalize: [], + original_fieldset: 'code_signature', + short: 'When the signature was generated and signed.', + type: 'date', + }, + 'threat.indicator.file.code_signature.trusted': { + dashed_name: 'threat-indicator-file-code-signature-trusted', + description: + 'Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.trusted', + level: 'extended', + name: 'trusted', + normalize: [], + original_fieldset: 'code_signature', + short: 'Stores the trust status of the certificate chain.', + type: 'boolean', + }, + 'threat.indicator.file.code_signature.valid': { + dashed_name: 'threat-indicator-file-code-signature-valid', + description: + 'Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.', + example: 'true', + flat_name: 'threat.indicator.file.code_signature.valid', + level: 'extended', + name: 'valid', + normalize: [], + original_fieldset: 'code_signature', + short: + 'Boolean to capture if the digital signature is verified against the binary content.', + type: 'boolean', + }, + 'threat.indicator.file.created': { + dashed_name: 'threat-indicator-file-created', + description: 'File creation time.\nNote that not all filesystems store the creation time.', + flat_name: 'threat.indicator.file.created', + level: 'extended', + name: 'created', + normalize: [], + original_fieldset: 'file', + short: 'File creation time.', + type: 'date', + }, + 'threat.indicator.file.ctime': { + dashed_name: 'threat-indicator-file-ctime', + description: + 'Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.', + flat_name: 'threat.indicator.file.ctime', + level: 'extended', + name: 'ctime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file attributes or metadata changed.', + type: 'date', + }, + 'threat.indicator.file.device': { + dashed_name: 'threat-indicator-file-device', + description: 'Device that is the source of the file.', + example: 'sda', + flat_name: 'threat.indicator.file.device', + ignore_above: 1024, + level: 'extended', + name: 'device', + normalize: [], + original_fieldset: 'file', + short: 'Device that is the source of the file.', + type: 'keyword', + }, + 'threat.indicator.file.directory': { + dashed_name: 'threat-indicator-file-directory', + description: + 'Directory where the file is located. It should include the drive letter, when appropriate.', + example: '/home/alice', + flat_name: 'threat.indicator.file.directory', + ignore_above: 1024, + level: 'extended', + name: 'directory', + normalize: [], + original_fieldset: 'file', + short: 'Directory where the file is located.', + type: 'keyword', + }, + 'threat.indicator.file.drive_letter': { + dashed_name: 'threat-indicator-file-drive-letter', + description: + 'Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.', + example: 'C', + flat_name: 'threat.indicator.file.drive_letter', + ignore_above: 1, + level: 'extended', + name: 'drive_letter', + normalize: [], + original_fieldset: 'file', + short: 'Drive letter where the file is located.', + type: 'keyword', + }, + 'threat.indicator.file.elf.architecture': { + dashed_name: 'threat-indicator-file-elf-architecture', + description: 'Machine architecture of the ELF file.', + example: 'x86-64', + flat_name: 'threat.indicator.file.elf.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'elf', + short: 'Machine architecture of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.byte_order': { + dashed_name: 'threat-indicator-file-elf-byte-order', + description: 'Byte sequence of ELF file.', + example: 'Little Endian', + flat_name: 'threat.indicator.file.elf.byte_order', + ignore_above: 1024, + level: 'extended', + name: 'byte_order', + normalize: [], + original_fieldset: 'elf', + short: 'Byte sequence of ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.cpu_type': { + dashed_name: 'threat-indicator-file-elf-cpu-type', + description: 'CPU type of the ELF file.', + example: 'Intel', + flat_name: 'threat.indicator.file.elf.cpu_type', + ignore_above: 1024, + level: 'extended', + name: 'cpu_type', + normalize: [], + original_fieldset: 'elf', + short: 'CPU type of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.creation_date': { + dashed_name: 'threat-indicator-file-elf-creation-date', + description: + "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators.", + flat_name: 'threat.indicator.file.elf.creation_date', + level: 'extended', + name: 'creation_date', + normalize: [], + original_fieldset: 'elf', + short: 'Build or compile date.', + type: 'date', + }, + 'threat.indicator.file.elf.exports': { + dashed_name: 'threat-indicator-file-elf-exports', + description: 'List of exported element names and types.', + flat_name: 'threat.indicator.file.elf.exports', + level: 'extended', + name: 'exports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of exported element names and types.', + type: 'flattened', + }, + 'threat.indicator.file.elf.header.abi_version': { + dashed_name: 'threat-indicator-file-elf-header-abi-version', + description: 'Version of the ELF Application Binary Interface (ABI).', + flat_name: 'threat.indicator.file.elf.header.abi_version', + ignore_above: 1024, + level: 'extended', + name: 'header.abi_version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF Application Binary Interface (ABI).', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.class': { + dashed_name: 'threat-indicator-file-elf-header-class', + description: 'Header class of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.class', + ignore_above: 1024, + level: 'extended', + name: 'header.class', + normalize: [], + original_fieldset: 'elf', + short: 'Header class of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.data': { + dashed_name: 'threat-indicator-file-elf-header-data', + description: 'Data table of the ELF header.', + flat_name: 'threat.indicator.file.elf.header.data', + ignore_above: 1024, + level: 'extended', + name: 'header.data', + normalize: [], + original_fieldset: 'elf', + short: 'Data table of the ELF header.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.entrypoint': { + dashed_name: 'threat-indicator-file-elf-header-entrypoint', + description: 'Header entrypoint of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.entrypoint', + format: 'string', + level: 'extended', + name: 'header.entrypoint', + normalize: [], + original_fieldset: 'elf', + short: 'Header entrypoint of the ELF file.', + type: 'long', + }, + 'threat.indicator.file.elf.header.object_version': { + dashed_name: 'threat-indicator-file-elf-header-object-version', + description: '"0x1" for original ELF files.', + flat_name: 'threat.indicator.file.elf.header.object_version', + ignore_above: 1024, + level: 'extended', + name: 'header.object_version', + normalize: [], + original_fieldset: 'elf', + short: '"0x1" for original ELF files.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.os_abi': { + dashed_name: 'threat-indicator-file-elf-header-os-abi', + description: 'Application Binary Interface (ABI) of the Linux OS.', + flat_name: 'threat.indicator.file.elf.header.os_abi', + ignore_above: 1024, + level: 'extended', + name: 'header.os_abi', + normalize: [], + original_fieldset: 'elf', + short: 'Application Binary Interface (ABI) of the Linux OS.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.type': { + dashed_name: 'threat-indicator-file-elf-header-type', + description: 'Header type of the ELF file.', + flat_name: 'threat.indicator.file.elf.header.type', + ignore_above: 1024, + level: 'extended', + name: 'header.type', + normalize: [], + original_fieldset: 'elf', + short: 'Header type of the ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.elf.header.version': { + dashed_name: 'threat-indicator-file-elf-header-version', + description: 'Version of the ELF header.', + flat_name: 'threat.indicator.file.elf.header.version', + ignore_above: 1024, + level: 'extended', + name: 'header.version', + normalize: [], + original_fieldset: 'elf', + short: 'Version of the ELF header.', + type: 'keyword', + }, + 'threat.indicator.file.elf.imports': { + dashed_name: 'threat-indicator-file-elf-imports', + description: 'List of imported element names and types.', + flat_name: 'threat.indicator.file.elf.imports', + level: 'extended', + name: 'imports', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of imported element names and types.', + type: 'flattened', + }, + 'threat.indicator.file.elf.sections': { + dashed_name: 'threat-indicator-file-elf-sections', + description: + 'An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`.', + flat_name: 'threat.indicator.file.elf.sections', + level: 'extended', + name: 'sections', + normalize: ['array'], + original_fieldset: 'elf', + short: 'Section information of the ELF file.', + type: 'nested', + }, + 'threat.indicator.file.elf.sections.chi2': { + dashed_name: 'threat-indicator-file-elf-sections-chi2', + description: 'Chi-square probability distribution of the section.', + flat_name: 'threat.indicator.file.elf.sections.chi2', + format: 'number', + level: 'extended', + name: 'sections.chi2', + normalize: [], + original_fieldset: 'elf', + short: 'Chi-square probability distribution of the section.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.entropy': { + dashed_name: 'threat-indicator-file-elf-sections-entropy', + description: 'Shannon entropy calculation from the section.', + flat_name: 'threat.indicator.file.elf.sections.entropy', + format: 'number', + level: 'extended', + name: 'sections.entropy', + normalize: [], + original_fieldset: 'elf', + short: 'Shannon entropy calculation from the section.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.flags': { + dashed_name: 'threat-indicator-file-elf-sections-flags', + description: 'ELF Section List flags.', + flat_name: 'threat.indicator.file.elf.sections.flags', + ignore_above: 1024, + level: 'extended', + name: 'sections.flags', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List flags.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.name': { + dashed_name: 'threat-indicator-file-elf-sections-name', + description: 'ELF Section List name.', + flat_name: 'threat.indicator.file.elf.sections.name', + ignore_above: 1024, + level: 'extended', + name: 'sections.name', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List name.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.physical_offset': { + dashed_name: 'threat-indicator-file-elf-sections-physical-offset', + description: 'ELF Section List offset.', + flat_name: 'threat.indicator.file.elf.sections.physical_offset', + ignore_above: 1024, + level: 'extended', + name: 'sections.physical_offset', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List offset.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.physical_size': { + dashed_name: 'threat-indicator-file-elf-sections-physical-size', + description: 'ELF Section List physical size.', + flat_name: 'threat.indicator.file.elf.sections.physical_size', + format: 'bytes', + level: 'extended', + name: 'sections.physical_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List physical size.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.type': { + dashed_name: 'threat-indicator-file-elf-sections-type', + description: 'ELF Section List type.', + flat_name: 'threat.indicator.file.elf.sections.type', + ignore_above: 1024, + level: 'extended', + name: 'sections.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List type.', + type: 'keyword', + }, + 'threat.indicator.file.elf.sections.virtual_address': { + dashed_name: 'threat-indicator-file-elf-sections-virtual-address', + description: 'ELF Section List virtual address.', + flat_name: 'threat.indicator.file.elf.sections.virtual_address', + format: 'string', + level: 'extended', + name: 'sections.virtual_address', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual address.', + type: 'long', + }, + 'threat.indicator.file.elf.sections.virtual_size': { + dashed_name: 'threat-indicator-file-elf-sections-virtual-size', + description: 'ELF Section List virtual size.', + flat_name: 'threat.indicator.file.elf.sections.virtual_size', + format: 'string', + level: 'extended', + name: 'sections.virtual_size', + normalize: [], + original_fieldset: 'elf', + short: 'ELF Section List virtual size.', + type: 'long', + }, + 'threat.indicator.file.elf.segments': { + dashed_name: 'threat-indicator-file-elf-segments', + description: + 'An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`.', + flat_name: 'threat.indicator.file.elf.segments', + level: 'extended', + name: 'segments', + normalize: ['array'], + original_fieldset: 'elf', + short: 'ELF object segment list.', + type: 'nested', + }, + 'threat.indicator.file.elf.segments.sections': { + dashed_name: 'threat-indicator-file-elf-segments-sections', + description: 'ELF object segment sections.', + flat_name: 'threat.indicator.file.elf.segments.sections', + ignore_above: 1024, + level: 'extended', + name: 'segments.sections', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment sections.', + type: 'keyword', + }, + 'threat.indicator.file.elf.segments.type': { + dashed_name: 'threat-indicator-file-elf-segments-type', + description: 'ELF object segment type.', + flat_name: 'threat.indicator.file.elf.segments.type', + ignore_above: 1024, + level: 'extended', + name: 'segments.type', + normalize: [], + original_fieldset: 'elf', + short: 'ELF object segment type.', + type: 'keyword', + }, + 'threat.indicator.file.elf.shared_libraries': { + dashed_name: 'threat-indicator-file-elf-shared-libraries', + description: 'List of shared libraries used by this ELF object.', + flat_name: 'threat.indicator.file.elf.shared_libraries', + ignore_above: 1024, + level: 'extended', + name: 'shared_libraries', + normalize: ['array'], + original_fieldset: 'elf', + short: 'List of shared libraries used by this ELF object.', + type: 'keyword', + }, + 'threat.indicator.file.elf.telfhash': { + dashed_name: 'threat-indicator-file-elf-telfhash', + description: 'telfhash symbol hash for ELF file.', + flat_name: 'threat.indicator.file.elf.telfhash', + ignore_above: 1024, + level: 'extended', + name: 'telfhash', + normalize: [], + original_fieldset: 'elf', + short: 'telfhash hash for ELF file.', + type: 'keyword', + }, + 'threat.indicator.file.extension': { + dashed_name: 'threat-indicator-file-extension', + description: + 'File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.indicator.file.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'file', + short: 'File extension, excluding the leading dot.', + type: 'keyword', + }, + 'threat.indicator.file.fork_name': { + dashed_name: 'threat-indicator-file-fork-name', + description: + 'A fork is additional data associated with a filesystem object.\nOn Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist.\nOn NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\\path\\to\\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name.', + example: 'Zone.Identifer', + flat_name: 'threat.indicator.file.fork_name', + ignore_above: 1024, + level: 'extended', + name: 'fork_name', + normalize: [], + original_fieldset: 'file', + short: 'A fork is additional data associated with a filesystem object.', + type: 'keyword', + }, + 'threat.indicator.file.gid': { + dashed_name: 'threat-indicator-file-gid', + description: 'Primary group ID (GID) of the file.', + example: '1001', + flat_name: 'threat.indicator.file.gid', + ignore_above: 1024, + level: 'extended', + name: 'gid', + normalize: [], + original_fieldset: 'file', + short: 'Primary group ID (GID) of the file.', + type: 'keyword', + }, + 'threat.indicator.file.group': { + dashed_name: 'threat-indicator-file-group', + description: 'Primary group name of the file.', + example: 'alice', + flat_name: 'threat.indicator.file.group', + ignore_above: 1024, + level: 'extended', + name: 'group', + normalize: [], + original_fieldset: 'file', + short: 'Primary group name of the file.', + type: 'keyword', + }, + 'threat.indicator.file.hash.md5': { + dashed_name: 'threat-indicator-file-hash-md5', + description: 'MD5 hash.', + flat_name: 'threat.indicator.file.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'md5', + normalize: [], + original_fieldset: 'hash', + short: 'MD5 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha1': { + dashed_name: 'threat-indicator-file-hash-sha1', + description: 'SHA1 hash.', + flat_name: 'threat.indicator.file.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'sha1', + normalize: [], + original_fieldset: 'hash', + short: 'SHA1 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha256': { + dashed_name: 'threat-indicator-file-hash-sha256', + description: 'SHA256 hash.', + flat_name: 'threat.indicator.file.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'sha256', + normalize: [], + original_fieldset: 'hash', + short: 'SHA256 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha384': { + dashed_name: 'threat-indicator-file-hash-sha384', + description: 'SHA384 hash.', + flat_name: 'threat.indicator.file.hash.sha384', + ignore_above: 1024, + level: 'extended', + name: 'sha384', + normalize: [], + original_fieldset: 'hash', + short: 'SHA384 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.sha512': { + dashed_name: 'threat-indicator-file-hash-sha512', + description: 'SHA512 hash.', + flat_name: 'threat.indicator.file.hash.sha512', + ignore_above: 1024, + level: 'extended', + name: 'sha512', + normalize: [], + original_fieldset: 'hash', + short: 'SHA512 hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.ssdeep': { + dashed_name: 'threat-indicator-file-hash-ssdeep', + description: 'SSDEEP hash.', + flat_name: 'threat.indicator.file.hash.ssdeep', + ignore_above: 1024, + level: 'extended', + name: 'ssdeep', + normalize: [], + original_fieldset: 'hash', + short: 'SSDEEP hash.', + type: 'keyword', + }, + 'threat.indicator.file.hash.tlsh': { + dashed_name: 'threat-indicator-file-hash-tlsh', + description: 'TLSH hash.', + flat_name: 'threat.indicator.file.hash.tlsh', + ignore_above: 1024, + level: 'extended', + name: 'tlsh', + normalize: [], + original_fieldset: 'hash', + short: 'TLSH hash.', + type: 'keyword', + }, + 'threat.indicator.file.inode': { + dashed_name: 'threat-indicator-file-inode', + description: 'Inode representing the file in the filesystem.', + example: '256383', + flat_name: 'threat.indicator.file.inode', + ignore_above: 1024, + level: 'extended', + name: 'inode', + normalize: [], + original_fieldset: 'file', + short: 'Inode representing the file in the filesystem.', + type: 'keyword', + }, + 'threat.indicator.file.mime_type': { + dashed_name: 'threat-indicator-file-mime-type', + description: + 'MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.', + flat_name: 'threat.indicator.file.mime_type', + ignore_above: 1024, + level: 'extended', + name: 'mime_type', + normalize: [], + original_fieldset: 'file', + short: 'Media type of file, document, or arrangement of bytes.', + type: 'keyword', + }, + 'threat.indicator.file.mode': { + dashed_name: 'threat-indicator-file-mode', + description: 'Mode of the file in octal representation.', + example: '0640', + flat_name: 'threat.indicator.file.mode', + ignore_above: 1024, + level: 'extended', + name: 'mode', + normalize: [], + original_fieldset: 'file', + short: 'Mode of the file in octal representation.', + type: 'keyword', + }, + 'threat.indicator.file.mtime': { + dashed_name: 'threat-indicator-file-mtime', + description: 'Last time the file content was modified.', + flat_name: 'threat.indicator.file.mtime', + level: 'extended', + name: 'mtime', + normalize: [], + original_fieldset: 'file', + short: 'Last time the file content was modified.', + type: 'date', + }, + 'threat.indicator.file.name': { + dashed_name: 'threat-indicator-file-name', + description: 'Name of the file including the extension, without the directory.', + example: 'example.png', + flat_name: 'threat.indicator.file.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'file', + short: 'Name of the file including the extension, without the directory.', + type: 'keyword', + }, + 'threat.indicator.file.owner': { + dashed_name: 'threat-indicator-file-owner', + description: "File owner's username.", + example: 'alice', + flat_name: 'threat.indicator.file.owner', + ignore_above: 1024, + level: 'extended', + name: 'owner', + normalize: [], + original_fieldset: 'file', + short: "File owner's username.", + type: 'keyword', + }, + 'threat.indicator.file.path': { + dashed_name: 'threat-indicator-file-path', + description: + 'Full path to the file, including the file name. It should include the drive letter, when appropriate.', + example: '/home/alice/example.png', + flat_name: 'threat.indicator.file.path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.file.path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'path', + normalize: [], + original_fieldset: 'file', + short: 'Full path to the file, including the file name.', + type: 'keyword', + }, + 'threat.indicator.file.pe.architecture': { + dashed_name: 'threat-indicator-file-pe-architecture', + description: 'CPU architecture target for the file.', + example: 'x64', + flat_name: 'threat.indicator.file.pe.architecture', + ignore_above: 1024, + level: 'extended', + name: 'architecture', + normalize: [], + original_fieldset: 'pe', + short: 'CPU architecture target for the file.', + type: 'keyword', + }, + 'threat.indicator.file.pe.company': { + dashed_name: 'threat-indicator-file-pe-company', + description: 'Internal company name of the file, provided at compile-time.', + example: 'Microsoft Corporation', + flat_name: 'threat.indicator.file.pe.company', + ignore_above: 1024, + level: 'extended', + name: 'company', + normalize: [], + original_fieldset: 'pe', + short: 'Internal company name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.description': { + dashed_name: 'threat-indicator-file-pe-description', + description: 'Internal description of the file, provided at compile-time.', + example: 'Paint', + flat_name: 'threat.indicator.file.pe.description', + ignore_above: 1024, + level: 'extended', + name: 'description', + normalize: [], + original_fieldset: 'pe', + short: 'Internal description of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.file_version': { + dashed_name: 'threat-indicator-file-pe-file-version', + description: 'Internal version of the file, provided at compile-time.', + example: '6.3.9600.17415', + flat_name: 'threat.indicator.file.pe.file_version', + ignore_above: 1024, + level: 'extended', + name: 'file_version', + normalize: [], + original_fieldset: 'pe', + short: 'Process name.', + type: 'keyword', + }, + 'threat.indicator.file.pe.imphash': { + dashed_name: 'threat-indicator-file-pe-imphash', + description: + 'A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.', + example: '0c6803c4e922103c4dca5963aad36ddf', + flat_name: 'threat.indicator.file.pe.imphash', + ignore_above: 1024, + level: 'extended', + name: 'imphash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the imports in a PE file.', + type: 'keyword', + }, + 'threat.indicator.file.pe.original_file_name': { + dashed_name: 'threat-indicator-file-pe-original-file-name', + description: 'Internal name of the file, provided at compile-time.', + example: 'MSPAINT.EXE', + flat_name: 'threat.indicator.file.pe.original_file_name', + ignore_above: 1024, + level: 'extended', + name: 'original_file_name', + normalize: [], + original_fieldset: 'pe', + short: 'Internal name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.pe.pehash': { + dashed_name: 'threat-indicator-file-pe-pehash', + description: + 'A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.', + example: '73ff189b63cd6be375a7ff25179a38d347651975', + flat_name: 'threat.indicator.file.pe.pehash', + ignore_above: 1024, + level: 'extended', + name: 'pehash', + normalize: [], + original_fieldset: 'pe', + short: 'A hash of the PE header and data from one or more PE sections.', + type: 'keyword', + }, + 'threat.indicator.file.pe.product': { + dashed_name: 'threat-indicator-file-pe-product', + description: 'Internal product name of the file, provided at compile-time.', + example: 'Microsoft® Windows® Operating System', + flat_name: 'threat.indicator.file.pe.product', + ignore_above: 1024, + level: 'extended', + name: 'product', + normalize: [], + original_fieldset: 'pe', + short: 'Internal product name of the file, provided at compile-time.', + type: 'keyword', + }, + 'threat.indicator.file.size': { + dashed_name: 'threat-indicator-file-size', + description: 'File size in bytes.\nOnly relevant when `file.type` is "file".', + example: 16384, + flat_name: 'threat.indicator.file.size', + level: 'extended', + name: 'size', + normalize: [], + original_fieldset: 'file', + short: 'File size in bytes.', + type: 'long', + }, + 'threat.indicator.file.target_path': { + dashed_name: 'threat-indicator-file-target-path', + description: 'Target path for symlinks.', + flat_name: 'threat.indicator.file.target_path', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.file.target_path.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'target_path', + normalize: [], + original_fieldset: 'file', + short: 'Target path for symlinks.', + type: 'keyword', + }, + 'threat.indicator.file.type': { + dashed_name: 'threat-indicator-file-type', + description: 'File type (file, dir, or symlink).', + example: 'file', + flat_name: 'threat.indicator.file.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'file', + short: 'File type (file, dir, or symlink).', + type: 'keyword', + }, + 'threat.indicator.file.uid': { + dashed_name: 'threat-indicator-file-uid', + description: 'The user ID (UID) or security identifier (SID) of the file owner.', + example: '1001', + flat_name: 'threat.indicator.file.uid', + ignore_above: 1024, + level: 'extended', + name: 'uid', + normalize: [], + original_fieldset: 'file', + short: 'The user ID (UID) or security identifier (SID) of the file owner.', + type: 'keyword', + }, + 'threat.indicator.file.x509.alternative_names': { + dashed_name: 'threat-indicator-file-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.indicator.file.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.common_name': { + dashed_name: 'threat-indicator-file-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.file.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.country': { + dashed_name: 'threat-indicator-file-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.indicator.file.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.distinguished_name': { + dashed_name: 'threat-indicator-file-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.file.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.locality': { + dashed_name: 'threat-indicator-file-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.indicator.file.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.organization': { + dashed_name: 'threat-indicator-file-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.indicator.file.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.organizational_unit': { + dashed_name: 'threat-indicator-file-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.indicator.file.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.issuer.state_or_province': { + dashed_name: 'threat-indicator-file-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.file.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.file.x509.not_after': { + dashed_name: 'threat-indicator-file-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.indicator.file.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.indicator.file.x509.not_before': { + dashed_name: 'threat-indicator-file-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.indicator.file.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.indicator.file.x509.public_key_algorithm': { + dashed_name: 'threat-indicator-file-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.indicator.file.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.indicator.file.x509.public_key_curve': { + dashed_name: 'threat-indicator-file-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.indicator.file.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.indicator.file.x509.public_key_exponent': { + dashed_name: 'threat-indicator-file-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.indicator.file.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.indicator.file.x509.public_key_size': { + dashed_name: 'threat-indicator-file-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.indicator.file.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.indicator.file.x509.serial_number': { + dashed_name: 'threat-indicator-file-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.indicator.file.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.indicator.file.x509.signature_algorithm': { + dashed_name: 'threat-indicator-file-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.indicator.file.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.common_name': { + dashed_name: 'threat-indicator-file-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.indicator.file.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.country': { + dashed_name: 'threat-indicator-file-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.indicator.file.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.distinguished_name': { + dashed_name: 'threat-indicator-file-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.indicator.file.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.locality': { + dashed_name: 'threat-indicator-file-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.indicator.file.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.organization': { + dashed_name: 'threat-indicator-file-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.indicator.file.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.organizational_unit': { + dashed_name: 'threat-indicator-file-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.indicator.file.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.indicator.file.x509.subject.state_or_province': { + dashed_name: 'threat-indicator-file-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.file.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.file.x509.version_number': { + dashed_name: 'threat-indicator-file-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.indicator.file.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.indicator.first_seen': { + dashed_name: 'threat-indicator-first-seen', + description: + 'The date and time when intelligence source first reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.first_seen', + level: 'extended', + name: 'indicator.first_seen', + normalize: [], + short: 'Date/time indicator was first reported.', + type: 'date', + }, + 'threat.indicator.geo.city_name': { + dashed_name: 'threat-indicator-geo-city-name', + description: 'City name.', + example: 'Montreal', + flat_name: 'threat.indicator.geo.city_name', + ignore_above: 1024, + level: 'core', + name: 'city_name', + normalize: [], + original_fieldset: 'geo', + short: 'City name.', + type: 'keyword', + }, + 'threat.indicator.geo.continent_code': { + dashed_name: 'threat-indicator-geo-continent-code', + description: "Two-letter code representing continent's name.", + example: 'NA', + flat_name: 'threat.indicator.geo.continent_code', + ignore_above: 1024, + level: 'core', + name: 'continent_code', + normalize: [], + original_fieldset: 'geo', + short: 'Continent code.', + type: 'keyword', + }, + 'threat.indicator.geo.continent_name': { + dashed_name: 'threat-indicator-geo-continent-name', + description: 'Name of the continent.', + example: 'North America', + flat_name: 'threat.indicator.geo.continent_name', + ignore_above: 1024, + level: 'core', + name: 'continent_name', + normalize: [], + original_fieldset: 'geo', + short: 'Name of the continent.', + type: 'keyword', + }, + 'threat.indicator.geo.country_iso_code': { + dashed_name: 'threat-indicator-geo-country-iso-code', + description: 'Country ISO code.', + example: 'CA', + flat_name: 'threat.indicator.geo.country_iso_code', + ignore_above: 1024, + level: 'core', + name: 'country_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Country ISO code.', + type: 'keyword', + }, + 'threat.indicator.geo.country_name': { + dashed_name: 'threat-indicator-geo-country-name', + description: 'Country name.', + example: 'Canada', + flat_name: 'threat.indicator.geo.country_name', + ignore_above: 1024, + level: 'core', + name: 'country_name', + normalize: [], + original_fieldset: 'geo', + short: 'Country name.', + type: 'keyword', + }, + 'threat.indicator.geo.location': { + dashed_name: 'threat-indicator-geo-location', + description: 'Longitude and latitude.', + example: '{ "lon": -73.614830, "lat": 45.505918 }', + flat_name: 'threat.indicator.geo.location', + level: 'core', + name: 'location', + normalize: [], + original_fieldset: 'geo', + short: 'Longitude and latitude.', + type: 'geo_point', + }, + 'threat.indicator.geo.name': { + dashed_name: 'threat-indicator-geo-name', + description: + 'User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.', + example: 'boston-dc', + flat_name: 'threat.indicator.geo.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'geo', + short: 'User-defined description of a location.', + type: 'keyword', + }, + 'threat.indicator.geo.postal_code': { + dashed_name: 'threat-indicator-geo-postal-code', + description: + 'Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.', + example: 94040, + flat_name: 'threat.indicator.geo.postal_code', + ignore_above: 1024, + level: 'core', + name: 'postal_code', + normalize: [], + original_fieldset: 'geo', + short: 'Postal code.', + type: 'keyword', + }, + 'threat.indicator.geo.region_iso_code': { + dashed_name: 'threat-indicator-geo-region-iso-code', + description: 'Region ISO code.', + example: 'CA-QC', + flat_name: 'threat.indicator.geo.region_iso_code', + ignore_above: 1024, + level: 'core', + name: 'region_iso_code', + normalize: [], + original_fieldset: 'geo', + short: 'Region ISO code.', + type: 'keyword', + }, + 'threat.indicator.geo.region_name': { + dashed_name: 'threat-indicator-geo-region-name', + description: 'Region name.', + example: 'Quebec', + flat_name: 'threat.indicator.geo.region_name', + ignore_above: 1024, + level: 'core', + name: 'region_name', + normalize: [], + original_fieldset: 'geo', + short: 'Region name.', + type: 'keyword', + }, + 'threat.indicator.geo.timezone': { + dashed_name: 'threat-indicator-geo-timezone', + description: 'The time zone of the location, such as IANA time zone name.', + example: 'America/Argentina/Buenos_Aires', + flat_name: 'threat.indicator.geo.timezone', + ignore_above: 1024, + level: 'core', + name: 'timezone', + normalize: [], + original_fieldset: 'geo', + short: 'Time zone.', + type: 'keyword', + }, + 'threat.indicator.ip': { + dashed_name: 'threat-indicator-ip', + description: 'Identifies a threat indicator as an IP address (irrespective of direction).', + example: '1.2.3.4', + flat_name: 'threat.indicator.ip', + level: 'extended', + name: 'indicator.ip', + normalize: [], + short: 'Indicator IP address', + type: 'ip', + }, + 'threat.indicator.last_seen': { + dashed_name: 'threat-indicator-last-seen', + description: + 'The date and time when intelligence source last reported sighting this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.last_seen', + level: 'extended', + name: 'indicator.last_seen', + normalize: [], + short: 'Date/time indicator was last reported.', + type: 'date', + }, + 'threat.indicator.marking.tlp': { + dashed_name: 'threat-indicator-marking-tlp', + description: 'Traffic Light Protocol sharing markings.', + example: 'CLEAR', + expected_values: ['WHITE', 'CLEAR', 'GREEN', 'AMBER', 'AMBER+STRICT', 'RED'], + flat_name: 'threat.indicator.marking.tlp', + ignore_above: 1024, + level: 'extended', + name: 'indicator.marking.tlp', + normalize: [], + short: 'Indicator TLP marking', + type: 'keyword', + }, + 'threat.indicator.modified_at': { + dashed_name: 'threat-indicator-modified-at', + description: + 'The date and time when intelligence source last modified information for this indicator.', + example: '2020-11-05T17:25:47.000Z', + flat_name: 'threat.indicator.modified_at', + level: 'extended', + name: 'indicator.modified_at', + normalize: [], + short: 'Date/time indicator was last updated.', + type: 'date', + }, + 'threat.indicator.port': { + dashed_name: 'threat-indicator-port', + description: 'Identifies a threat indicator as a port number (irrespective of direction).', + example: 443, + flat_name: 'threat.indicator.port', + level: 'extended', + name: 'indicator.port', + normalize: [], + short: 'Indicator port', + type: 'long', + }, + 'threat.indicator.provider': { + dashed_name: 'threat-indicator-provider', + description: "The name of the indicator's provider.", + example: 'lrz_urlhaus', + flat_name: 'threat.indicator.provider', + ignore_above: 1024, + level: 'extended', + name: 'indicator.provider', + normalize: [], + short: 'Indicator provider', + type: 'keyword', + }, + 'threat.indicator.reference': { + dashed_name: 'threat-indicator-reference', + description: 'Reference URL linking to additional information about this indicator.', + example: 'https://system.example.com/indicator/0001234', + flat_name: 'threat.indicator.reference', + ignore_above: 1024, + level: 'extended', + name: 'indicator.reference', + normalize: [], + short: 'Indicator reference URL', + type: 'keyword', + }, + 'threat.indicator.registry.data.bytes': { + dashed_name: 'threat-indicator-registry-data-bytes', + description: + 'Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.', + example: 'ZQBuAC0AVQBTAAAAZQBuAAAAAAA=', + flat_name: 'threat.indicator.registry.data.bytes', + ignore_above: 1024, + level: 'extended', + name: 'data.bytes', + normalize: [], + original_fieldset: 'registry', + short: 'Original bytes written with base64 encoding.', + type: 'keyword', + }, + 'threat.indicator.registry.data.strings': { + dashed_name: 'threat-indicator-registry-data-strings', + description: + 'Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).', + example: '["C:\\rta\\red_ttp\\bin\\myapp.exe"]', + flat_name: 'threat.indicator.registry.data.strings', + level: 'core', + name: 'data.strings', + normalize: ['array'], + original_fieldset: 'registry', + short: 'List of strings representing what was written to the registry.', + type: 'wildcard', + }, + 'threat.indicator.registry.data.type': { + dashed_name: 'threat-indicator-registry-data-type', + description: 'Standard registry type for encoding contents', + example: 'REG_SZ', + flat_name: 'threat.indicator.registry.data.type', + ignore_above: 1024, + level: 'core', + name: 'data.type', + normalize: [], + original_fieldset: 'registry', + short: 'Standard registry type for encoding contents', + type: 'keyword', + }, + 'threat.indicator.registry.hive': { + dashed_name: 'threat-indicator-registry-hive', + description: 'Abbreviated name for the hive.', + example: 'HKLM', + flat_name: 'threat.indicator.registry.hive', + ignore_above: 1024, + level: 'core', + name: 'hive', + normalize: [], + original_fieldset: 'registry', + short: 'Abbreviated name for the hive.', + type: 'keyword', + }, + 'threat.indicator.registry.key': { + dashed_name: 'threat-indicator-registry-key', + description: 'Hive-relative path of keys.', + example: + 'SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe', + flat_name: 'threat.indicator.registry.key', + ignore_above: 1024, + level: 'core', + name: 'key', + normalize: [], + original_fieldset: 'registry', + short: 'Hive-relative path of keys.', + type: 'keyword', + }, + 'threat.indicator.registry.path': { + dashed_name: 'threat-indicator-registry-path', + description: 'Full path, including hive, key and value', + example: + 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger', + flat_name: 'threat.indicator.registry.path', + ignore_above: 1024, + level: 'core', + name: 'path', + normalize: [], + original_fieldset: 'registry', + short: 'Full path, including hive, key and value', + type: 'keyword', + }, + 'threat.indicator.registry.value': { + dashed_name: 'threat-indicator-registry-value', + description: 'Name of the value written.', + example: 'Debugger', + flat_name: 'threat.indicator.registry.value', + ignore_above: 1024, + level: 'core', + name: 'value', + normalize: [], + original_fieldset: 'registry', + short: 'Name of the value written.', + type: 'keyword', + }, + 'threat.indicator.scanner_stats': { + dashed_name: 'threat-indicator-scanner-stats', + description: 'Count of AV/EDR vendors that successfully detected malicious file or URL.', + example: 4, + flat_name: 'threat.indicator.scanner_stats', + level: 'extended', + name: 'indicator.scanner_stats', + normalize: [], + short: 'Scanner statistics', + type: 'long', + }, + 'threat.indicator.sightings': { + dashed_name: 'threat-indicator-sightings', + description: 'Number of times this indicator was observed conducting threat activity.', + example: 20, + flat_name: 'threat.indicator.sightings', + level: 'extended', + name: 'indicator.sightings', + normalize: [], + short: 'Number of times indicator observed', + type: 'long', + }, + 'threat.indicator.type': { + dashed_name: 'threat-indicator-type', + description: 'Type of indicator as represented by Cyber Observable in STIX 2.0.', + example: 'ipv4-addr', + expected_values: [ + 'autonomous-system', + 'artifact', + 'directory', + 'domain-name', + 'email-addr', + 'file', + 'ipv4-addr', + 'ipv6-addr', + 'mac-addr', + 'mutex', + 'port', + 'process', + 'software', + 'url', + 'user-account', + 'windows-registry-key', + 'x509-certificate', + ], + flat_name: 'threat.indicator.type', + ignore_above: 1024, + level: 'extended', + name: 'indicator.type', + normalize: [], + short: 'Type of indicator', + type: 'keyword', + }, + 'threat.indicator.url.domain': { + dashed_name: 'threat-indicator-url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'threat.indicator.url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'url', + short: 'Domain of the url.', + type: 'keyword', + }, + 'threat.indicator.url.extension': { + dashed_name: 'threat-indicator-url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'threat.indicator.url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + original_fieldset: 'url', + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'threat.indicator.url.fragment': { + dashed_name: 'threat-indicator-url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'threat.indicator.url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + original_fieldset: 'url', + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'threat.indicator.url.full': { + dashed_name: 'threat-indicator-url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'threat.indicator.url.full', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.url.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'url', + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'threat.indicator.url.original': { + dashed_name: 'threat-indicator-url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'threat.indicator.url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.indicator.url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + original_fieldset: 'url', + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'threat.indicator.url.password': { + dashed_name: 'threat-indicator-url-password', + description: 'Password of the request.', + flat_name: 'threat.indicator.url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + original_fieldset: 'url', + short: 'Password of the request.', + type: 'keyword', + }, + 'threat.indicator.url.path': { + dashed_name: 'threat-indicator-url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'threat.indicator.url.path', + level: 'extended', + name: 'path', + normalize: [], + original_fieldset: 'url', + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'threat.indicator.url.port': { + dashed_name: 'threat-indicator-url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'threat.indicator.url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + original_fieldset: 'url', + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'threat.indicator.url.query': { + dashed_name: 'threat-indicator-url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'threat.indicator.url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + original_fieldset: 'url', + short: 'Query string of the request.', + type: 'keyword', + }, + 'threat.indicator.url.registered_domain': { + dashed_name: 'threat-indicator-url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'threat.indicator.url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + original_fieldset: 'url', + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'threat.indicator.url.scheme': { + dashed_name: 'threat-indicator-url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'threat.indicator.url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + original_fieldset: 'url', + short: 'Scheme of the url.', + type: 'keyword', + }, + 'threat.indicator.url.subdomain': { + dashed_name: 'threat-indicator-url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'threat.indicator.url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + original_fieldset: 'url', + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'threat.indicator.url.top_level_domain': { + dashed_name: 'threat-indicator-url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'threat.indicator.url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + original_fieldset: 'url', + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'threat.indicator.url.username': { + dashed_name: 'threat-indicator-url-username', + description: 'Username of the request.', + flat_name: 'threat.indicator.url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + original_fieldset: 'url', + short: 'Username of the request.', + type: 'keyword', + }, + 'threat.indicator.x509.alternative_names': { + dashed_name: 'threat-indicator-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'threat.indicator.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.common_name': { + dashed_name: 'threat-indicator-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.country': { + dashed_name: 'threat-indicator-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'threat.indicator.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.distinguished_name': { + dashed_name: 'threat-indicator-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'threat.indicator.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.locality': { + dashed_name: 'threat-indicator-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'threat.indicator.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.organization': { + dashed_name: 'threat-indicator-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'threat.indicator.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.organizational_unit': { + dashed_name: 'threat-indicator-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'threat.indicator.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.issuer.state_or_province': { + dashed_name: 'threat-indicator-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.x509.not_after': { + dashed_name: 'threat-indicator-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'threat.indicator.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'threat.indicator.x509.not_before': { + dashed_name: 'threat-indicator-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'threat.indicator.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'threat.indicator.x509.public_key_algorithm': { + dashed_name: 'threat-indicator-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'threat.indicator.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'threat.indicator.x509.public_key_curve': { + dashed_name: 'threat-indicator-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'threat.indicator.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'threat.indicator.x509.public_key_exponent': { + dashed_name: 'threat-indicator-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'threat.indicator.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'threat.indicator.x509.public_key_size': { + dashed_name: 'threat-indicator-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'threat.indicator.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'threat.indicator.x509.serial_number': { + dashed_name: 'threat-indicator-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'threat.indicator.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'threat.indicator.x509.signature_algorithm': { + dashed_name: 'threat-indicator-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'threat.indicator.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.common_name': { + dashed_name: 'threat-indicator-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'threat.indicator.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.country': { + dashed_name: 'threat-indicator-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'threat.indicator.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'threat.indicator.x509.subject.distinguished_name': { + dashed_name: 'threat-indicator-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'threat.indicator.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.locality': { + dashed_name: 'threat-indicator-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'threat.indicator.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'threat.indicator.x509.subject.organization': { + dashed_name: 'threat-indicator-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'threat.indicator.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.organizational_unit': { + dashed_name: 'threat-indicator-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'threat.indicator.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'threat.indicator.x509.subject.state_or_province': { + dashed_name: 'threat-indicator-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'threat.indicator.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'threat.indicator.x509.version_number': { + dashed_name: 'threat-indicator-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'threat.indicator.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'threat.software.alias': { + dashed_name: 'threat-software-alias', + description: + 'The alias(es) of the software for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® associated software description.', + example: '[ "X-Agent" ]', + flat_name: 'threat.software.alias', + ignore_above: 1024, + level: 'extended', + name: 'software.alias', + normalize: ['array'], + short: 'Alias of the software', + type: 'keyword', + }, + 'threat.software.id': { + dashed_name: 'threat-software-id', + description: + 'The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.', + example: 'S0552', + flat_name: 'threat.software.id', + ignore_above: 1024, + level: 'extended', + name: 'software.id', + normalize: [], + short: 'ID of the software', + type: 'keyword', + }, + 'threat.software.name': { + dashed_name: 'threat-software-name', + description: + 'The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.', + example: 'AdFind', + flat_name: 'threat.software.name', + ignore_above: 1024, + level: 'extended', + name: 'software.name', + normalize: [], + short: 'Name of the software.', + type: 'keyword', + }, + 'threat.software.platforms': { + dashed_name: 'threat-software-platforms', + description: + 'The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.', + example: '[ "Windows" ]', + expected_values: [ + 'AWS', + 'Azure', + 'Azure AD', + 'GCP', + 'Linux', + 'macOS', + 'Network', + 'Office 365', + 'SaaS', + 'Windows', + ], + flat_name: 'threat.software.platforms', + ignore_above: 1024, + level: 'extended', + name: 'software.platforms', + normalize: ['array'], + short: 'Platforms of the software.', + type: 'keyword', + }, + 'threat.software.reference': { + dashed_name: 'threat-software-reference', + description: + 'The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.', + example: 'https://attack.mitre.org/software/S0552/', + flat_name: 'threat.software.reference', + ignore_above: 1024, + level: 'extended', + name: 'software.reference', + normalize: [], + short: 'Software reference URL.', + type: 'keyword', + }, + 'threat.software.type': { + dashed_name: 'threat-software-type', + description: + 'The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.', + example: 'Tool', + expected_values: ['Malware', 'Tool'], + flat_name: 'threat.software.type', + ignore_above: 1024, + level: 'extended', + name: 'software.type', + normalize: [], + short: 'Software type.', + type: 'keyword', + }, + 'threat.tactic.id': { + dashed_name: 'threat-tactic-id', + description: + 'The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )', + example: 'TA0002', + flat_name: 'threat.tactic.id', + ignore_above: 1024, + level: 'extended', + name: 'tactic.id', + normalize: ['array'], + short: 'Threat tactic id.', + type: 'keyword', + }, + 'threat.tactic.name': { + dashed_name: 'threat-tactic-name', + description: + 'Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)', + example: 'Execution', + flat_name: 'threat.tactic.name', + ignore_above: 1024, + level: 'extended', + name: 'tactic.name', + normalize: ['array'], + short: 'Threat tactic.', + type: 'keyword', + }, + 'threat.tactic.reference': { + dashed_name: 'threat-tactic-reference', + description: + 'The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )', + example: 'https://attack.mitre.org/tactics/TA0002/', + flat_name: 'threat.tactic.reference', + ignore_above: 1024, + level: 'extended', + name: 'tactic.reference', + normalize: ['array'], + short: 'Threat tactic URL reference.', + type: 'keyword', + }, + 'threat.technique.id': { + dashed_name: 'threat-technique-id', + description: + 'The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'T1059', + flat_name: 'threat.technique.id', + ignore_above: 1024, + level: 'extended', + name: 'technique.id', + normalize: ['array'], + short: 'Threat technique id.', + type: 'keyword', + }, + 'threat.technique.name': { + dashed_name: 'threat-technique-name', + description: + 'The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'Command and Scripting Interpreter', + flat_name: 'threat.technique.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.technique.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'technique.name', + normalize: ['array'], + short: 'Threat technique name.', + type: 'keyword', + }, + 'threat.technique.reference': { + dashed_name: 'threat-technique-reference', + description: + 'The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)', + example: 'https://attack.mitre.org/techniques/T1059/', + flat_name: 'threat.technique.reference', + ignore_above: 1024, + level: 'extended', + name: 'technique.reference', + normalize: ['array'], + short: 'Threat technique URL reference.', + type: 'keyword', + }, + 'threat.technique.subtechnique.id': { + dashed_name: 'threat-technique-subtechnique-id', + description: + 'The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'T1059.001', + flat_name: 'threat.technique.subtechnique.id', + ignore_above: 1024, + level: 'extended', + name: 'technique.subtechnique.id', + normalize: ['array'], + short: 'Threat subtechnique id.', + type: 'keyword', + }, + 'threat.technique.subtechnique.name': { + dashed_name: 'threat-technique-subtechnique-name', + description: + 'The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'PowerShell', + flat_name: 'threat.technique.subtechnique.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'threat.technique.subtechnique.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'technique.subtechnique.name', + normalize: ['array'], + short: 'Threat subtechnique name.', + type: 'keyword', + }, + 'threat.technique.subtechnique.reference': { + dashed_name: 'threat-technique-subtechnique-reference', + description: + 'The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)', + example: 'https://attack.mitre.org/techniques/T1059/001/', + flat_name: 'threat.technique.subtechnique.reference', + ignore_above: 1024, + level: 'extended', + name: 'technique.subtechnique.reference', + normalize: ['array'], + short: 'Threat subtechnique URL reference.', + type: 'keyword', + }, + 'threat.threat.indicator.marking.tlp.version': { + dashed_name: 'threat-threat-indicator-marking-tlp-version', + description: 'Traffic Light Protocol version.', + example: 2, + flat_name: 'threat.threat.indicator.marking.tlp.version', + ignore_above: 1024, + level: 'extended', + name: 'threat.indicator.marking.tlp.version', + normalize: [], + short: 'Indicator TLP version', + type: 'keyword', + }, + }, + group: 2, + name: 'threat', + nestings: [ + 'threat.enrichments.indicator.as', + 'threat.enrichments.indicator.file', + 'threat.enrichments.indicator.geo', + 'threat.enrichments.indicator.registry', + 'threat.enrichments.indicator.url', + 'threat.enrichments.indicator.x509', + 'threat.indicator.as', + 'threat.indicator.file', + 'threat.indicator.geo', + 'threat.indicator.registry', + 'threat.indicator.url', + 'threat.indicator.x509', + ], + prefix: 'threat.', + reused_here: [ + { + full: 'threat.indicator.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'threat.enrichments.indicator.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'threat.indicator.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'threat.enrichments.indicator.as', + schema_name: 'as', + short: 'Fields describing an Autonomous System (Internet routing prefix).', + }, + { + full: 'threat.indicator.file', + schema_name: 'file', + short: 'Fields describing files.', + }, + { + full: 'threat.enrichments.indicator.file', + schema_name: 'file', + short: 'Fields describing files.', + }, + { + full: 'threat.indicator.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'threat.enrichments.indicator.geo', + schema_name: 'geo', + short: 'Fields describing a location.', + }, + { + full: 'threat.indicator.registry', + schema_name: 'registry', + short: 'Fields related to Windows Registry operations.', + }, + { + full: 'threat.enrichments.indicator.registry', + schema_name: 'registry', + short: 'Fields related to Windows Registry operations.', + }, + { + full: 'threat.indicator.url', + schema_name: 'url', + short: 'Fields that let you store URLs in various forms.', + }, + { + full: 'threat.enrichments.indicator.url', + schema_name: 'url', + short: 'Fields that let you store URLs in various forms.', + }, + ], + short: 'Fields to classify events and alerts according to a threat taxonomy.', + title: 'Threat', + type: 'group', + }, + tls: { + description: + 'Fields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files.', + fields: { + 'tls.cipher': { + dashed_name: 'tls-cipher', + description: 'String indicating the cipher used during the current connection.', + example: 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256', + flat_name: 'tls.cipher', + ignore_above: 1024, + level: 'extended', + name: 'cipher', + normalize: [], + short: 'String indicating the cipher used during the current connection.', + type: 'keyword', + }, + 'tls.client.certificate': { + dashed_name: 'tls-client-certificate', + description: + 'PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list.', + example: 'MII...', + flat_name: 'tls.client.certificate', + ignore_above: 1024, + level: 'extended', + name: 'client.certificate', + normalize: [], + short: 'PEM-encoded stand-alone certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.certificate_chain': { + dashed_name: 'tls-client-certificate-chain', + description: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain.', + example: '["MII...", "MII..."]', + flat_name: 'tls.client.certificate_chain', + ignore_above: 1024, + level: 'extended', + name: 'client.certificate_chain', + normalize: ['array'], + short: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.md5': { + dashed_name: 'tls-client-hash-md5', + description: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC', + flat_name: 'tls.client.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.md5', + normalize: [], + short: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.sha1': { + dashed_name: 'tls-client-hash-sha1', + description: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '9E393D93138888D288266C2D915214D1D1CCEB2A', + flat_name: 'tls.client.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.sha1', + normalize: [], + short: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.hash.sha256': { + dashed_name: 'tls-client-hash-sha256', + description: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0', + flat_name: 'tls.client.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'client.hash.sha256', + normalize: [], + short: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client.', + type: 'keyword', + }, + 'tls.client.issuer': { + dashed_name: 'tls-client-issuer', + description: + 'Distinguished name of subject of the issuer of the x.509 certificate presented by the client.', + example: 'CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.client.issuer', + ignore_above: 1024, + level: 'extended', + name: 'client.issuer', + normalize: [], + short: + 'Distinguished name of subject of the issuer of the x.509 certificate presented by the client.', + type: 'keyword', + }, + 'tls.client.ja3': { + dashed_name: 'tls-client-ja3', + description: + 'A hash that identifies clients based on how they perform an SSL/TLS handshake.', + example: 'd4e5b18d6b55c71272893221c96ba240', + flat_name: 'tls.client.ja3', + ignore_above: 1024, + level: 'extended', + name: 'client.ja3', + normalize: [], + short: 'A hash that identifies clients based on how they perform an SSL/TLS handshake.', + type: 'keyword', + }, + 'tls.client.not_after': { + dashed_name: 'tls-client-not-after', + description: 'Date/Time indicating when client certificate is no longer considered valid.', + example: '2021-01-01T00:00:00.000Z', + flat_name: 'tls.client.not_after', + level: 'extended', + name: 'client.not_after', + normalize: [], + short: 'Date/Time indicating when client certificate is no longer considered valid.', + type: 'date', + }, + 'tls.client.not_before': { + dashed_name: 'tls-client-not-before', + description: 'Date/Time indicating when client certificate is first considered valid.', + example: '1970-01-01T00:00:00.000Z', + flat_name: 'tls.client.not_before', + level: 'extended', + name: 'client.not_before', + normalize: [], + short: 'Date/Time indicating when client certificate is first considered valid.', + type: 'date', + }, + 'tls.client.server_name': { + dashed_name: 'tls-client-server-name', + description: + 'Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`.', + example: 'www.elastic.co', + flat_name: 'tls.client.server_name', + ignore_above: 1024, + level: 'extended', + name: 'client.server_name', + normalize: [], + short: 'Hostname the client is trying to connect to. Also called the SNI.', + type: 'keyword', + }, + 'tls.client.subject': { + dashed_name: 'tls-client-subject', + description: + 'Distinguished name of subject of the x.509 certificate presented by the client.', + example: 'CN=myclient, OU=Documentation Team, DC=example, DC=com', + flat_name: 'tls.client.subject', + ignore_above: 1024, + level: 'extended', + name: 'client.subject', + normalize: [], + short: 'Distinguished name of subject of the x.509 certificate presented by the client.', + type: 'keyword', + }, + 'tls.client.supported_ciphers': { + dashed_name: 'tls-client-supported-ciphers', + description: 'Array of ciphers offered by the client during the client hello.', + example: + '["TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "..."]', + flat_name: 'tls.client.supported_ciphers', + ignore_above: 1024, + level: 'extended', + name: 'client.supported_ciphers', + normalize: ['array'], + short: 'Array of ciphers offered by the client during the client hello.', + type: 'keyword', + }, + 'tls.client.x509.alternative_names': { + dashed_name: 'tls-client-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'tls.client.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'tls.client.x509.issuer.common_name': { + dashed_name: 'tls-client-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'tls.client.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.country': { + dashed_name: 'tls-client-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'tls.client.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'tls.client.x509.issuer.distinguished_name': { + dashed_name: 'tls-client-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'tls.client.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.locality': { + dashed_name: 'tls-client-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'tls.client.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.client.x509.issuer.organization': { + dashed_name: 'tls-client-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'tls.client.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.organizational_unit': { + dashed_name: 'tls-client-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'tls.client.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.issuer.state_or_province': { + dashed_name: 'tls-client-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.client.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.client.x509.not_after': { + dashed_name: 'tls-client-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'tls.client.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'tls.client.x509.not_before': { + dashed_name: 'tls-client-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'tls.client.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'tls.client.x509.public_key_algorithm': { + dashed_name: 'tls-client-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'tls.client.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'tls.client.x509.public_key_curve': { + dashed_name: 'tls-client-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'tls.client.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'tls.client.x509.public_key_exponent': { + dashed_name: 'tls-client-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'tls.client.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'tls.client.x509.public_key_size': { + dashed_name: 'tls-client-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'tls.client.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'tls.client.x509.serial_number': { + dashed_name: 'tls-client-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'tls.client.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'tls.client.x509.signature_algorithm': { + dashed_name: 'tls-client-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'tls.client.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'tls.client.x509.subject.common_name': { + dashed_name: 'tls-client-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'tls.client.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.country': { + dashed_name: 'tls-client-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'tls.client.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'tls.client.x509.subject.distinguished_name': { + dashed_name: 'tls-client-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'tls.client.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'tls.client.x509.subject.locality': { + dashed_name: 'tls-client-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'tls.client.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.client.x509.subject.organization': { + dashed_name: 'tls-client-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'tls.client.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.organizational_unit': { + dashed_name: 'tls-client-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'tls.client.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'tls.client.x509.subject.state_or_province': { + dashed_name: 'tls-client-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.client.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.client.x509.version_number': { + dashed_name: 'tls-client-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'tls.client.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'tls.curve': { + dashed_name: 'tls-curve', + description: 'String indicating the curve used for the given cipher, when applicable.', + example: 'secp256r1', + flat_name: 'tls.curve', + ignore_above: 1024, + level: 'extended', + name: 'curve', + normalize: [], + short: 'String indicating the curve used for the given cipher, when applicable.', + type: 'keyword', + }, + 'tls.established': { + dashed_name: 'tls-established', + description: + 'Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.', + flat_name: 'tls.established', + level: 'extended', + name: 'established', + normalize: [], + short: + 'Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel.', + type: 'boolean', + }, + 'tls.next_protocol': { + dashed_name: 'tls-next-protocol', + description: + 'String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case.', + example: 'http/1.1', + flat_name: 'tls.next_protocol', + ignore_above: 1024, + level: 'extended', + name: 'next_protocol', + normalize: [], + short: 'String indicating the protocol being tunneled.', + type: 'keyword', + }, + 'tls.resumed': { + dashed_name: 'tls-resumed', + description: + 'Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.', + flat_name: 'tls.resumed', + level: 'extended', + name: 'resumed', + normalize: [], + short: + 'Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation.', + type: 'boolean', + }, + 'tls.server.certificate': { + dashed_name: 'tls-server-certificate', + description: + 'PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list.', + example: 'MII...', + flat_name: 'tls.server.certificate', + ignore_above: 1024, + level: 'extended', + name: 'server.certificate', + normalize: [], + short: 'PEM-encoded stand-alone certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.certificate_chain': { + dashed_name: 'tls-server-certificate-chain', + description: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain.', + example: '["MII...", "MII..."]', + flat_name: 'tls.server.certificate_chain', + ignore_above: 1024, + level: 'extended', + name: 'server.certificate_chain', + normalize: ['array'], + short: + 'Array of PEM-encoded certificates that make up the certificate chain offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.md5': { + dashed_name: 'tls-server-hash-md5', + description: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0F76C7F2C55BFD7D8E8B8F4BFBF0C9EC', + flat_name: 'tls.server.hash.md5', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.md5', + normalize: [], + short: + 'Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.sha1': { + dashed_name: 'tls-server-hash-sha1', + description: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '9E393D93138888D288266C2D915214D1D1CCEB2A', + flat_name: 'tls.server.hash.sha1', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.sha1', + normalize: [], + short: + 'Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.hash.sha256': { + dashed_name: 'tls-server-hash-sha256', + description: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash.', + example: '0687F666A054EF17A08E2F2162EAB4CBC0D265E1D7875BE74BF3C712CA92DAF0', + flat_name: 'tls.server.hash.sha256', + ignore_above: 1024, + level: 'extended', + name: 'server.hash.sha256', + normalize: [], + short: + 'Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server.', + type: 'keyword', + }, + 'tls.server.issuer': { + dashed_name: 'tls-server-issuer', + description: 'Subject of the issuer of the x.509 certificate presented by the server.', + example: 'CN=Example Root CA, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.server.issuer', + ignore_above: 1024, + level: 'extended', + name: 'server.issuer', + normalize: [], + short: 'Subject of the issuer of the x.509 certificate presented by the server.', + type: 'keyword', + }, + 'tls.server.ja3s': { + dashed_name: 'tls-server-ja3s', + description: + 'A hash that identifies servers based on how they perform an SSL/TLS handshake.', + example: '394441ab65754e2207b1e1b457b3641d', + flat_name: 'tls.server.ja3s', + ignore_above: 1024, + level: 'extended', + name: 'server.ja3s', + normalize: [], + short: 'A hash that identifies servers based on how they perform an SSL/TLS handshake.', + type: 'keyword', + }, + 'tls.server.not_after': { + dashed_name: 'tls-server-not-after', + description: 'Timestamp indicating when server certificate is no longer considered valid.', + example: '2021-01-01T00:00:00.000Z', + flat_name: 'tls.server.not_after', + level: 'extended', + name: 'server.not_after', + normalize: [], + short: 'Timestamp indicating when server certificate is no longer considered valid.', + type: 'date', + }, + 'tls.server.not_before': { + dashed_name: 'tls-server-not-before', + description: 'Timestamp indicating when server certificate is first considered valid.', + example: '1970-01-01T00:00:00.000Z', + flat_name: 'tls.server.not_before', + level: 'extended', + name: 'server.not_before', + normalize: [], + short: 'Timestamp indicating when server certificate is first considered valid.', + type: 'date', + }, + 'tls.server.subject': { + dashed_name: 'tls-server-subject', + description: 'Subject of the x.509 certificate presented by the server.', + example: 'CN=www.example.com, OU=Infrastructure Team, DC=example, DC=com', + flat_name: 'tls.server.subject', + ignore_above: 1024, + level: 'extended', + name: 'server.subject', + normalize: [], + short: 'Subject of the x.509 certificate presented by the server.', + type: 'keyword', + }, + 'tls.server.x509.alternative_names': { + dashed_name: 'tls-server-x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'tls.server.x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'tls.server.x509.issuer.common_name': { + dashed_name: 'tls-server-x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'tls.server.x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.country': { + dashed_name: 'tls-server-x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'tls.server.x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'tls.server.x509.issuer.distinguished_name': { + dashed_name: 'tls-server-x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'tls.server.x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.locality': { + dashed_name: 'tls-server-x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'tls.server.x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.server.x509.issuer.organization': { + dashed_name: 'tls-server-x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'tls.server.x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.organizational_unit': { + dashed_name: 'tls-server-x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'tls.server.x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.issuer.state_or_province': { + dashed_name: 'tls-server-x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.server.x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.server.x509.not_after': { + dashed_name: 'tls-server-x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'tls.server.x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'tls.server.x509.not_before': { + dashed_name: 'tls-server-x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'tls.server.x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + original_fieldset: 'x509', + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'tls.server.x509.public_key_algorithm': { + dashed_name: 'tls-server-x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'tls.server.x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'tls.server.x509.public_key_curve': { + dashed_name: 'tls-server-x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'tls.server.x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + original_fieldset: 'x509', + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'tls.server.x509.public_key_exponent': { + dashed_name: 'tls-server-x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'tls.server.x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + original_fieldset: 'x509', + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'tls.server.x509.public_key_size': { + dashed_name: 'tls-server-x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'tls.server.x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + original_fieldset: 'x509', + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'tls.server.x509.serial_number': { + dashed_name: 'tls-server-x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'tls.server.x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + original_fieldset: 'x509', + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'tls.server.x509.signature_algorithm': { + dashed_name: 'tls-server-x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'tls.server.x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + original_fieldset: 'x509', + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'tls.server.x509.subject.common_name': { + dashed_name: 'tls-server-x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'tls.server.x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.country': { + dashed_name: 'tls-server-x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'tls.server.x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'tls.server.x509.subject.distinguished_name': { + dashed_name: 'tls-server-x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'tls.server.x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + original_fieldset: 'x509', + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'tls.server.x509.subject.locality': { + dashed_name: 'tls-server-x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'tls.server.x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of locality names (L)', + type: 'keyword', + }, + 'tls.server.x509.subject.organization': { + dashed_name: 'tls-server-x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'tls.server.x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.organizational_unit': { + dashed_name: 'tls-server-x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'tls.server.x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'tls.server.x509.subject.state_or_province': { + dashed_name: 'tls-server-x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'tls.server.x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + original_fieldset: 'x509', + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'tls.server.x509.version_number': { + dashed_name: 'tls-server-x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'tls.server.x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + original_fieldset: 'x509', + short: 'Version of x509 format.', + type: 'keyword', + }, + 'tls.version': { + dashed_name: 'tls-version', + description: 'Numeric part of the version parsed from the original string.', + example: '1.2', + flat_name: 'tls.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Numeric part of the version parsed from the original string.', + type: 'keyword', + }, + 'tls.version_protocol': { + dashed_name: 'tls-version-protocol', + description: 'Normalized lowercase protocol name parsed from original string.', + example: 'tls', + flat_name: 'tls.version_protocol', + ignore_above: 1024, + level: 'extended', + name: 'version_protocol', + normalize: [], + short: 'Normalized lowercase protocol name parsed from original string.', + type: 'keyword', + }, + }, + group: 2, + name: 'tls', + nestings: ['tls.client.x509', 'tls.server.x509'], + prefix: 'tls.', + reused_here: [ + { + full: 'tls.client.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + { + full: 'tls.server.x509', + schema_name: 'x509', + short: 'These fields contain x509 certificate metadata.', + }, + ], + short: 'Fields describing a TLS connection.', + title: 'TLS', + type: 'group', + }, + tracing: { + description: + 'Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.\nUnlike most field sets in ECS, the tracing fields are *not* nested under the field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, and so on.', + fields: { + 'span.id': { + dashed_name: 'span-id', + description: + 'Unique identifier of the span within the scope of its trace.\nA span represents an operation within a transaction, such as a request to another service, or a database query.', + example: '3ff9a8981b7ccd5a', + flat_name: 'span.id', + ignore_above: 1024, + level: 'extended', + name: 'span.id', + normalize: [], + short: 'Unique identifier of the span within the scope of its trace.', + type: 'keyword', + }, + 'trace.id': { + dashed_name: 'trace-id', + description: + 'Unique identifier of the trace.\nA trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services.', + example: '4bf92f3577b34da6a3ce929d0e0e4736', + flat_name: 'trace.id', + ignore_above: 1024, + level: 'extended', + name: 'trace.id', + normalize: [], + short: 'Unique identifier of the trace.', + type: 'keyword', + }, + 'transaction.id': { + dashed_name: 'transaction-id', + description: + 'Unique identifier of the transaction within the scope of its trace.\nA transaction is the highest level of work measured within a service, such as a request to a server.', + example: '00f067aa0ba902b7', + flat_name: 'transaction.id', + ignore_above: 1024, + level: 'extended', + name: 'transaction.id', + normalize: [], + short: 'Unique identifier of the transaction within the scope of its trace.', + type: 'keyword', + }, + }, + group: 2, + name: 'tracing', + prefix: '', + root: true, + short: 'Fields related to distributed tracing.', + title: 'Tracing', + type: 'group', + }, + url: { + description: + 'URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on.', + fields: { + 'url.domain': { + dashed_name: 'url-domain', + description: + 'Domain of the url, such as "www.elastic.co".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.', + example: 'www.elastic.co', + flat_name: 'url.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Domain of the url.', + type: 'keyword', + }, + 'url.extension': { + dashed_name: 'url-extension', + description: + 'The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be "png", not ".png".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").', + example: 'png', + flat_name: 'url.extension', + ignore_above: 1024, + level: 'extended', + name: 'extension', + normalize: [], + short: 'File extension from the request url, excluding the leading dot.', + type: 'keyword', + }, + 'url.fragment': { + dashed_name: 'url-fragment', + description: + 'Portion of the url after the `#`, such as "top".\nThe `#` is not part of the fragment.', + flat_name: 'url.fragment', + ignore_above: 1024, + level: 'extended', + name: 'fragment', + normalize: [], + short: 'Portion of the url after the `#`.', + type: 'keyword', + }, + 'url.full': { + dashed_name: 'url-full', + description: + 'If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top', + flat_name: 'url.full', + level: 'extended', + multi_fields: [{ flat_name: 'url.full.text', name: 'text', type: 'match_only_text' }], + name: 'full', + normalize: [], + short: 'Full unparsed URL.', + type: 'wildcard', + }, + 'url.original': { + dashed_name: 'url-original', + description: + 'Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.', + example: 'https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch', + flat_name: 'url.original', + level: 'extended', + multi_fields: [ + { + flat_name: 'url.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + short: 'Unmodified original url as seen in the event source.', + type: 'wildcard', + }, + 'url.password': { + dashed_name: 'url-password', + description: 'Password of the request.', + flat_name: 'url.password', + ignore_above: 1024, + level: 'extended', + name: 'password', + normalize: [], + short: 'Password of the request.', + type: 'keyword', + }, + 'url.path': { + dashed_name: 'url-path', + description: 'Path of the request, such as "/search".', + flat_name: 'url.path', + level: 'extended', + name: 'path', + normalize: [], + short: 'Path of the request, such as "/search".', + type: 'wildcard', + }, + 'url.port': { + dashed_name: 'url-port', + description: 'Port of the request, such as 443.', + example: 443, + flat_name: 'url.port', + format: 'string', + level: 'extended', + name: 'port', + normalize: [], + short: 'Port of the request, such as 443.', + type: 'long', + }, + 'url.query': { + dashed_name: 'url-query', + description: + 'The query field describes the query string of the request, such as "q=elasticsearch".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.', + flat_name: 'url.query', + ignore_above: 1024, + level: 'extended', + name: 'query', + normalize: [], + short: 'Query string of the request.', + type: 'keyword', + }, + 'url.registered_domain': { + dashed_name: 'url-registered-domain', + description: + 'The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for "foo.example.com" is "example.com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".', + example: 'example.com', + flat_name: 'url.registered_domain', + ignore_above: 1024, + level: 'extended', + name: 'registered_domain', + normalize: [], + short: 'The highest registered url domain, stripped of the subdomain.', + type: 'keyword', + }, + 'url.scheme': { + dashed_name: 'url-scheme', + description: + 'Scheme of the request, such as "https".\nNote: The `:` is not part of the scheme.', + example: 'https', + flat_name: 'url.scheme', + ignore_above: 1024, + level: 'extended', + name: 'scheme', + normalize: [], + short: 'Scheme of the url.', + type: 'keyword', + }, + 'url.subdomain': { + dashed_name: 'url-subdomain', + description: + 'The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.', + example: 'east', + flat_name: 'url.subdomain', + ignore_above: 1024, + level: 'extended', + name: 'subdomain', + normalize: [], + short: 'The subdomain of the domain.', + type: 'keyword', + }, + 'url.top_level_domain': { + dashed_name: 'url-top-level-domain', + description: + 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".', + example: 'co.uk', + flat_name: 'url.top_level_domain', + ignore_above: 1024, + level: 'extended', + name: 'top_level_domain', + normalize: [], + short: 'The effective top level domain (com, org, net, co.uk).', + type: 'keyword', + }, + 'url.username': { + dashed_name: 'url-username', + description: 'Username of the request.', + flat_name: 'url.username', + ignore_above: 1024, + level: 'extended', + name: 'username', + normalize: [], + short: 'Username of the request.', + type: 'keyword', + }, + }, + group: 2, + name: 'url', + prefix: 'url.', + reusable: { + expected: [ + { as: 'url', at: 'threat.indicator', full: 'threat.indicator.url' }, + { + as: 'url', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.url', + }, + ], + top_level: true, + }, + short: 'Fields that let you store URLs in various forms.', + title: 'URL', + type: 'group', + }, + user: { + description: + 'The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.', + fields: { + 'user.changes.domain': { + dashed_name: 'user-changes-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.changes.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.changes.email': { + dashed_name: 'user-changes-email', + description: 'User email address.', + flat_name: 'user.changes.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.changes.full_name': { + dashed_name: 'user-changes-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.changes.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.changes.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.changes.group.domain': { + dashed_name: 'user-changes-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.changes.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.changes.group.id': { + dashed_name: 'user-changes-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.changes.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.changes.group.name': { + dashed_name: 'user-changes-group-name', + description: 'Name of the group.', + flat_name: 'user.changes.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.changes.hash': { + dashed_name: 'user-changes-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.changes.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.changes.id': { + dashed_name: 'user-changes-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.changes.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.changes.name': { + dashed_name: 'user-changes-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.changes.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.changes.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.changes.roles': { + dashed_name: 'user-changes-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.changes.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.domain': { + dashed_name: 'user-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.effective.domain': { + dashed_name: 'user-effective-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.effective.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.effective.email': { + dashed_name: 'user-effective-email', + description: 'User email address.', + flat_name: 'user.effective.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.effective.full_name': { + dashed_name: 'user-effective-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.effective.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.effective.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.effective.group.domain': { + dashed_name: 'user-effective-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.effective.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.effective.group.id': { + dashed_name: 'user-effective-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.effective.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.effective.group.name': { + dashed_name: 'user-effective-group-name', + description: 'Name of the group.', + flat_name: 'user.effective.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.effective.hash': { + dashed_name: 'user-effective-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.effective.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.effective.id': { + dashed_name: 'user-effective-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.effective.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.effective.name': { + dashed_name: 'user-effective-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.effective.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.effective.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.effective.roles': { + dashed_name: 'user-effective-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.effective.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.email': { + dashed_name: 'user-email', + description: 'User email address.', + flat_name: 'user.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + short: 'User email address.', + type: 'keyword', + }, + 'user.full_name': { + dashed_name: 'user-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.group.domain': { + dashed_name: 'user-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.group.id': { + dashed_name: 'user-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.group.name': { + dashed_name: 'user-group-name', + description: 'Name of the group.', + flat_name: 'user.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.hash': { + dashed_name: 'user-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.id': { + dashed_name: 'user-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.name': { + dashed_name: 'user-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.risk.calculated_level': { + dashed_name: 'user-risk-calculated-level', + description: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 'High', + flat_name: 'user.risk.calculated_level', + ignore_above: 1024, + level: 'extended', + name: 'calculated_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'keyword', + }, + 'user.risk.calculated_score': { + dashed_name: 'user-risk-calculated-score', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + example: 880.73, + flat_name: 'user.risk.calculated_score', + level: 'extended', + name: 'calculated_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring.', + type: 'float', + }, + 'user.risk.calculated_score_norm': { + dashed_name: 'user-risk-calculated-score-norm', + description: + 'A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100.', + example: 88.73, + flat_name: 'user.risk.calculated_score_norm', + level: 'extended', + name: 'calculated_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an internal system.', + type: 'float', + }, + 'user.risk.static_level': { + dashed_name: 'user-risk-static-level', + description: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 'High', + flat_name: 'user.risk.static_level', + ignore_above: 1024, + level: 'extended', + name: 'static_level', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'keyword', + }, + 'user.risk.static_score': { + dashed_name: 'user-risk-static-score', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + example: 830, + flat_name: 'user.risk.static_score', + level: 'extended', + name: 'static_score', + normalize: [], + original_fieldset: 'risk', + short: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform.', + type: 'float', + }, + 'user.risk.static_score_norm': { + dashed_name: 'user-risk-static-score-norm', + description: + 'A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100.', + example: 83, + flat_name: 'user.risk.static_score_norm', + level: 'extended', + name: 'static_score_norm', + normalize: [], + original_fieldset: 'risk', + short: 'A normalized risk score calculated by an external system.', + type: 'float', + }, + 'user.roles': { + dashed_name: 'user-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + 'user.target.domain': { + dashed_name: 'user-target-domain', + description: + 'Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.target.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'user', + short: 'Name of the directory the user is a member of.', + type: 'keyword', + }, + 'user.target.email': { + dashed_name: 'user-target-email', + description: 'User email address.', + flat_name: 'user.target.email', + ignore_above: 1024, + level: 'extended', + name: 'email', + normalize: [], + original_fieldset: 'user', + short: 'User email address.', + type: 'keyword', + }, + 'user.target.full_name': { + dashed_name: 'user-target-full-name', + description: "User's full name, if available.", + example: 'Albert Einstein', + flat_name: 'user.target.full_name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user.target.full_name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full_name', + normalize: [], + original_fieldset: 'user', + short: "User's full name, if available.", + type: 'keyword', + }, + 'user.target.group.domain': { + dashed_name: 'user-target-group-domain', + description: + 'Name of the directory the group is a member of.\nFor example, an LDAP or Active Directory domain name.', + flat_name: 'user.target.group.domain', + ignore_above: 1024, + level: 'extended', + name: 'domain', + normalize: [], + original_fieldset: 'group', + short: 'Name of the directory the group is a member of.', + type: 'keyword', + }, + 'user.target.group.id': { + dashed_name: 'user-target-group-id', + description: 'Unique identifier for the group on the system/platform.', + flat_name: 'user.target.group.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + original_fieldset: 'group', + short: 'Unique identifier for the group on the system/platform.', + type: 'keyword', + }, + 'user.target.group.name': { + dashed_name: 'user-target-group-name', + description: 'Name of the group.', + flat_name: 'user.target.group.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + original_fieldset: 'group', + short: 'Name of the group.', + type: 'keyword', + }, + 'user.target.hash': { + dashed_name: 'user-target-hash', + description: + 'Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.', + flat_name: 'user.target.hash', + ignore_above: 1024, + level: 'extended', + name: 'hash', + normalize: [], + original_fieldset: 'user', + short: 'Unique user hash to correlate information for a user in anonymized form.', + type: 'keyword', + }, + 'user.target.id': { + dashed_name: 'user-target-id', + description: 'Unique identifier of the user.', + example: 'S-1-5-21-202424912787-2692429404-2351956786-1000', + flat_name: 'user.target.id', + ignore_above: 1024, + level: 'core', + name: 'id', + normalize: [], + original_fieldset: 'user', + short: 'Unique identifier of the user.', + type: 'keyword', + }, + 'user.target.name': { + dashed_name: 'user-target-name', + description: 'Short name or login of the user.', + example: 'a.einstein', + flat_name: 'user.target.name', + ignore_above: 1024, + level: 'core', + multi_fields: [ + { + flat_name: 'user.target.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'user', + short: 'Short name or login of the user.', + type: 'keyword', + }, + 'user.target.roles': { + dashed_name: 'user-target-roles', + description: 'Array of user roles at the time of the event.', + example: '["kibana_admin", "reporting_user"]', + flat_name: 'user.target.roles', + ignore_above: 1024, + level: 'extended', + name: 'roles', + normalize: ['array'], + original_fieldset: 'user', + short: 'Array of user roles at the time of the event.', + type: 'keyword', + }, + }, + group: 2, + name: 'user', + nestings: ['user.changes', 'user.effective', 'user.group', 'user.risk', 'user.target'], + prefix: 'user.', + reusable: { + expected: [ + { as: 'user', at: 'client', full: 'client.user' }, + { as: 'user', at: 'destination', full: 'destination.user' }, + { as: 'user', at: 'server', full: 'server.user' }, + { as: 'user', at: 'source', full: 'source.user' }, + { + as: 'target', + at: 'user', + full: 'user.target', + short_override: 'Targeted user of action taken.', + }, + { + as: 'effective', + at: 'user', + full: 'user.effective', + short_override: 'User whose privileges were assumed.', + }, + { + as: 'changes', + at: 'user', + full: 'user.changes', + short_override: 'Captures changes made to a user.', + }, + { + as: 'user', + at: 'process', + full: 'process.user', + short_override: 'The effective user (euid).', + }, + { + as: 'saved_user', + at: 'process', + full: 'process.saved_user', + short_override: 'The saved user (suid).', + }, + { + as: 'real_user', + at: 'process', + full: 'process.real_user', + short_override: 'The real user (ruid). Identifies the real owner of the process.', + }, + { + as: 'attested_user', + at: 'process', + beta: 'Reusing the `user` fields in this location is currently considered beta.', + full: 'process.attested_user', + short_override: + 'The externally attested user based on an external source such as the Kube API.', + }, + ], + top_level: true, + }, + reused_here: [ + { + full: 'user.group', + schema_name: 'group', + short: "User's group relevant to the event.", + }, + { + full: 'user.risk', + schema_name: 'risk', + short: 'Fields for describing risk score and level.', + }, + { + full: 'user.target', + schema_name: 'user', + short: 'Targeted user of action taken.', + }, + { + full: 'user.effective', + schema_name: 'user', + short: 'User whose privileges were assumed.', + }, + { + full: 'user.changes', + schema_name: 'user', + short: 'Captures changes made to a user.', + }, + ], + short: 'Fields to describe the user relevant to the event.', + title: 'User', + type: 'group', + }, + user_agent: { + description: + 'The user_agent fields normally come from a browser request.\nThey often show up in web service logs coming from the parsed user agent string.', + fields: { + 'user_agent.device.name': { + dashed_name: 'user-agent-device-name', + description: 'Name of the device.', + example: 'iPhone', + flat_name: 'user_agent.device.name', + ignore_above: 1024, + level: 'extended', + name: 'device.name', + normalize: [], + short: 'Name of the device.', + type: 'keyword', + }, + 'user_agent.name': { + dashed_name: 'user-agent-name', + description: 'Name of the user agent.', + example: 'Safari', + flat_name: 'user_agent.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Name of the user agent.', + type: 'keyword', + }, + 'user_agent.original': { + dashed_name: 'user-agent-original', + description: 'Unparsed user_agent string.', + example: + 'Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1', + flat_name: 'user_agent.original', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.original.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'original', + normalize: [], + short: 'Unparsed user_agent string.', + type: 'keyword', + }, + 'user_agent.os.family': { + dashed_name: 'user-agent-os-family', + description: 'OS family (such as redhat, debian, freebsd, windows).', + example: 'debian', + flat_name: 'user_agent.os.family', + ignore_above: 1024, + level: 'extended', + name: 'family', + normalize: [], + original_fieldset: 'os', + short: 'OS family (such as redhat, debian, freebsd, windows).', + type: 'keyword', + }, + 'user_agent.os.full': { + dashed_name: 'user-agent-os-full', + description: 'Operating system name, including the version or code name.', + example: 'Mac OS Mojave', + flat_name: 'user_agent.os.full', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.os.full.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'full', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, including the version or code name.', + type: 'keyword', + }, + 'user_agent.os.kernel': { + dashed_name: 'user-agent-os-kernel', + description: 'Operating system kernel version as a raw string.', + example: '4.4.0-112-generic', + flat_name: 'user_agent.os.kernel', + ignore_above: 1024, + level: 'extended', + name: 'kernel', + normalize: [], + original_fieldset: 'os', + short: 'Operating system kernel version as a raw string.', + type: 'keyword', + }, + 'user_agent.os.name': { + dashed_name: 'user-agent-os-name', + description: 'Operating system name, without the version.', + example: 'Mac OS X', + flat_name: 'user_agent.os.name', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'user_agent.os.name.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'name', + normalize: [], + original_fieldset: 'os', + short: 'Operating system name, without the version.', + type: 'keyword', + }, + 'user_agent.os.platform': { + dashed_name: 'user-agent-os-platform', + description: 'Operating system platform (such centos, ubuntu, windows).', + example: 'darwin', + flat_name: 'user_agent.os.platform', + ignore_above: 1024, + level: 'extended', + name: 'platform', + normalize: [], + original_fieldset: 'os', + short: 'Operating system platform (such centos, ubuntu, windows).', + type: 'keyword', + }, + 'user_agent.os.type': { + dashed_name: 'user-agent-os-type', + description: + "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.", + example: 'macos', + expected_values: ['linux', 'macos', 'unix', 'windows', 'ios', 'android'], + flat_name: 'user_agent.os.type', + ignore_above: 1024, + level: 'extended', + name: 'type', + normalize: [], + original_fieldset: 'os', + short: 'Which commercial OS family (one of: linux, macos, unix, windows, ios or android).', + type: 'keyword', + }, + 'user_agent.os.version': { + dashed_name: 'user-agent-os-version', + description: 'Operating system version as a raw string.', + example: '10.14.1', + flat_name: 'user_agent.os.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + original_fieldset: 'os', + short: 'Operating system version as a raw string.', + type: 'keyword', + }, + 'user_agent.version': { + dashed_name: 'user-agent-version', + description: 'Version of the user agent.', + example: 12, + flat_name: 'user_agent.version', + ignore_above: 1024, + level: 'extended', + name: 'version', + normalize: [], + short: 'Version of the user agent.', + type: 'keyword', + }, + }, + group: 2, + name: 'user_agent', + nestings: ['user_agent.os'], + prefix: 'user_agent.', + reused_here: [ + { + full: 'user_agent.os', + schema_name: 'os', + short: 'OS fields contain information about the operating system.', + }, + ], + short: 'Fields to describe a browser user_agent string.', + title: 'User agent', + type: 'group', + }, + vlan: { + description: + 'The VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection.\nNetwork.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic.\nNetwork.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging.\nObserver.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers.', + fields: { + 'vlan.id': { + dashed_name: 'vlan-id', + description: 'VLAN ID as reported by the observer.', + example: 10, + flat_name: 'vlan.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'VLAN ID as reported by the observer.', + type: 'keyword', + }, + 'vlan.name': { + dashed_name: 'vlan-name', + description: 'Optional VLAN name as reported by the observer.', + example: 'outside', + flat_name: 'vlan.name', + ignore_above: 1024, + level: 'extended', + name: 'name', + normalize: [], + short: 'Optional VLAN name as reported by the observer.', + type: 'keyword', + }, + }, + group: 2, + name: 'vlan', + prefix: 'vlan.', + reusable: { + expected: [ + { as: 'vlan', at: 'observer.ingress', full: 'observer.ingress.vlan' }, + { as: 'vlan', at: 'observer.egress', full: 'observer.egress.vlan' }, + { as: 'vlan', at: 'network', full: 'network.vlan' }, + { as: 'vlan', at: 'network.inner', full: 'network.inner.vlan' }, + ], + top_level: false, + }, + short: 'Fields to describe observed VLAN information.', + title: 'VLAN', + type: 'group', + }, + vulnerability: { + description: + 'The vulnerability fields describe information about a vulnerability that is relevant to an event.', + fields: { + 'vulnerability.category': { + dashed_name: 'vulnerability-category', + description: + 'The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories])\nThis field must be an array.', + example: '["Firewall"]', + flat_name: 'vulnerability.category', + ignore_above: 1024, + level: 'extended', + name: 'category', + normalize: ['array'], + short: 'Category of a vulnerability.', + type: 'keyword', + }, + 'vulnerability.classification': { + dashed_name: 'vulnerability-classification', + description: + 'The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/)', + example: 'CVSS', + flat_name: 'vulnerability.classification', + ignore_above: 1024, + level: 'extended', + name: 'classification', + normalize: [], + short: 'Classification of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.description': { + dashed_name: 'vulnerability-description', + description: + 'The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description])', + example: 'In macOS before 2.12.6, there is a vulnerability in the RPC...', + flat_name: 'vulnerability.description', + ignore_above: 1024, + level: 'extended', + multi_fields: [ + { + flat_name: 'vulnerability.description.text', + name: 'text', + type: 'match_only_text', + }, + ], + name: 'description', + normalize: [], + short: 'Description of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.enumeration': { + dashed_name: 'vulnerability-enumeration', + description: + 'The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/)', + example: 'CVE', + flat_name: 'vulnerability.enumeration', + ignore_above: 1024, + level: 'extended', + name: 'enumeration', + normalize: [], + short: 'Identifier of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.id': { + dashed_name: 'vulnerability-id', + description: + 'The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID]', + example: 'CVE-2019-00001', + flat_name: 'vulnerability.id', + ignore_above: 1024, + level: 'extended', + name: 'id', + normalize: [], + short: 'ID of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.reference': { + dashed_name: 'vulnerability-reference', + description: + 'A resource that provides additional information, context, and mitigations for the identified vulnerability.', + example: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111', + flat_name: 'vulnerability.reference', + ignore_above: 1024, + level: 'extended', + name: 'reference', + normalize: [], + short: 'Reference of the vulnerability.', + type: 'keyword', + }, + 'vulnerability.report_id': { + dashed_name: 'vulnerability-report-id', + description: 'The report or scan identification number.', + example: 20191018.0001, + flat_name: 'vulnerability.report_id', + ignore_above: 1024, + level: 'extended', + name: 'report_id', + normalize: [], + short: 'Scan identification number.', + type: 'keyword', + }, + 'vulnerability.scanner.vendor': { + dashed_name: 'vulnerability-scanner-vendor', + description: 'The name of the vulnerability scanner vendor.', + example: 'Tenable', + flat_name: 'vulnerability.scanner.vendor', + ignore_above: 1024, + level: 'extended', + name: 'scanner.vendor', + normalize: [], + short: 'Name of the scanner vendor.', + type: 'keyword', + }, + 'vulnerability.score.base': { + dashed_name: 'vulnerability-score-base', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nBase scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document)', + example: 5.5, + flat_name: 'vulnerability.score.base', + level: 'extended', + name: 'score.base', + normalize: [], + short: 'Vulnerability Base score.', + type: 'float', + }, + 'vulnerability.score.environmental': { + dashed_name: 'vulnerability-score-environmental', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nEnvironmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document)', + example: 5.5, + flat_name: 'vulnerability.score.environmental', + level: 'extended', + name: 'score.environmental', + normalize: [], + short: 'Vulnerability Environmental score.', + type: 'float', + }, + 'vulnerability.score.temporal': { + dashed_name: 'vulnerability-score-temporal', + description: + 'Scores can range from 0.0 to 10.0, with 10.0 being the most severe.\nTemporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document)', + flat_name: 'vulnerability.score.temporal', + level: 'extended', + name: 'score.temporal', + normalize: [], + short: 'Vulnerability Temporal score.', + type: 'float', + }, + 'vulnerability.score.version': { + dashed_name: 'vulnerability-score-version', + description: + 'The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.\nCVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss)', + example: 2, + flat_name: 'vulnerability.score.version', + ignore_above: 1024, + level: 'extended', + name: 'score.version', + normalize: [], + short: 'CVSS version.', + type: 'keyword', + }, + 'vulnerability.severity': { + dashed_name: 'vulnerability-severity', + description: + 'The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss)', + example: 'Critical', + flat_name: 'vulnerability.severity', + ignore_above: 1024, + level: 'extended', + name: 'severity', + normalize: [], + short: 'Severity of the vulnerability.', + type: 'keyword', + }, + }, + group: 2, + name: 'vulnerability', + prefix: 'vulnerability.', + short: 'Fields to describe the vulnerability relevant to an event.', + title: 'Vulnerability', + type: 'group', + }, + x509: { + description: + 'This implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk.\nWhen the certificate relates to a file, use the fields at `file.x509`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`).\nEvents that contain certificate information about network connections, should use the x509 fields under the relevant TLS fields: `tls.server.x509` and/or `tls.client.x509`.', + fields: { + 'x509.alternative_names': { + dashed_name: 'x509-alternative-names', + description: + 'List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.', + example: '*.elastic.co', + flat_name: 'x509.alternative_names', + ignore_above: 1024, + level: 'extended', + name: 'alternative_names', + normalize: ['array'], + short: 'List of subject alternative names (SAN).', + type: 'keyword', + }, + 'x509.issuer.common_name': { + dashed_name: 'x509-issuer-common-name', + description: 'List of common name (CN) of issuing certificate authority.', + example: 'Example SHA2 High Assurance Server CA', + flat_name: 'x509.issuer.common_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.common_name', + normalize: ['array'], + short: 'List of common name (CN) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.country': { + dashed_name: 'x509-issuer-country', + description: 'List of country \\(C) codes', + example: 'US', + flat_name: 'x509.issuer.country', + ignore_above: 1024, + level: 'extended', + name: 'issuer.country', + normalize: ['array'], + short: 'List of country \\(C) codes', + type: 'keyword', + }, + 'x509.issuer.distinguished_name': { + dashed_name: 'x509-issuer-distinguished-name', + description: 'Distinguished name (DN) of issuing certificate authority.', + example: + 'C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA', + flat_name: 'x509.issuer.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'issuer.distinguished_name', + normalize: [], + short: 'Distinguished name (DN) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.locality': { + dashed_name: 'x509-issuer-locality', + description: 'List of locality names (L)', + example: 'Mountain View', + flat_name: 'x509.issuer.locality', + ignore_above: 1024, + level: 'extended', + name: 'issuer.locality', + normalize: ['array'], + short: 'List of locality names (L)', + type: 'keyword', + }, + 'x509.issuer.organization': { + dashed_name: 'x509-issuer-organization', + description: 'List of organizations (O) of issuing certificate authority.', + example: 'Example Inc', + flat_name: 'x509.issuer.organization', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organization', + normalize: ['array'], + short: 'List of organizations (O) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.organizational_unit': { + dashed_name: 'x509-issuer-organizational-unit', + description: 'List of organizational units (OU) of issuing certificate authority.', + example: 'www.example.com', + flat_name: 'x509.issuer.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'issuer.organizational_unit', + normalize: ['array'], + short: 'List of organizational units (OU) of issuing certificate authority.', + type: 'keyword', + }, + 'x509.issuer.state_or_province': { + dashed_name: 'x509-issuer-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'x509.issuer.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'issuer.state_or_province', + normalize: ['array'], + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'x509.not_after': { + dashed_name: 'x509-not-after', + description: 'Time at which the certificate is no longer considered valid.', + example: '2020-07-16T03:15:39Z', + flat_name: 'x509.not_after', + level: 'extended', + name: 'not_after', + normalize: [], + short: 'Time at which the certificate is no longer considered valid.', + type: 'date', + }, + 'x509.not_before': { + dashed_name: 'x509-not-before', + description: 'Time at which the certificate is first considered valid.', + example: '2019-08-16T01:40:25Z', + flat_name: 'x509.not_before', + level: 'extended', + name: 'not_before', + normalize: [], + short: 'Time at which the certificate is first considered valid.', + type: 'date', + }, + 'x509.public_key_algorithm': { + dashed_name: 'x509-public-key-algorithm', + description: 'Algorithm used to generate the public key.', + example: 'RSA', + flat_name: 'x509.public_key_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'public_key_algorithm', + normalize: [], + short: 'Algorithm used to generate the public key.', + type: 'keyword', + }, + 'x509.public_key_curve': { + dashed_name: 'x509-public-key-curve', + description: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + example: 'nistp521', + flat_name: 'x509.public_key_curve', + ignore_above: 1024, + level: 'extended', + name: 'public_key_curve', + normalize: [], + short: + 'The curve used by the elliptic curve public key algorithm. This is algorithm specific.', + type: 'keyword', + }, + 'x509.public_key_exponent': { + dashed_name: 'x509-public-key-exponent', + description: 'Exponent used to derive the public key. This is algorithm specific.', + doc_values: false, + example: 65537, + flat_name: 'x509.public_key_exponent', + index: false, + level: 'extended', + name: 'public_key_exponent', + normalize: [], + short: 'Exponent used to derive the public key. This is algorithm specific.', + type: 'long', + }, + 'x509.public_key_size': { + dashed_name: 'x509-public-key-size', + description: 'The size of the public key space in bits.', + example: 2048, + flat_name: 'x509.public_key_size', + level: 'extended', + name: 'public_key_size', + normalize: [], + short: 'The size of the public key space in bits.', + type: 'long', + }, + 'x509.serial_number': { + dashed_name: 'x509-serial-number', + description: + 'Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.', + example: '55FBB9C7DEBF09809D12CCAA', + flat_name: 'x509.serial_number', + ignore_above: 1024, + level: 'extended', + name: 'serial_number', + normalize: [], + short: 'Unique serial number issued by the certificate authority.', + type: 'keyword', + }, + 'x509.signature_algorithm': { + dashed_name: 'x509-signature-algorithm', + description: + 'Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.', + example: 'SHA256-RSA', + flat_name: 'x509.signature_algorithm', + ignore_above: 1024, + level: 'extended', + name: 'signature_algorithm', + normalize: [], + short: 'Identifier for certificate signature algorithm.', + type: 'keyword', + }, + 'x509.subject.common_name': { + dashed_name: 'x509-subject-common-name', + description: 'List of common names (CN) of subject.', + example: 'shared.global.example.net', + flat_name: 'x509.subject.common_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.common_name', + normalize: ['array'], + short: 'List of common names (CN) of subject.', + type: 'keyword', + }, + 'x509.subject.country': { + dashed_name: 'x509-subject-country', + description: 'List of country \\(C) code', + example: 'US', + flat_name: 'x509.subject.country', + ignore_above: 1024, + level: 'extended', + name: 'subject.country', + normalize: ['array'], + short: 'List of country \\(C) code', + type: 'keyword', + }, + 'x509.subject.distinguished_name': { + dashed_name: 'x509-subject-distinguished-name', + description: 'Distinguished name (DN) of the certificate subject entity.', + example: + 'C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net', + flat_name: 'x509.subject.distinguished_name', + ignore_above: 1024, + level: 'extended', + name: 'subject.distinguished_name', + normalize: [], + short: 'Distinguished name (DN) of the certificate subject entity.', + type: 'keyword', + }, + 'x509.subject.locality': { + dashed_name: 'x509-subject-locality', + description: 'List of locality names (L)', + example: 'San Francisco', + flat_name: 'x509.subject.locality', + ignore_above: 1024, + level: 'extended', + name: 'subject.locality', + normalize: ['array'], + short: 'List of locality names (L)', + type: 'keyword', + }, + 'x509.subject.organization': { + dashed_name: 'x509-subject-organization', + description: 'List of organizations (O) of subject.', + example: 'Example, Inc.', + flat_name: 'x509.subject.organization', + ignore_above: 1024, + level: 'extended', + name: 'subject.organization', + normalize: ['array'], + short: 'List of organizations (O) of subject.', + type: 'keyword', + }, + 'x509.subject.organizational_unit': { + dashed_name: 'x509-subject-organizational-unit', + description: 'List of organizational units (OU) of subject.', + flat_name: 'x509.subject.organizational_unit', + ignore_above: 1024, + level: 'extended', + name: 'subject.organizational_unit', + normalize: ['array'], + short: 'List of organizational units (OU) of subject.', + type: 'keyword', + }, + 'x509.subject.state_or_province': { + dashed_name: 'x509-subject-state-or-province', + description: 'List of state or province names (ST, S, or P)', + example: 'California', + flat_name: 'x509.subject.state_or_province', + ignore_above: 1024, + level: 'extended', + name: 'subject.state_or_province', + normalize: ['array'], + short: 'List of state or province names (ST, S, or P)', + type: 'keyword', + }, + 'x509.version_number': { + dashed_name: 'x509-version-number', + description: 'Version of x509 format.', + example: 3, + flat_name: 'x509.version_number', + ignore_above: 1024, + level: 'extended', + name: 'version_number', + normalize: [], + short: 'Version of x509 format.', + type: 'keyword', + }, + }, + group: 2, + name: 'x509', + prefix: 'x509.', + reusable: { + expected: [ + { as: 'x509', at: 'file', full: 'file.x509' }, + { as: 'x509', at: 'threat.indicator', full: 'threat.indicator.x509' }, + { + as: 'x509', + at: 'threat.enrichments.indicator', + full: 'threat.enrichments.indicator.x509', + }, + { as: 'x509', at: 'tls.client', full: 'tls.client.x509' }, + { as: 'x509', at: 'tls.server', full: 'tls.server.x509' }, + ], + top_level: false, + }, + short: 'These fields contain x509 certificate metadata.', + title: 'x509 Certificate', + type: 'group', + }, +}; diff --git a/packages/kbn-ecs/generated/server.ts b/packages/kbn-ecs/generated/server.ts new file mode 100644 index 0000000000000..182eaca274a6d --- /dev/null +++ b/packages/kbn-ecs/generated/server.ts @@ -0,0 +1,186 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records. + * For TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection. For other protocols, the server is generally the responder in the network transaction. Some systems actually use the term "responder" to refer the server in TCP connections. The server fields describe details about the system acting as the server in the network event. Server fields are usually populated in conjunction with client fields. Server fields are generally not populated for packet-level events. + * Client / server representations can add semantic context to an exchange, which is helpful to visualize the data in certain situations. If your context falls in that category, you should still ensure that source and destination are filled appropriately. + */ +export interface EcsServer { + /** + * Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. + * Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. + */ + address?: string; + as?: { + /** + * Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + */ + number?: number; + organization?: { + /** + * Organization name. + */ + name?: string; + }; + }; + + /** + * Bytes sent from the server to the client. + */ + bytes?: number; + /** + * The domain name of the server system. + * This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. + */ + domain?: string; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * IP address of the server (IPv4 or IPv6). + */ + ip?: string; + /** + * MAC address of the server. + * The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. + */ + mac?: string; + nat?: { + /** + * Translated ip of destination based NAT sessions (e.g. internet to private DMZ) + * Typically used with load balancers, firewalls, or routers. + */ + ip?: string; + /** + * Translated port of destination based NAT sessions (e.g. internet to private DMZ) + * Typically used with load balancers, firewalls, or routers. + */ + port?: number; + }; + + /** + * Packets sent from the server to the client. + */ + packets?: number; + /** + * Port of the server. + */ + port?: number; + /** + * The highest registered server domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. + * For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + user?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; +} diff --git a/packages/kbn-ecs/generated/service.ts b/packages/kbn-ecs/generated/service.ts new file mode 100644 index 0000000000000..b25c422473fe5 --- /dev/null +++ b/packages/kbn-ecs/generated/service.ts @@ -0,0 +1,224 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The service fields describe the service for or from which the data was collected. + * These fields help you find and correlate logs for a specific service and version. + */ +export interface EcsService { + /** + * Address where data about this service was collected from. + * This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). + */ + address?: string; + /** + * Identifies the environment where the service is running. + * If the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment. + */ + environment?: string; + /** + * Ephemeral identifier of this service (if one exists). + * This id normally changes across restarts, but `service.id` does not. + */ + ephemeral_id?: string; + /** + * Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. + * This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. + * Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. + */ + id?: string; + /** + * Name of the service data is collected from. + * The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. + * In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. + */ + name?: string; + node?: { + /** + * Name of a service node. + * This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. + * In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. + */ + name?: string; + /** + * Deprecated for removal in next major version release. This field will be superseded by `node.roles`. + * Role of a service node. + * This allows for distinction between different running roles of the same service. + * In the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`. + * In the case of Elasticsearch, the `service.node.role` could be `master` or `data`. + * Other services could use this to distinguish between a `web` and `worker` role running as part of the service. + */ + role?: string; + /** + * Roles of a service node. + * This allows for distinction between different running roles of the same service. + * In the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both. + * In the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both. + * Other services could use this to distinguish between a `web` and `worker` role running as part of the service. + */ + roles?: string[]; + }; + + origin?: { + /** + * Address where data about this service was collected from. + * This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). + */ + address?: string; + /** + * Identifies the environment where the service is running. + * If the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment. + */ + environment?: string; + /** + * Ephemeral identifier of this service (if one exists). + * This id normally changes across restarts, but `service.id` does not. + */ + ephemeral_id?: string; + /** + * Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. + * This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. + * Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. + */ + id?: string; + /** + * Name of the service data is collected from. + * The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. + * In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. + */ + name?: string; + node?: { + /** + * Name of a service node. + * This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. + * In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. + */ + name?: string; + /** + * Deprecated for removal in next major version release. This field will be superseded by `node.roles`. + * Role of a service node. + * This allows for distinction between different running roles of the same service. + * In the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`. + * In the case of Elasticsearch, the `service.node.role` could be `master` or `data`. + * Other services could use this to distinguish between a `web` and `worker` role running as part of the service. + */ + role?: string; + /** + * Roles of a service node. + * This allows for distinction between different running roles of the same service. + * In the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both. + * In the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both. + * Other services could use this to distinguish between a `web` and `worker` role running as part of the service. + */ + roles?: string[]; + }; + + /** + * Current state of the service. + */ + state?: string; + /** + * The type of the service data is collected from. + * The type can be used to group and correlate logs and metrics from one service type. + * Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. + */ + type?: string; + /** + * Version of the service the data was collected from. + * This allows to look at a data set only for a specific version of a service. + */ + version?: string; + }; + + /** + * Current state of the service. + */ + state?: string; + target?: { + /** + * Address where data about this service was collected from. + * This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). + */ + address?: string; + /** + * Identifies the environment where the service is running. + * If the same service runs in different environments (production, staging, QA, development, etc.), the environment can identify other instances of the same service. Can also group services and applications from the same environment. + */ + environment?: string; + /** + * Ephemeral identifier of this service (if one exists). + * This id normally changes across restarts, but `service.id` does not. + */ + ephemeral_id?: string; + /** + * Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. + * This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. + * Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. + */ + id?: string; + /** + * Name of the service data is collected from. + * The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. + * In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. + */ + name?: string; + node?: { + /** + * Name of a service node. + * This allows for two nodes of the same service running on the same host to be differentiated. Therefore, `service.node.name` should typically be unique across nodes of a given service. + * In the case of Elasticsearch, the `service.node.name` could contain the unique node name within the Elasticsearch cluster. In cases where the service doesn't have the concept of a node name, the host name or container name can be used to distinguish running instances that make up this service. If those do not provide uniqueness (e.g. multiple instances of the service running on the same host) - the node name can be manually set. + */ + name?: string; + /** + * Deprecated for removal in next major version release. This field will be superseded by `node.roles`. + * Role of a service node. + * This allows for distinction between different running roles of the same service. + * In the case of Kibana, the `service.node.role` could be `ui` or `background_tasks`. + * In the case of Elasticsearch, the `service.node.role` could be `master` or `data`. + * Other services could use this to distinguish between a `web` and `worker` role running as part of the service. + */ + role?: string; + /** + * Roles of a service node. + * This allows for distinction between different running roles of the same service. + * In the case of Kibana, the `service.node.role` could be `ui` or `background_tasks` or both. + * In the case of Elasticsearch, the `service.node.role` could be `master` or `data` or both. + * Other services could use this to distinguish between a `web` and `worker` role running as part of the service. + */ + roles?: string[]; + }; + + /** + * Current state of the service. + */ + state?: string; + /** + * The type of the service data is collected from. + * The type can be used to group and correlate logs and metrics from one service type. + * Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. + */ + type?: string; + /** + * Version of the service the data was collected from. + * This allows to look at a data set only for a specific version of a service. + */ + version?: string; + }; + + /** + * The type of the service data is collected from. + * The type can be used to group and correlate logs and metrics from one service type. + * Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. + */ + type?: string; + /** + * Version of the service the data was collected from. + * This allows to look at a data set only for a specific version of a service. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/source.ts b/packages/kbn-ecs/generated/source.ts new file mode 100644 index 0000000000000..fbdb54009d999 --- /dev/null +++ b/packages/kbn-ecs/generated/source.ts @@ -0,0 +1,185 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction. + * Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated. + */ +export interface EcsSource { + /** + * Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. + * Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. + */ + address?: string; + as?: { + /** + * Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + */ + number?: number; + organization?: { + /** + * Organization name. + */ + name?: string; + }; + }; + + /** + * Bytes sent from the source to the destination. + */ + bytes?: number; + /** + * The domain name of the source system. + * This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. + */ + domain?: string; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * IP address of the source (IPv4 or IPv6). + */ + ip?: string; + /** + * MAC address of the source. + * The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. + */ + mac?: string; + nat?: { + /** + * Translated ip of source based NAT sessions (e.g. internal client to internet) + * Typically connections traversing load balancers, firewalls, or routers. + */ + ip?: string; + /** + * Translated port of source based NAT sessions. (e.g. internal client to internet) + * Typically used with load balancers, firewalls, or routers. + */ + port?: number; + }; + + /** + * Packets sent from the source to the destination. + */ + packets?: number; + /** + * Port of the source. + */ + port?: number; + /** + * The highest registered source domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. + * For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + user?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; +} diff --git a/packages/kbn-ecs/generated/threat.ts b/packages/kbn-ecs/generated/threat.ts new file mode 100644 index 0000000000000..afa74f8fe3bfb --- /dev/null +++ b/packages/kbn-ecs/generated/threat.ts @@ -0,0 +1,891 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework. + * These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service"). + */ +export interface EcsThreat { + /** + * A list of associated indicators objects enriching the event, and the context of that association/enrichment. + */ + enrichments?: Array>; + feed?: { + /** + * The saved object ID of the dashboard belonging to the threat feed for displaying dashboard links to threat feeds in Kibana. + */ + dashboard_id?: string; + /** + * Description of the threat feed in a UI friendly format. + */ + description?: string; + /** + * The name of the threat feed in UI friendly format. + */ + name?: string; + /** + * Reference information for the threat feed in a UI friendly format. + */ + reference?: string; + }; + + /** + * Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. + */ + framework?: string; + group?: { + /** + * The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community. + * While not required, you can use a MITRE ATT&CK® group alias(es). + */ + alias?: string[]; + /** + * The id of the group for a set of related intrusion activity that are tracked by a common name in the security community. + * While not required, you can use a MITRE ATT&CK® group id. + */ + id?: string; + /** + * The name of the group for a set of related intrusion activity that are tracked by a common name in the security community. + * While not required, you can use a MITRE ATT&CK® group name. + */ + name?: string; + /** + * The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community. + * While not required, you can use a MITRE ATT&CK® group reference URL. + */ + reference?: string; + }; + + indicator?: { + as?: { + /** + * Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + */ + number?: number; + organization?: { + /** + * Organization name. + */ + name?: string; + }; + }; + + /** + * Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields. + */ + confidence?: string; + /** + * Describes the type of action conducted by the threat. + */ + description?: string; + email?: { + /** + * Identifies a threat indicator as an email address (irrespective of direction). + */ + address?: string; + }; + + file?: { + /** + * Last time the file was accessed. + * Note that not all filesystems keep track of access time. + */ + accessed?: string; + /** + * Array of file attributes. + * Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. + */ + attributes?: string[]; + code_signature?: { + /** + * The hashing algorithm used to sign the process. + * This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. + */ + digest_algorithm?: string; + /** + * Boolean to capture if a signature is present. + */ + exists?: boolean; + /** + * The identifier used to sign the process. + * This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. + */ + signing_id?: string; + /** + * Additional information about the certificate status. + * This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. + */ + status?: string; + /** + * Subject name of the code signer + */ + subject_name?: string; + /** + * The team identifier used to sign the process. + * This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. + */ + team_id?: string; + /** + * Date and time when the code signature was generated and signed. + */ + timestamp?: string; + /** + * Stores the trust status of the certificate chain. + * Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. + */ + trusted?: boolean; + /** + * Boolean to capture if the digital signature is verified against the binary content. + * Leave unpopulated if a certificate was unchecked. + */ + valid?: boolean; + }; + + /** + * File creation time. + * Note that not all filesystems store the creation time. + */ + created?: string; + /** + * Last time the file attributes or metadata changed. + * Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. + */ + ctime?: string; + /** + * Device that is the source of the file. + */ + device?: string; + /** + * Directory where the file is located. It should include the drive letter, when appropriate. + */ + directory?: string; + /** + * Drive letter where the file is located. This field is only relevant on Windows. + * The value should be uppercase, and not include the colon. + */ + drive_letter?: string; + elf?: { + /** + * Machine architecture of the ELF file. + */ + architecture?: string; + /** + * Byte sequence of ELF file. + */ + byte_order?: string; + /** + * CPU type of the ELF file. + */ + cpu_type?: string; + /** + * Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. + */ + creation_date?: string; + /** + * List of exported element names and types. + */ + exports?: Array>; + header?: { + /** + * Version of the ELF Application Binary Interface (ABI). + */ + abi_version?: string; + /** + * Header class of the ELF file. + */ + class?: string; + /** + * Data table of the ELF header. + */ + data?: string; + /** + * Header entrypoint of the ELF file. + */ + entrypoint?: number; + /** + * "0x1" for original ELF files. + */ + object_version?: string; + /** + * Application Binary Interface (ABI) of the Linux OS. + */ + os_abi?: string; + /** + * Header type of the ELF file. + */ + type?: string; + /** + * Version of the ELF header. + */ + version?: string; + }; + + /** + * List of imported element names and types. + */ + imports?: Array>; + /** + * An array containing an object for each section of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. + */ + sections?: Array>; + /** + * An array containing an object for each segment of the ELF file. + * The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. + */ + segments?: Array>; + /** + * List of shared libraries used by this ELF object. + */ + shared_libraries?: string[]; + /** + * telfhash symbol hash for ELF file. + */ + telfhash?: string; + }; + + /** + * File extension, excluding the leading dot. + * Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). + */ + extension?: string; + /** + * A fork is additional data associated with a filesystem object. + * On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist. + * On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name. + */ + fork_name?: string; + /** + * Primary group ID (GID) of the file. + */ + gid?: string; + /** + * Primary group name of the file. + */ + group?: string; + hash?: { + /** + * MD5 hash. + */ + md5?: string; + /** + * SHA1 hash. + */ + sha1?: string; + /** + * SHA256 hash. + */ + sha256?: string; + /** + * SHA384 hash. + */ + sha384?: string; + /** + * SHA512 hash. + */ + sha512?: string; + /** + * SSDEEP hash. + */ + ssdeep?: string; + /** + * TLSH hash. + */ + tlsh?: string; + }; + + /** + * Inode representing the file in the filesystem. + */ + inode?: string; + /** + * MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. + */ + mime_type?: string; + /** + * Mode of the file in octal representation. + */ + mode?: string; + /** + * Last time the file content was modified. + */ + mtime?: string; + /** + * Name of the file including the extension, without the directory. + */ + name?: string; + /** + * File owner's username. + */ + owner?: string; + /** + * Full path to the file, including the file name. It should include the drive letter, when appropriate. + */ + path?: string; + pe?: { + /** + * CPU architecture target for the file. + */ + architecture?: string; + /** + * Internal company name of the file, provided at compile-time. + */ + company?: string; + /** + * Internal description of the file, provided at compile-time. + */ + description?: string; + /** + * Internal version of the file, provided at compile-time. + */ + file_version?: string; + /** + * A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. + * Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. + */ + imphash?: string; + /** + * Internal name of the file, provided at compile-time. + */ + original_file_name?: string; + /** + * A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. + * Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. + */ + pehash?: string; + /** + * Internal product name of the file, provided at compile-time. + */ + product?: string; + }; + + /** + * File size in bytes. + * Only relevant when `file.type` is "file". + */ + size?: number; + /** + * Target path for symlinks. + */ + target_path?: string; + /** + * File type (file, dir, or symlink). + */ + type?: string; + /** + * The user ID (UID) or security identifier (SID) of the file owner. + */ + uid?: string; + x509?: { + /** + * List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. + */ + alternative_names?: string[]; + issuer?: { + /** + * List of common name (CN) of issuing certificate authority. + */ + common_name?: string[]; + /** + * List of country \(C) codes + */ + country?: string[]; + /** + * Distinguished name (DN) of issuing certificate authority. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of issuing certificate authority. + */ + organization?: string[]; + /** + * List of organizational units (OU) of issuing certificate authority. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Time at which the certificate is no longer considered valid. + */ + not_after?: string; + /** + * Time at which the certificate is first considered valid. + */ + not_before?: string; + /** + * Algorithm used to generate the public key. + */ + public_key_algorithm?: string; + /** + * The curve used by the elliptic curve public key algorithm. This is algorithm specific. + */ + public_key_curve?: string; + /** + * Exponent used to derive the public key. This is algorithm specific. + */ + public_key_exponent?: number; + /** + * The size of the public key space in bits. + */ + public_key_size?: number; + /** + * Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + */ + serial_number?: string; + /** + * Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + */ + signature_algorithm?: string; + subject?: { + /** + * List of common names (CN) of subject. + */ + common_name?: string[]; + /** + * List of country \(C) code + */ + country?: string[]; + /** + * Distinguished name (DN) of the certificate subject entity. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of subject. + */ + organization?: string[]; + /** + * List of organizational units (OU) of subject. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Version of x509 format. + */ + version_number?: string; + }; + }; + + /** + * The date and time when intelligence source first reported sighting this indicator. + */ + first_seen?: string; + geo?: { + /** + * City name. + */ + city_name?: string; + /** + * Two-letter code representing continent's name. + */ + continent_code?: string; + /** + * Name of the continent. + */ + continent_name?: string; + /** + * Country ISO code. + */ + country_iso_code?: string; + /** + * Country name. + */ + country_name?: string; + /** + * Longitude and latitude. + */ + location?: { lat: number; lon: number }; + /** + * User-defined description of a location, at the level of granularity they care about. + * Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. + * Not typically used in automated geolocation. + */ + name?: string; + /** + * Postal code associated with the location. + * Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. + */ + postal_code?: string; + /** + * Region ISO code. + */ + region_iso_code?: string; + /** + * Region name. + */ + region_name?: string; + /** + * The time zone of the location, such as IANA time zone name. + */ + timezone?: string; + }; + + /** + * Identifies a threat indicator as an IP address (irrespective of direction). + */ + ip?: string; + /** + * The date and time when intelligence source last reported sighting this indicator. + */ + last_seen?: string; + marking?: { + /** + * Traffic Light Protocol sharing markings. + */ + tlp?: string; + }; + + /** + * The date and time when intelligence source last modified information for this indicator. + */ + modified_at?: string; + /** + * Identifies a threat indicator as a port number (irrespective of direction). + */ + port?: number; + /** + * The name of the indicator's provider. + */ + provider?: string; + /** + * Reference URL linking to additional information about this indicator. + */ + reference?: string; + registry?: { + data?: { + /** + * Original bytes written with base64 encoding. + * For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. + */ + bytes?: string; + /** + * Content when writing string types. + * Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). + */ + strings?: string[]; + /** + * Standard registry type for encoding contents + */ + type?: string; + }; + + /** + * Abbreviated name for the hive. + */ + hive?: string; + /** + * Hive-relative path of keys. + */ + key?: string; + /** + * Full path, including hive, key and value + */ + path?: string; + /** + * Name of the value written. + */ + value?: string; + }; + + /** + * Count of AV/EDR vendors that successfully detected malicious file or URL. + */ + scanner_stats?: number; + /** + * Number of times this indicator was observed conducting threat activity. + */ + sightings?: number; + /** + * Type of indicator as represented by Cyber Observable in STIX 2.0. + */ + type?: string; + url?: { + /** + * Domain of the url, such as "www.elastic.co". + * In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. + * If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. + */ + domain?: string; + /** + * The field contains the file extension from the original request url, excluding the leading dot. + * The file extension is only set if it exists, as not every url has a file extension. + * The leading period must not be included. For example, the value must be "png", not ".png". + * Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). + */ + extension?: string; + /** + * Portion of the url after the `#`, such as "top". + * The `#` is not part of the fragment. + */ + fragment?: string; + /** + * If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. + */ + full?: string; + /** + * Unmodified original url as seen in the event source. + * Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. + * This field is meant to represent the URL as it was observed, complete or not. + */ + original?: string; + /** + * Password of the request. + */ + password?: string; + /** + * Path of the request, such as "/search". + */ + path?: string; + /** + * Port of the request, such as 443. + */ + port?: number; + /** + * The query field describes the query string of the request, such as "q=elasticsearch". + * The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. + */ + query?: string; + /** + * The highest registered url domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * Scheme of the request, such as "https". + * Note: The `:` is not part of the scheme. + */ + scheme?: string; + /** + * The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. + * For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + /** + * Username of the request. + */ + username?: string; + }; + + x509?: { + /** + * List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. + */ + alternative_names?: string[]; + issuer?: { + /** + * List of common name (CN) of issuing certificate authority. + */ + common_name?: string[]; + /** + * List of country \(C) codes + */ + country?: string[]; + /** + * Distinguished name (DN) of issuing certificate authority. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of issuing certificate authority. + */ + organization?: string[]; + /** + * List of organizational units (OU) of issuing certificate authority. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Time at which the certificate is no longer considered valid. + */ + not_after?: string; + /** + * Time at which the certificate is first considered valid. + */ + not_before?: string; + /** + * Algorithm used to generate the public key. + */ + public_key_algorithm?: string; + /** + * The curve used by the elliptic curve public key algorithm. This is algorithm specific. + */ + public_key_curve?: string; + /** + * Exponent used to derive the public key. This is algorithm specific. + */ + public_key_exponent?: number; + /** + * The size of the public key space in bits. + */ + public_key_size?: number; + /** + * Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + */ + serial_number?: string; + /** + * Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + */ + signature_algorithm?: string; + subject?: { + /** + * List of common names (CN) of subject. + */ + common_name?: string[]; + /** + * List of country \(C) code + */ + country?: string[]; + /** + * Distinguished name (DN) of the certificate subject entity. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of subject. + */ + organization?: string[]; + /** + * List of organizational units (OU) of subject. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Version of x509 format. + */ + version_number?: string; + }; + }; + + software?: { + /** + * The alias(es) of the software for a set of related intrusion activity that are tracked by a common name in the security community. + * While not required, you can use a MITRE ATT&CK® associated software description. + */ + alias?: string[]; + /** + * The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. + * While not required, you can use a MITRE ATT&CK® software id. + */ + id?: string; + /** + * The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. + * While not required, you can use a MITRE ATT&CK® software name. + */ + name?: string; + /** + * The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. + * While not required, you can use MITRE ATT&CK® software platform values. + */ + platforms?: string[]; + /** + * The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. + * While not required, you can use a MITRE ATT&CK® software reference URL. + */ + reference?: string; + /** + * The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®. + * While not required, you can use a MITRE ATT&CK® software type. + */ + type?: string; + }; + + tactic?: { + /** + * The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) + */ + id?: string[]; + /** + * Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) + */ + name?: string[]; + /** + * The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) + */ + reference?: string[]; + }; + + technique?: { + /** + * The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) + */ + id?: string[]; + /** + * The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) + */ + name?: string[]; + /** + * The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) + */ + reference?: string[]; + subtechnique?: { + /** + * The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) + */ + id?: string[]; + /** + * The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) + */ + name?: string[]; + /** + * The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) + */ + reference?: string[]; + }; + }; + + threat?: { + indicator?: { + marking?: { + tlp?: { + /** + * Traffic Light Protocol version. + */ + version?: string; + }; + }; + }; + }; +} diff --git a/packages/kbn-ecs/generated/tls.ts b/packages/kbn-ecs/generated/tls.ts new file mode 100644 index 0000000000000..5ce5343a73ab6 --- /dev/null +++ b/packages/kbn-ecs/generated/tls.ts @@ -0,0 +1,349 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Fields related to a TLS connection. These fields focus on the TLS protocol itself and intentionally avoids in-depth analysis of the related x.509 certificate files. + */ +export interface EcsTls { + /** + * String indicating the cipher used during the current connection. + */ + cipher?: string; + client?: { + /** + * PEM-encoded stand-alone certificate offered by the client. This is usually mutually-exclusive of `client.certificate_chain` since this value also exists in that list. + */ + certificate?: string; + /** + * Array of PEM-encoded certificates that make up the certificate chain offered by the client. This is usually mutually-exclusive of `client.certificate` since that value should be the first certificate in the chain. + */ + certificate_chain?: string[]; + hash?: { + /** + * Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. + */ + md5?: string; + /** + * Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. + */ + sha1?: string; + /** + * Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash. + */ + sha256?: string; + }; + + /** + * Distinguished name of subject of the issuer of the x.509 certificate presented by the client. + */ + issuer?: string; + /** + * A hash that identifies clients based on how they perform an SSL/TLS handshake. + */ + ja3?: string; + /** + * Date/Time indicating when client certificate is no longer considered valid. + */ + not_after?: string; + /** + * Date/Time indicating when client certificate is first considered valid. + */ + not_before?: string; + /** + * Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`. + */ + server_name?: string; + /** + * Distinguished name of subject of the x.509 certificate presented by the client. + */ + subject?: string; + /** + * Array of ciphers offered by the client during the client hello. + */ + supported_ciphers?: string[]; + x509?: { + /** + * List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. + */ + alternative_names?: string[]; + issuer?: { + /** + * List of common name (CN) of issuing certificate authority. + */ + common_name?: string[]; + /** + * List of country \(C) codes + */ + country?: string[]; + /** + * Distinguished name (DN) of issuing certificate authority. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of issuing certificate authority. + */ + organization?: string[]; + /** + * List of organizational units (OU) of issuing certificate authority. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Time at which the certificate is no longer considered valid. + */ + not_after?: string; + /** + * Time at which the certificate is first considered valid. + */ + not_before?: string; + /** + * Algorithm used to generate the public key. + */ + public_key_algorithm?: string; + /** + * The curve used by the elliptic curve public key algorithm. This is algorithm specific. + */ + public_key_curve?: string; + /** + * Exponent used to derive the public key. This is algorithm specific. + */ + public_key_exponent?: number; + /** + * The size of the public key space in bits. + */ + public_key_size?: number; + /** + * Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + */ + serial_number?: string; + /** + * Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + */ + signature_algorithm?: string; + subject?: { + /** + * List of common names (CN) of subject. + */ + common_name?: string[]; + /** + * List of country \(C) code + */ + country?: string[]; + /** + * Distinguished name (DN) of the certificate subject entity. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of subject. + */ + organization?: string[]; + /** + * List of organizational units (OU) of subject. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Version of x509 format. + */ + version_number?: string; + }; + }; + + /** + * String indicating the curve used for the given cipher, when applicable. + */ + curve?: string; + /** + * Boolean flag indicating if the TLS negotiation was successful and transitioned to an encrypted tunnel. + */ + established?: boolean; + /** + * String indicating the protocol being tunneled. Per the values in the IANA registry (https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids), this string should be lower case. + */ + next_protocol?: string; + /** + * Boolean flag indicating if this TLS connection was resumed from an existing TLS negotiation. + */ + resumed?: boolean; + server?: { + /** + * PEM-encoded stand-alone certificate offered by the server. This is usually mutually-exclusive of `server.certificate_chain` since this value also exists in that list. + */ + certificate?: string; + /** + * Array of PEM-encoded certificates that make up the certificate chain offered by the server. This is usually mutually-exclusive of `server.certificate` since that value should be the first certificate in the chain. + */ + certificate_chain?: string[]; + hash?: { + /** + * Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. + */ + md5?: string; + /** + * Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. + */ + sha1?: string; + /** + * Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the server. For consistency with other hash values, this value should be formatted as an uppercase hash. + */ + sha256?: string; + }; + + /** + * Subject of the issuer of the x.509 certificate presented by the server. + */ + issuer?: string; + /** + * A hash that identifies servers based on how they perform an SSL/TLS handshake. + */ + ja3s?: string; + /** + * Timestamp indicating when server certificate is no longer considered valid. + */ + not_after?: string; + /** + * Timestamp indicating when server certificate is first considered valid. + */ + not_before?: string; + /** + * Subject of the x.509 certificate presented by the server. + */ + subject?: string; + x509?: { + /** + * List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. + */ + alternative_names?: string[]; + issuer?: { + /** + * List of common name (CN) of issuing certificate authority. + */ + common_name?: string[]; + /** + * List of country \(C) codes + */ + country?: string[]; + /** + * Distinguished name (DN) of issuing certificate authority. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of issuing certificate authority. + */ + organization?: string[]; + /** + * List of organizational units (OU) of issuing certificate authority. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Time at which the certificate is no longer considered valid. + */ + not_after?: string; + /** + * Time at which the certificate is first considered valid. + */ + not_before?: string; + /** + * Algorithm used to generate the public key. + */ + public_key_algorithm?: string; + /** + * The curve used by the elliptic curve public key algorithm. This is algorithm specific. + */ + public_key_curve?: string; + /** + * Exponent used to derive the public key. This is algorithm specific. + */ + public_key_exponent?: number; + /** + * The size of the public key space in bits. + */ + public_key_size?: number; + /** + * Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + */ + serial_number?: string; + /** + * Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + */ + signature_algorithm?: string; + subject?: { + /** + * List of common names (CN) of subject. + */ + common_name?: string[]; + /** + * List of country \(C) code + */ + country?: string[]; + /** + * Distinguished name (DN) of the certificate subject entity. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of subject. + */ + organization?: string[]; + /** + * List of organizational units (OU) of subject. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Version of x509 format. + */ + version_number?: string; + }; + }; + + /** + * Numeric part of the version parsed from the original string. + */ + version?: string; + /** + * Normalized lowercase protocol name parsed from original string. + */ + version_protocol?: string; +} diff --git a/packages/kbn-ecs/generated/tracing.ts b/packages/kbn-ecs/generated/tracing.ts new file mode 100644 index 0000000000000..f893979ea4a4c --- /dev/null +++ b/packages/kbn-ecs/generated/tracing.ts @@ -0,0 +1,37 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services. + * Unlike most field sets in ECS, the tracing fields are *not* nested under the field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, and so on. + */ +export interface EcsTracing { + span?: { + /** + * Unique identifier of the span within the scope of its trace. + * A span represents an operation within a transaction, such as a request to another service, or a database query. + */ + id?: string; + }; + + trace?: { + /** + * Unique identifier of the trace. + * A trace groups multiple events like transactions that belong together. For example, a user request handled by multiple inter-connected services. + */ + id?: string; + }; + + transaction?: { + /** + * Unique identifier of the transaction within the scope of its trace. + * A transaction is the highest level of work measured within a service, such as a request to a server. + */ + id?: string; + }; +} diff --git a/packages/kbn-ecs/generated/url.ts b/packages/kbn-ecs/generated/url.ts new file mode 100644 index 0000000000000..ad64ff8b90fb0 --- /dev/null +++ b/packages/kbn-ecs/generated/url.ts @@ -0,0 +1,83 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * URL fields provide support for complete or partial URLs, and supports the breaking down into scheme, domain, path, and so on. + */ +export interface EcsUrl { + /** + * Domain of the url, such as "www.elastic.co". + * In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. + * If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. + */ + domain?: string; + /** + * The field contains the file extension from the original request url, excluding the leading dot. + * The file extension is only set if it exists, as not every url has a file extension. + * The leading period must not be included. For example, the value must be "png", not ".png". + * Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). + */ + extension?: string; + /** + * Portion of the url after the `#`, such as "top". + * The `#` is not part of the fragment. + */ + fragment?: string; + /** + * If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. + */ + full?: string; + /** + * Unmodified original url as seen in the event source. + * Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. + * This field is meant to represent the URL as it was observed, complete or not. + */ + original?: string; + /** + * Password of the request. + */ + password?: string; + /** + * Path of the request, such as "/search". + */ + path?: string; + /** + * Port of the request, such as 443. + */ + port?: number; + /** + * The query field describes the query string of the request, such as "q=elasticsearch". + * The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. + */ + query?: string; + /** + * The highest registered url domain, stripped of the subdomain. + * For example, the registered domain for "foo.example.com" is "example.com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + */ + registered_domain?: string; + /** + * Scheme of the request, such as "https". + * Note: The `:` is not part of the scheme. + */ + scheme?: string; + /** + * The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. + * For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. + */ + subdomain?: string; + /** + * The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + * This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + */ + top_level_domain?: string; + /** + * Username of the request. + */ + username?: string; +} diff --git a/packages/kbn-ecs/generated/user.ts b/packages/kbn-ecs/generated/user.ts new file mode 100644 index 0000000000000..9f22ea7d7cc8d --- /dev/null +++ b/packages/kbn-ecs/generated/user.ts @@ -0,0 +1,233 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The user fields describe information about the user that is relevant to the event. + * Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them. + */ +export interface EcsUser { + changes?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; + + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + effective?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; + + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + risk?: { + /** + * A risk classification level calculated by an internal system as part of entity analytics and entity risk scoring. + */ + calculated_level?: string; + /** + * A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring. + */ + calculated_score?: number; + /** + * A risk classification score calculated by an internal system as part of entity analytics and entity risk scoring, and normalized to a range of 0 to 100. + */ + calculated_score_norm?: number; + /** + * A risk classification level obtained from outside the system, such as from some external Threat Intelligence Platform. + */ + static_level?: string; + /** + * A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform. + */ + static_score?: number; + /** + * A risk classification score obtained from outside the system, such as from some external Threat Intelligence Platform, and normalized to a range of 0 to 100. + */ + static_score_norm?: number; + }; + + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + target?: { + /** + * Name of the directory the user is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * User email address. + */ + email?: string; + /** + * User's full name, if available. + */ + full_name?: string; + group?: { + /** + * Name of the directory the group is a member of. + * For example, an LDAP or Active Directory domain name. + */ + domain?: string; + /** + * Unique identifier for the group on the system/platform. + */ + id?: string; + /** + * Name of the group. + */ + name?: string; + }; + + /** + * Unique user hash to correlate information for a user in anonymized form. + * Useful if `user.id` or `user.name` contain confidential information and cannot be used. + */ + hash?: string; + /** + * Unique identifier of the user. + */ + id?: string; + /** + * Short name or login of the user. + */ + name?: string; + /** + * Array of user roles at the time of the event. + */ + roles?: string[]; + }; +} diff --git a/packages/kbn-ecs/generated/user_agent.ts b/packages/kbn-ecs/generated/user_agent.ts new file mode 100644 index 0000000000000..7ca483c745af0 --- /dev/null +++ b/packages/kbn-ecs/generated/user_agent.ts @@ -0,0 +1,65 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The user_agent fields normally come from a browser request. + * They often show up in web service logs coming from the parsed user agent string. + */ +export interface EcsUserAgent { + device?: { + /** + * Name of the device. + */ + name?: string; + }; + + /** + * Name of the user agent. + */ + name?: string; + /** + * Unparsed user_agent string. + */ + original?: string; + os?: { + /** + * OS family (such as redhat, debian, freebsd, windows). + */ + family?: string; + /** + * Operating system name, including the version or code name. + */ + full?: string; + /** + * Operating system kernel version as a raw string. + */ + kernel?: string; + /** + * Operating system name, without the version. + */ + name?: string; + /** + * Operating system platform (such centos, ubuntu, windows). + */ + platform?: string; + /** + * Use the `os.type` field to categorize the operating system into one of the broad commercial families. + * If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. + */ + type?: string; + /** + * Operating system version as a raw string. + */ + version?: string; + }; + + /** + * Version of the user agent. + */ + version?: string; +} diff --git a/packages/kbn-ecs/generated/vlan.ts b/packages/kbn-ecs/generated/vlan.ts new file mode 100644 index 0000000000000..af461a711db05 --- /dev/null +++ b/packages/kbn-ecs/generated/vlan.ts @@ -0,0 +1,24 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The VLAN fields are used to identify 802.1q tag(s) of a packet, as well as ingress and egress VLAN associations of an observer in relation to a specific packet or connection. + * Network.vlan fields are used to record a single VLAN tag, or the outer tag in the case of q-in-q encapsulations, for a packet or connection as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. + * Network.inner VLAN fields are used to report inner q-in-q 802.1q tags (multiple 802.1q encapsulations) as observed, typically provided by a network sensor (e.g. Zeek, Wireshark) passively reporting on traffic. Network.inner VLAN fields should only be used in addition to network.vlan fields to indicate q-in-q tagging. + * Observer.ingress and observer.egress VLAN values are used to record observer specific information when observer events contain discrete ingress and egress VLAN information, typically provided by firewalls, routers, or load balancers. + */ +export interface EcsVlan { + /** + * VLAN ID as reported by the observer. + */ + id?: string; + /** + * Optional VLAN name as reported by the observer. + */ + name?: string; +} diff --git a/packages/kbn-ecs/generated/vulnerability.ts b/packages/kbn-ecs/generated/vulnerability.ts new file mode 100644 index 0000000000000..fb6fb6c79cef3 --- /dev/null +++ b/packages/kbn-ecs/generated/vulnerability.ts @@ -0,0 +1,76 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * The vulnerability fields describe information about a vulnerability that is relevant to an event. + */ +export interface EcsVulnerability { + /** + * The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) + * This field must be an array. + */ + category?: string[]; + /** + * The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) + */ + classification?: string; + /** + * The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) + */ + description?: string; + /** + * The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) + */ + enumeration?: string; + /** + * The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] + */ + id?: string; + /** + * A resource that provides additional information, context, and mitigations for the identified vulnerability. + */ + reference?: string; + /** + * The report or scan identification number. + */ + report_id?: string; + scanner?: { + /** + * The name of the vulnerability scanner vendor. + */ + vendor?: string; + }; + + score?: { + /** + * Scores can range from 0.0 to 10.0, with 10.0 being the most severe. + * Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) + */ + base?: number; + /** + * Scores can range from 0.0 to 10.0, with 10.0 being the most severe. + * Environmental scores cover an assessment for any modified Base metrics, confidentiality, integrity, and availability requirements. For example (https://www.first.org/cvss/specification-document) + */ + environmental?: number; + /** + * Scores can range from 0.0 to 10.0, with 10.0 being the most severe. + * Temporal scores cover an assessment for code maturity, remediation level, and confidence. For example (https://www.first.org/cvss/specification-document) + */ + temporal?: number; + /** + * The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. + * CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) + */ + version?: string; + }; + + /** + * The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) + */ + severity?: string; +} diff --git a/packages/kbn-ecs/generated/x509.ts b/packages/kbn-ecs/generated/x509.ts new file mode 100644 index 0000000000000..f4db637a110c1 --- /dev/null +++ b/packages/kbn-ecs/generated/x509.ts @@ -0,0 +1,117 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +/** + * This implements the common core fields for x509 certificates. This information is likely logged with TLS sessions, digital signatures found in executable binaries, S/MIME information in email bodies, or analysis of files on disk. + * When the certificate relates to a file, use the fields at `file.x509`. When hashes of the DER-encoded certificate are available, the `hash` data set should be populated as well (e.g. `file.hash.sha256`). + * Events that contain certificate information about network connections, should use the x509 fields under the relevant TLS fields: `tls.server.x509` and/or `tls.client.x509`. + */ +export interface EcsX509 { + /** + * List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. + */ + alternative_names?: string[]; + issuer?: { + /** + * List of common name (CN) of issuing certificate authority. + */ + common_name?: string[]; + /** + * List of country \(C) codes + */ + country?: string[]; + /** + * Distinguished name (DN) of issuing certificate authority. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of issuing certificate authority. + */ + organization?: string[]; + /** + * List of organizational units (OU) of issuing certificate authority. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Time at which the certificate is no longer considered valid. + */ + not_after?: string; + /** + * Time at which the certificate is first considered valid. + */ + not_before?: string; + /** + * Algorithm used to generate the public key. + */ + public_key_algorithm?: string; + /** + * The curve used by the elliptic curve public key algorithm. This is algorithm specific. + */ + public_key_curve?: string; + /** + * Exponent used to derive the public key. This is algorithm specific. + */ + public_key_exponent?: number; + /** + * The size of the public key space in bits. + */ + public_key_size?: number; + /** + * Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. + */ + serial_number?: string; + /** + * Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. + */ + signature_algorithm?: string; + subject?: { + /** + * List of common names (CN) of subject. + */ + common_name?: string[]; + /** + * List of country \(C) code + */ + country?: string[]; + /** + * Distinguished name (DN) of the certificate subject entity. + */ + distinguished_name?: string; + /** + * List of locality names (L) + */ + locality?: string[]; + /** + * List of organizations (O) of subject. + */ + organization?: string[]; + /** + * List of organizational units (OU) of subject. + */ + organizational_unit?: string[]; + /** + * List of state or province names (ST, S, or P) + */ + state_or_province?: string[]; + }; + + /** + * Version of x509 format. + */ + version_number?: string; +} diff --git a/packages/kbn-ecs/index.ts b/packages/kbn-ecs/index.ts index 2ad902cd523c9..a25cdcc7ed297 100644 --- a/packages/kbn-ecs/index.ts +++ b/packages/kbn-ecs/index.ts @@ -6,4 +6,4 @@ * Side Public License, v 1. */ -export * from './src/ecs'; +export * from './generated'; diff --git a/packages/kbn-ecs/src/ecs/base.ts b/packages/kbn-ecs/src/ecs/base.ts deleted file mode 100644 index df633aa882c3a..0000000000000 --- a/packages/kbn-ecs/src/ecs/base.ts +++ /dev/null @@ -1,19 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-base.html - * - * @internal - */ -export interface EcsBase { - ['@timestamp']: string; - labels?: Record; - message?: string; - tags?: string[]; -} diff --git a/packages/kbn-ecs/src/ecs/client.ts b/packages/kbn-ecs/src/ecs/client.ts deleted file mode 100644 index 5597ee8080060..0000000000000 --- a/packages/kbn-ecs/src/ecs/client.ts +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsAutonomousSystem } from './autonomous_system'; -import { EcsGeo } from './geo'; -import { EcsNestedUser } from './user'; - -interface NestedFields { - as?: EcsAutonomousSystem; - geo?: EcsGeo; - user?: EcsNestedUser; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-client.html - * - * @internal - */ -export interface EcsClient extends NestedFields { - address?: string; - bytes?: number; - domain?: string; - ip?: string; - mac?: string; - nat?: { ip?: string; port?: number }; - packets?: number; - port?: number; - registered_domain?: string; - subdomain?: string; - top_level_domain?: string; -} diff --git a/packages/kbn-ecs/src/ecs/cloud.ts b/packages/kbn-ecs/src/ecs/cloud.ts deleted file mode 100644 index 55f43a523cced..0000000000000 --- a/packages/kbn-ecs/src/ecs/cloud.ts +++ /dev/null @@ -1,23 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-cloud.html - * - * @internal - */ -export interface EcsCloud { - account?: { id?: string; name?: string }; - availability_zone?: string; - instance?: { id?: string; name?: string }; - machine?: { type: string }; - project?: { id?: string; name?: string }; - provider?: string; - region?: string; - service?: { name: string }; -} diff --git a/packages/kbn-ecs/src/ecs/code_signature.ts b/packages/kbn-ecs/src/ecs/code_signature.ts deleted file mode 100644 index ead0a9dc73570..0000000000000 --- a/packages/kbn-ecs/src/ecs/code_signature.ts +++ /dev/null @@ -1,24 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-code_signature.html - * - * @internal - */ -export interface EcsCodeSignature { - digest_algorithm?: string; - exists?: boolean; - signing_id?: string; - status?: string; - subject_name?: string; - timestamp?: string; - team_id?: string; - trusted?: boolean; - valid?: boolean; -} diff --git a/packages/kbn-ecs/src/ecs/container.ts b/packages/kbn-ecs/src/ecs/container.ts deleted file mode 100644 index 52997b9e0ec55..0000000000000 --- a/packages/kbn-ecs/src/ecs/container.ts +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-container.html - * - * @internal - */ -export interface EcsContainer { - cpu?: { usage?: number }; - disk?: Disk; - id?: string; - image?: Image; - labels?: Record; - memory?: { usage?: number }; - name?: string; - network?: Network; - runtime?: string; -} - -interface Disk { - read?: { bytes?: number }; - write?: { bytes?: number }; -} - -interface Image { - hash?: { all: string[] }; - name?: string; - tag?: string[]; -} - -interface Network { - egress?: { bytes?: number }; - ingress?: { bytes?: number }; -} diff --git a/packages/kbn-ecs/src/ecs/data_stream.ts b/packages/kbn-ecs/src/ecs/data_stream.ts deleted file mode 100644 index 1f941e3ec5f9d..0000000000000 --- a/packages/kbn-ecs/src/ecs/data_stream.ts +++ /dev/null @@ -1,18 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-data_stream.html - * - * @internal - */ -export interface EcsDataStream { - dataset?: string; - namespace?: string; - type?: 'logs' | 'metrics'; -} diff --git a/packages/kbn-ecs/src/ecs/destination.ts b/packages/kbn-ecs/src/ecs/destination.ts deleted file mode 100644 index 7c2facd3dc2f9..0000000000000 --- a/packages/kbn-ecs/src/ecs/destination.ts +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsAutonomousSystem } from './autonomous_system'; -import { EcsGeo } from './geo'; -import { EcsNestedUser } from './user'; - -interface NestedFields { - as?: EcsAutonomousSystem; - geo?: EcsGeo; - user?: EcsNestedUser; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-destination.html - * - * @internal - */ -export interface EcsDestination extends NestedFields { - address?: string; - bytes?: number; - domain?: string; - ip?: string; - mac?: string; - nat?: { ip?: string; port?: number }; - packets?: number; - port?: number; - registered_domain?: string; - subdomain?: string; - top_level_domain?: string; -} diff --git a/packages/kbn-ecs/src/ecs/dll.ts b/packages/kbn-ecs/src/ecs/dll.ts deleted file mode 100644 index 863afda6453ee..0000000000000 --- a/packages/kbn-ecs/src/ecs/dll.ts +++ /dev/null @@ -1,25 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsCodeSignature } from './code_signature'; -import { EcsHash } from './hash'; - -interface NestedFields { - code_signature?: EcsCodeSignature; - hash?: EcsHash; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-dll.html - * - * @internal - */ -export interface EcsDll extends NestedFields { - name?: string; - path?: string; -} diff --git a/packages/kbn-ecs/src/ecs/dns.ts b/packages/kbn-ecs/src/ecs/dns.ts deleted file mode 100644 index efca3750127d0..0000000000000 --- a/packages/kbn-ecs/src/ecs/dns.ts +++ /dev/null @@ -1,42 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-dns.html - * - * @internal - */ -export interface EcsDns { - answers?: Answer[]; - header_flags?: HeaderFlags[]; - id?: number; - op_code?: string; - question?: Question; - resolved_ip?: string[]; - response_code?: string; - type?: string; -} - -type HeaderFlags = 'AA' | 'TC' | 'RD' | 'RA' | 'AD' | 'CD' | 'DO'; - -interface Answer { - data: string; - class?: string; - name?: string; - ttl?: number; - type?: string; -} - -interface Question { - class?: string; - name?: string; - registered_domain?: string; - subdomain?: string; - top_level_domain?: string; - type?: string; -} diff --git a/packages/kbn-ecs/src/ecs/elf.ts b/packages/kbn-ecs/src/ecs/elf.ts deleted file mode 100644 index 6b2588c63ffaa..0000000000000 --- a/packages/kbn-ecs/src/ecs/elf.ts +++ /dev/null @@ -1,71 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-elf.html - * - * @internal - */ -export interface EcsElf { - architecture?: string; - byte_order?: string; - cpu_type?: string; - creation_date?: string; - exports?: Export[]; - imports?: Import[]; - header?: Header; - sections?: Section[]; - segments?: Segment[]; - shared_libraries?: string[]; - telfhash?: string; -} - -interface Export { - binding?: string; - name?: string; - section?: string; - size?: string; - type?: string; - version?: string; - visibility?: string; -} - -interface Import { - library?: string; - name?: string; - type?: string; - version?: string; -} - -interface Header { - abi_version?: string; - class?: string; - data?: string; - entrypoint?: number; - object_version?: string; - os_abi?: string; - type?: string; - version?: string; -} - -interface Section { - chi2?: number; - entropy?: number; - flags?: string; - name?: string; - physical_offset?: string; - physical_size?: number; - type?: string; - virtual_address?: number; - virtual_size?: number; -} - -interface Segment { - sections?: string; - type?: string; -} diff --git a/packages/kbn-ecs/src/ecs/email.ts b/packages/kbn-ecs/src/ecs/email.ts deleted file mode 100644 index fcc3295fd71b5..0000000000000 --- a/packages/kbn-ecs/src/ecs/email.ts +++ /dev/null @@ -1,48 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsFile } from './file'; -import { EcsHash } from './hash'; - -interface NestedFields { - // Not all hash types are explicitly supported, see - // https://github.com/elastic/ecs/pull/1569 - hash?: Pick; -} - -interface AttachmentNestedFields { - file?: Pick; -} - -/** - * No docs yet, see https://github.com/elastic/ecs/pull/1569 - * - * @internal - */ -export interface EcsEmail extends NestedFields { - attachments?: Attachment[]; - bcc?: string[]; - cc?: string[]; - content_type?: string; - delivery_timestamp?: string; - direction?: string; - from?: string; - local_id?: string; - message_id?: string; - origination_timestamp?: string; - reply_to?: string; - subject?: string; - 'subject.text'?: string; - to?: string[]; - x_mailer?: string; -} - -// eslint-disable-next-line @typescript-eslint/no-empty-interface -interface Attachment extends AttachmentNestedFields { - // intentionally empty -} diff --git a/packages/kbn-ecs/src/ecs/event.ts b/packages/kbn-ecs/src/ecs/event.ts deleted file mode 100644 index 212a04526c709..0000000000000 --- a/packages/kbn-ecs/src/ecs/event.ts +++ /dev/null @@ -1,93 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-event.html - * - * @internal - */ -export interface EcsEvent { - action?: string; - agent_id_status?: 'verified' | 'mismatch' | 'missing' | 'auth_metadata_missing'; - category?: EcsEventCategory[]; - code?: string; - created?: string; - dataset?: string; - duration?: number; - end?: string; - hash?: string; - id?: string; - ingested?: string; - kind?: EcsEventKind; - module?: string; - original?: string; - outcome?: EcsEventOutcome; - provider?: string; - reason?: string; - reference?: string; - risk_score?: number; - risk_score_norm?: number; - sequence?: number; - severity?: number; - start?: string; - timezone?: string; - type?: EcsEventType[]; - url?: string; -} - -/** - * @public - */ -export type EcsEventCategory = - | 'authentication' - | 'configuration' - | 'database' - | 'driver' - | 'email' - | 'file' - | 'host' - | 'iam' - | 'intrusion_detection' - | 'malware' - | 'network' - | 'package' - | 'process' - | 'registry' - | 'session' - | 'web'; - -/** - * @public - */ -export type EcsEventKind = 'alert' | 'event' | 'metric' | 'state' | 'pipeline_error' | 'signal'; - -/** - * @public - */ -export type EcsEventOutcome = 'failure' | 'success' | 'unknown'; - -/** - * @public - */ -export type EcsEventType = - | 'access' - | 'admin' - | 'allowed' - | 'change' - | 'connection' - | 'creation' - | 'deletion' - | 'denied' - | 'end' - | 'error' - | 'group' - | 'info' - | 'installation' - | 'protocol' - | 'start' - | 'user'; diff --git a/packages/kbn-ecs/src/ecs/faas.ts b/packages/kbn-ecs/src/ecs/faas.ts deleted file mode 100644 index 0fd4048955d3c..0000000000000 --- a/packages/kbn-ecs/src/ecs/faas.ts +++ /dev/null @@ -1,26 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-faas.html - * - * @internal - */ -export interface EcsFaas { - coldstart?: boolean; - execution?: string; - id?: string; - name?: string; - trigger?: Trigger; - version?: string; -} - -interface Trigger { - request_id?: string; - type?: 'http' | 'pubsub' | 'datasource' | 'timer' | 'other'; -} diff --git a/packages/kbn-ecs/src/ecs/file.ts b/packages/kbn-ecs/src/ecs/file.ts deleted file mode 100644 index 09a7d33f0105d..0000000000000 --- a/packages/kbn-ecs/src/ecs/file.ts +++ /dev/null @@ -1,53 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsCodeSignature } from './code_signature'; -import { EcsElf } from './elf'; -import { EcsHash } from './hash'; -import { EcsX509 } from './x509'; - -interface NestedFields { - code_signature?: EcsCodeSignature; - elf?: EcsElf; - hash?: EcsHash; - x509?: EcsX509; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-file.html - * - * @internal - */ -export interface EcsFile extends NestedFields { - accessed?: string; - attributes?: string[]; - created?: string; - ctime?: string; - device?: string; - directory?: string; - drive_letter?: string; - extension?: string; - fork_name?: string; - gid?: string; - group?: string; - inode?: string; - // Technically this is a known list, but it's massive, so we'll just accept a string for now :) - // https://www.iana.org/assignments/media-types/media-types.xhtml - mime_type?: string; - mode?: string; - mtime?: string; - name?: string; - owner?: string; - path?: string; - 'path.text'?: string; - size?: number; - target_path?: string; - 'target_path.text'?: string; - type?: string; - uid?: string; -} diff --git a/packages/kbn-ecs/src/ecs/geo.ts b/packages/kbn-ecs/src/ecs/geo.ts deleted file mode 100644 index 3189e1a5557e3..0000000000000 --- a/packages/kbn-ecs/src/ecs/geo.ts +++ /dev/null @@ -1,31 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-geo.html - * - * @internal - */ -export interface EcsGeo { - city_name?: string; - continent_code?: string; - continent_name?: string; - country_iso_code?: string; - country_name?: string; - location?: GeoPoint; - name?: string; - postal_code?: string; - region_iso_code?: string; - region_name?: string; - timezone?: string; -} - -interface GeoPoint { - lat: number; - lon: number; -} diff --git a/packages/kbn-ecs/src/ecs/hash.ts b/packages/kbn-ecs/src/ecs/hash.ts deleted file mode 100644 index 84b0216765b00..0000000000000 --- a/packages/kbn-ecs/src/ecs/hash.ts +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-hash.html - * - * @internal - */ -export interface EcsHash { - md5?: string; - sha1?: string; - sha256?: string; - sha384?: string; - sha512?: string; - ssdeep?: string; - tlsh?: string; -} diff --git a/packages/kbn-ecs/src/ecs/host.ts b/packages/kbn-ecs/src/ecs/host.ts deleted file mode 100644 index a500367ced841..0000000000000 --- a/packages/kbn-ecs/src/ecs/host.ts +++ /dev/null @@ -1,47 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsGeo } from './geo'; -import { EcsOs } from './os'; - -interface NestedFields { - geo?: EcsGeo; - os?: EcsOs; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-host.html - * - * @internal - */ -export interface EcsHost extends NestedFields { - architecture?: string; - boot?: { id: string }; - cpu?: { usage: number }; - disk?: Disk; - domain?: string; - hostname?: string; - id?: string; - ip?: string[]; - mac?: string[]; - name?: string; - network?: Network; - pid_ns_ino?: string; - type?: string; - uptime?: number; -} - -interface Disk { - read?: { bytes: number }; - write?: { bytes: number }; -} - -interface Network { - egress?: { bytes?: number; packets?: number }; - ingress?: { bytes?: number; packets?: number }; -} diff --git a/packages/kbn-ecs/src/ecs/http.ts b/packages/kbn-ecs/src/ecs/http.ts deleted file mode 100644 index 809ad19fd6a79..0000000000000 --- a/packages/kbn-ecs/src/ecs/http.ts +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-http.html - * - * @internal - */ -export interface EcsHttp { - request?: Request; - response?: Response; - version?: string; -} - -interface Request { - body?: { bytes?: number; content?: string }; - bytes?: number; - id?: string; - // We can't provide predefined values here because ECS requires preserving the - // original casing for anomaly detection use cases. - method?: string; - mime_type?: string; - referrer?: string; -} - -interface Response { - body?: { bytes?: number; content?: string }; - bytes?: number; - mime_type?: string; - status_code?: number; -} diff --git a/packages/kbn-ecs/src/ecs/log.ts b/packages/kbn-ecs/src/ecs/log.ts deleted file mode 100644 index 13b7654fdeded..0000000000000 --- a/packages/kbn-ecs/src/ecs/log.ts +++ /dev/null @@ -1,37 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-log.html - * - * @internal - */ -export interface EcsLog { - file?: { path: string }; - level?: string; - logger?: string; - origin?: Origin; - syslog?: Syslog; -} - -interface Origin { - file?: { line?: number; name?: string }; - function?: string; -} - -interface Syslog { - appname?: string; - facility?: { code?: number; name?: string }; - hostname?: string; - msgid?: string; - priority?: number; - procid?: string; - severity?: { code?: number; name?: string }; - structured_data?: Record; - version?: string; -} diff --git a/packages/kbn-ecs/src/ecs/network.ts b/packages/kbn-ecs/src/ecs/network.ts deleted file mode 100644 index 9f225eb73c40b..0000000000000 --- a/packages/kbn-ecs/src/ecs/network.ts +++ /dev/null @@ -1,42 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsVlan } from './vlan'; - -interface NestedFields { - inner?: { vlan?: EcsVlan }; - vlan?: EcsVlan; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-network.html - * - * @internal - */ -export interface EcsNetwork extends NestedFields { - application?: string; - bytes?: number; - community_id?: string; - direction?: Direction; - forwarded_ip?: string; - iana_number?: string; - name?: string; - packets?: number; - protocol?: string; - transport?: string; - type?: string; -} - -type Direction = - | 'ingress' - | 'egress' - | 'inbound' - | 'outbound' - | 'internal' - | 'external' - | 'unknown'; diff --git a/packages/kbn-ecs/src/ecs/observer.ts b/packages/kbn-ecs/src/ecs/observer.ts deleted file mode 100644 index 77627eed7a6bf..0000000000000 --- a/packages/kbn-ecs/src/ecs/observer.ts +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsGeo } from './geo'; -import { EcsInterface } from './interface'; -import { EcsOs } from './os'; -import { EcsVlan } from './vlan'; - -interface NestedFields { - egress?: NestedEgressFields; - geo?: EcsGeo; - ingress?: NestedIngressFields; - os?: EcsOs; -} - -interface NestedEgressFields { - interface?: EcsInterface; - vlan?: EcsVlan; -} - -interface NestedIngressFields { - interface?: EcsInterface; - vlan?: EcsVlan; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-observer.html - * - * @internal - */ -export interface EcsObserver extends NestedFields { - egress?: Egress; - hostname?: string; - ingress?: Ingress; - ip?: string[]; - mac?: string[]; - name?: string; - product?: string; - serial_number?: string; - type?: string; - vendor?: string; - version?: string; -} - -interface Egress extends NestedEgressFields { - zone?: string; -} - -interface Ingress extends NestedIngressFields { - zone?: string; -} diff --git a/packages/kbn-ecs/src/ecs/orchestrator.ts b/packages/kbn-ecs/src/ecs/orchestrator.ts deleted file mode 100644 index 87ede628bdeb9..0000000000000 --- a/packages/kbn-ecs/src/ecs/orchestrator.ts +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-orchestrator.html - * - * @internal - */ -export interface EcsOrchestrator { - api_version?: string; - cluster?: Cluster; - namespace?: string; - organization?: string; - resource?: Resource; - type?: string; -} - -interface Cluster { - id?: string; - name?: string; - url?: string; - version?: string; -} - -interface Resource { - id?: string; - ip?: string[]; - name?: string; - parent?: { type: string }; - type?: string; -} diff --git a/packages/kbn-ecs/src/ecs/os.ts b/packages/kbn-ecs/src/ecs/os.ts deleted file mode 100644 index d4830df618ed2..0000000000000 --- a/packages/kbn-ecs/src/ecs/os.ts +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-os.html - * - * @internal - */ -export interface EcsOs { - family?: string; - full?: string; - kernel?: string; - name?: string; - platform?: string; - type?: 'linux' | 'macos' | 'unix' | 'windows'; - version?: string; -} diff --git a/packages/kbn-ecs/src/ecs/package.ts b/packages/kbn-ecs/src/ecs/package.ts deleted file mode 100644 index fce1415d08c4b..0000000000000 --- a/packages/kbn-ecs/src/ecs/package.ts +++ /dev/null @@ -1,28 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-package.html - * - * @internal - */ -export interface EcsPackage { - architecture?: string; - build_version?: string; - checksum?: string; - description?: string; - install_scope?: string; - installed?: string; - license?: string; - name?: string; - path?: string; - reference?: string; - size?: number; - type?: string; - version?: string; -} diff --git a/packages/kbn-ecs/src/ecs/pe.ts b/packages/kbn-ecs/src/ecs/pe.ts deleted file mode 100644 index b4b8be422a97d..0000000000000 --- a/packages/kbn-ecs/src/ecs/pe.ts +++ /dev/null @@ -1,23 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-pe.html - * - * @internal - */ -export interface EcsPe { - architecture?: string; - company?: string; - description?: string; - file_version?: string; - imphash?: string; - original_file_name?: string; - pehash?: string; - product?: string; -} diff --git a/packages/kbn-ecs/src/ecs/process.ts b/packages/kbn-ecs/src/ecs/process.ts deleted file mode 100644 index 8a83875025d84..0000000000000 --- a/packages/kbn-ecs/src/ecs/process.ts +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsCodeSignature } from './code_signature'; -import { EcsElf } from './elf'; -import { EcsGroup } from './group'; -import { EcsHash } from './hash'; -import { EcsSource } from './source'; -import { EcsUser } from './user'; - -interface NestedFields { - code_signature?: EcsCodeSignature; - elf?: EcsElf; - entry_leader?: EcsProcess; - group?: EcsGroup; - group_leader?: EcsProcess; - hash?: EcsHash; - parent?: EcsProcess; - previous?: EcsProcess; - real_group?: EcsGroup; - real_user?: EcsUser; - saved_group?: EcsGroup; - saved_user?: EcsUser; - session_leader?: EcsProcess & { entry_meta?: EntryMeta }; - supplemental_groups?: EcsGroup; - user?: EcsUser; -} - -interface EntryMeta { - type?: string; - source?: EcsSource; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-process.html - * - * @internal - */ -export interface EcsProcess extends NestedFields { - args?: string[]; - args_count?: number; - command_line?: string; - end?: string; - entity_id?: string; - env_vars?: Record; - executable?: string; - exit_code?: number; - name?: string; - pgid?: number; - pid?: number; - start?: string; - title?: string; - uptime?: number; - working_directory?: string; -} diff --git a/packages/kbn-ecs/src/ecs/registry.ts b/packages/kbn-ecs/src/ecs/registry.ts deleted file mode 100644 index 27042ae552e82..0000000000000 --- a/packages/kbn-ecs/src/ecs/registry.ts +++ /dev/null @@ -1,26 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-registry.html - * - * @internal - */ -export interface EcsRegistry { - data?: Data; - hive?: string; - key?: string; - path?: string; - value?: string; -} - -interface Data { - bytes?: string; - strings?: string[]; - type?: string; -} diff --git a/packages/kbn-ecs/src/ecs/related.ts b/packages/kbn-ecs/src/ecs/related.ts deleted file mode 100644 index d4556bea24d19..0000000000000 --- a/packages/kbn-ecs/src/ecs/related.ts +++ /dev/null @@ -1,19 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-related.html - * - * @internal - */ -export interface EcsRelated { - hash?: string[]; - hosts?: string[]; - ip?: string[]; - user?: string[]; -} diff --git a/packages/kbn-ecs/src/ecs/rule.ts b/packages/kbn-ecs/src/ecs/rule.ts deleted file mode 100644 index 144d93b12a42b..0000000000000 --- a/packages/kbn-ecs/src/ecs/rule.ts +++ /dev/null @@ -1,25 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-rule.html - * - * @internal - */ -export interface EcsRule { - author?: string[]; - category?: string; - description?: string; - id?: string; - license?: string; - name?: string; - reference?: string; - ruleset?: string; - uuid?: string; - version?: string; -} diff --git a/packages/kbn-ecs/src/ecs/server.ts b/packages/kbn-ecs/src/ecs/server.ts deleted file mode 100644 index 2d6666925cb99..0000000000000 --- a/packages/kbn-ecs/src/ecs/server.ts +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsAutonomousSystem } from './autonomous_system'; -import { EcsGeo } from './geo'; -import { EcsNestedUser } from './user'; - -interface NestedFields { - as?: EcsAutonomousSystem; - geo?: EcsGeo; - user?: EcsNestedUser; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-server.html - * - * @internal - */ -export interface EcsServer extends NestedFields { - address?: string; - bytes?: number; - domain?: string; - ip?: string; - mac?: string; - nat?: { ip?: string; port?: number }; - packets?: number; - port?: number; - registered_domain?: string; - subdomain?: string; - top_level_domain?: string; -} diff --git a/packages/kbn-ecs/src/ecs/service.ts b/packages/kbn-ecs/src/ecs/service.ts deleted file mode 100644 index 52ab6f117c22a..0000000000000 --- a/packages/kbn-ecs/src/ecs/service.ts +++ /dev/null @@ -1,29 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-service.html - * - * @internal - */ -export interface EcsService { - address?: string; - environment?: string; - ephemeral_id?: string; - id?: string; - name?: string; - node?: Node; - state?: string; - type?: string; - version?: string; -} - -interface Node { - name?: string; - roles?: string[]; -} diff --git a/packages/kbn-ecs/src/ecs/source.ts b/packages/kbn-ecs/src/ecs/source.ts deleted file mode 100644 index 10fd3df7efe23..0000000000000 --- a/packages/kbn-ecs/src/ecs/source.ts +++ /dev/null @@ -1,36 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsAutonomousSystem } from './autonomous_system'; -import { EcsGeo } from './geo'; -import { EcsNestedUser } from './user'; - -interface NestedFields { - as?: EcsAutonomousSystem; - geo?: EcsGeo; - user?: EcsNestedUser; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-source.html - * - * @internal - */ -export interface EcsSource extends NestedFields { - address?: string; - bytes?: number; - domain?: string; - ip?: string; - mac?: string; - nat?: { ip?: string; port?: number }; - packets?: number; - port?: number; - registered_domain?: string; - subdomain?: string; - top_level_domain?: string; -} diff --git a/packages/kbn-ecs/src/ecs/threat.ts b/packages/kbn-ecs/src/ecs/threat.ts deleted file mode 100644 index bba86fdbf128f..0000000000000 --- a/packages/kbn-ecs/src/ecs/threat.ts +++ /dev/null @@ -1,139 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsAutonomousSystem } from './autonomous_system'; -import { EcsFile } from './file'; -import { EcsGeo } from './geo'; -import { EcsRegistry } from './registry'; -import { EcsUrl } from './url'; -import { EcsX509 } from './x509'; - -interface IndicatorNestedFields { - as?: EcsAutonomousSystem; - file?: EcsFile; - geo?: EcsGeo; - registry?: EcsRegistry; - url?: EcsUrl; - x509?: EcsX509; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-threat.html - * - * @internal - */ -export interface EcsThreat { - enrichments?: Enrichment[]; - indicator?: Indicator; - feed?: Feed; - framework?: string; - group?: Group; - software?: Software; - tactic?: Tactic; - technique?: Technique; -} - -interface Enrichment { - indicator?: Indicator; - matched?: Matched; -} - -interface Indicator extends IndicatorNestedFields { - confidence?: 'Not Specified' | 'None' | 'Low' | 'Medium' | 'High'; - description?: string; - email?: { address?: string }; - first_seen?: string; - ip?: string; - last_seen?: string; - marking?: Marking; - modified_at?: string; - port?: number; - provider?: string; - reference?: string; - scanner_stats?: number; - sightings?: number; - type?: IndicatorType; -} - -interface Feed { - dashboard_id?: string; - description?: string; - name?: string; - reference?: string; -} - -interface Marking { - tlp?: 'WHITE' | 'GREEN' | 'AMBER' | 'RED'; -} - -interface Matched { - atomic?: string; - field?: string; - id?: string; - index?: string; - type?: string; -} - -interface Group { - alias?: string[]; - id?: string; - name?: string; - reference?: string; -} - -interface Software { - id?: string; - name?: string; - platforms?: SoftwarePlatforms[]; - reference?: string; - type?: 'Malware' | 'Tool'; -} - -type SoftwarePlatforms = - | 'AWS' - | 'Azure' - | 'Azure AD' - | 'GCP' - | 'Linux' - | 'macOS' - | 'Network' - | 'Office 365' - | 'SaaS' - | 'Windows'; - -interface Tactic { - id?: string[]; - name?: string[]; - reference?: string[]; -} - -interface Technique { - id?: string[]; - name?: string[]; - reference?: string[]; - subtechnique?: Technique; -} - -type IndicatorType = - | 'autonomous-system' - | 'artifact' - | 'directory' - | 'domain-name' - | 'email-addr' - | 'file' - | 'ipv4-addr' - | 'ipv6-addr' - | 'mac-addr' - | 'mutex' - | 'port' - | 'process' - | 'software' - | 'url' - | 'user-account' - | 'windows-registry-key' - | 'x509-certificate'; diff --git a/packages/kbn-ecs/src/ecs/tls.ts b/packages/kbn-ecs/src/ecs/tls.ts deleted file mode 100644 index a4aa8dce04a98..0000000000000 --- a/packages/kbn-ecs/src/ecs/tls.ts +++ /dev/null @@ -1,64 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsX509 } from './x509'; - -interface NestedClientFields { - x509?: EcsX509; -} - -interface NestedServerFields { - x509?: EcsX509; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-tls.html - * - * @internal - */ -export interface EcsTls { - cipher?: string; - client?: Client; - curve?: string; - established?: boolean; - next_protocol?: string; - resumed?: boolean; - server?: Server; - version?: string; - version_protocol?: string; -} - -interface Client extends NestedClientFields { - certificate?: string; - certificate_chain?: string[]; - hash?: Hash; - issuer?: string; - ja3?: string; - not_after?: string; - not_before?: string; - server_name?: string; - subject?: string; - supported_ciphers?: string[]; -} - -interface Server extends NestedServerFields { - certificate?: string; - certificate_chain?: string[]; - hash?: Hash; - issuer?: string; - ja3s?: string; - not_after?: string; - not_before?: string; - subject?: string; -} - -interface Hash { - md5?: string; - sha1?: string; - sha256?: string; -} diff --git a/packages/kbn-ecs/src/ecs/tracing.ts b/packages/kbn-ecs/src/ecs/tracing.ts deleted file mode 100644 index 05413770ca2d0..0000000000000 --- a/packages/kbn-ecs/src/ecs/tracing.ts +++ /dev/null @@ -1,23 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * Unlike other ECS field sets, tracing fields are not nested under the field - * set name (i.e. `trace.id` is valid, `tracing.trace.id` is not). So, like - * the base fields, we will need to do an intersection with these types at - * the root level. - * - * https://www.elastic.co/guide/en/ecs/master/ecs-tracing.html - * - * @internal - */ -export interface EcsTracing { - span?: { id?: string }; - trace?: { id?: string }; - transaction?: { id?: string }; -} diff --git a/packages/kbn-ecs/src/ecs/url.ts b/packages/kbn-ecs/src/ecs/url.ts deleted file mode 100644 index 7e4fe59bab4af..0000000000000 --- a/packages/kbn-ecs/src/ecs/url.ts +++ /dev/null @@ -1,29 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-url.html - * - * @internal - */ -export interface EcsUrl { - domain?: string; - extension?: string; - fragment?: string; - full?: string; - original?: string; - password?: string; - path?: string; - port?: number; - query?: string; - registered_domain?: string; - scheme?: string; - subdomain?: string; - top_level_domain?: string; - username?: string; -} diff --git a/packages/kbn-ecs/src/ecs/user.ts b/packages/kbn-ecs/src/ecs/user.ts deleted file mode 100644 index ec6f78473f3e3..0000000000000 --- a/packages/kbn-ecs/src/ecs/user.ts +++ /dev/null @@ -1,48 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsGroup } from './group'; - -interface NestedFields { - group?: EcsGroup; -} - -/** - * `User` is unlike most other fields which can be reused in multiple places - * in that ECS places restrictions on which individual properties can be reused; - * - * Specifically, `changes`, `effective`, and `target` may be used if `user` is - * placed at the root level, but not if it is nested inside another field like - * `destination`. A more detailed explanation of these nuances can be found at: - * - * https://www.elastic.co/guide/en/ecs/master/ecs-user-usage.html - * - * As a result, we need to export a separate `NestedUser` type to import into - * other interfaces internally. This contains the reusable subset of properties - * from `User`. - * - * @internal - */ -export interface EcsNestedUser extends NestedFields { - domain?: string; - email?: string; - full_name?: string; - hash?: string; - id?: string; - name?: string; - roles?: string[]; -} - -/** - * @internal - */ -export interface EcsUser extends EcsNestedUser { - changes?: EcsNestedUser; - effective?: EcsNestedUser; - target?: EcsNestedUser; -} diff --git a/packages/kbn-ecs/src/ecs/user_agent.ts b/packages/kbn-ecs/src/ecs/user_agent.ts deleted file mode 100644 index b0a97a47eac62..0000000000000 --- a/packages/kbn-ecs/src/ecs/user_agent.ts +++ /dev/null @@ -1,25 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { EcsOs } from './os'; - -interface NestedFields { - os?: EcsOs; -} - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-user_agent.html - * - * @internal - */ -export interface EcsUserAgent extends NestedFields { - device?: { name: string }; - name?: string; - original?: string; - version?: string; -} diff --git a/packages/kbn-ecs/src/ecs/vlan.ts b/packages/kbn-ecs/src/ecs/vlan.ts deleted file mode 100644 index e2a45f30cb484..0000000000000 --- a/packages/kbn-ecs/src/ecs/vlan.ts +++ /dev/null @@ -1,17 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-vlan.html - * - * @internal - */ -export interface EcsVlan { - id?: string; - name?: string; -} diff --git a/packages/kbn-ecs/src/ecs/vulnerability.ts b/packages/kbn-ecs/src/ecs/vulnerability.ts deleted file mode 100644 index 6dec07ff5874f..0000000000000 --- a/packages/kbn-ecs/src/ecs/vulnerability.ts +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-vulnerability.html - * - * @internal - */ -export interface EcsVulnerability { - category?: string[]; - classification?: string; - description?: string; - enumeration?: string; - id?: string; - reference?: string; - report_id?: string; - scanner?: { vendor: string }; - score?: Score; - severity?: string; -} - -interface Score { - base?: number; - environmental?: number; - temporal?: number; - version?: string; -} diff --git a/packages/kbn-ecs/src/ecs/x509.ts b/packages/kbn-ecs/src/ecs/x509.ts deleted file mode 100644 index 1b5b9f194923f..0000000000000 --- a/packages/kbn-ecs/src/ecs/x509.ts +++ /dev/null @@ -1,47 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-x509.html - * - * @internal - */ -export interface EcsX509 { - alternative_names?: string[]; - issuer?: Issuer; - not_after?: string; - not_before?: string; - public_key_algorithm?: string; - public_key_curve?: string; - public_key_exponent?: number; - public_key_size?: number; - serial_number?: string; - signature_algorithm?: string; - subject?: Subject; - version_number?: string; -} - -interface Issuer { - common_name?: string[]; - country?: string[]; - distinguished_name?: string; - locality?: string[]; - organization?: string[]; - organizational_unit?: string[]; - state_or_province?: string[]; -} - -interface Subject { - common_name?: string[]; - country?: string[]; - distinguished_name?: string; - locality?: string[]; - organization?: string[]; - organizational_unit?: string[]; - state_or_province?: string[]; -} diff --git a/packages/kbn-i18n/src/core/i18n.test.ts b/packages/kbn-i18n/src/core/i18n.test.ts index f9a6535d881ee..dfea790f129b5 100644 --- a/packages/kbn-i18n/src/core/i18n.test.ts +++ b/packages/kbn-i18n/src/core/i18n.test.ts @@ -662,13 +662,13 @@ describe('I18n engine', () => { i18n.translate('a.short', { values: { expires: new Date(2018, 5, 20, 18, 40, 30, 50) }, } as any) - ).toBe('Coupon expires at 6:40 PM'); + ).toBe('Coupon expires at 6:40 PM'); expect( i18n.translate('a.medium', { values: { expires: new Date(2018, 5, 20, 18, 40, 30, 50) }, } as any) - ).toBe('Coupon expires at 6:40:30 PM'); + ).toBe('Coupon expires at 6:40:30 PM'); }); test('should format default messages with time formatter', () => { @@ -679,14 +679,14 @@ describe('I18n engine', () => { defaultMessage: 'Coupon expires at {expires, time, short}', values: { expires: new Date(2018, 5, 20, 18, 40, 30, 50) }, }) - ).toBe('Coupon expires at 6:40 PM'); + ).toBe('Coupon expires at 6:40 PM'); expect( i18n.translate('foo', { defaultMessage: 'Coupon expires at {expires, time, medium}', values: { expires: new Date(2018, 5, 20, 18, 40, 30, 50) }, }) - ).toBe('Coupon expires at 6:40:30 PM'); + ).toBe('Coupon expires at 6:40:30 PM'); }); test('should format message with a custom format', () => { diff --git a/packages/kbn-logging/src/log_meta.ts b/packages/kbn-logging/src/log_meta.ts index e17f841979cb2..1ba110b0e0bee 100644 --- a/packages/kbn-logging/src/log_meta.ts +++ b/packages/kbn-logging/src/log_meta.ts @@ -8,8 +8,7 @@ import { EcsBase, - EcsAgent, - EcsAutonomousSystem, + EcsAs as EcsAutonomousSystem, EcsClient, EcsCloud, EcsContainer, @@ -40,6 +39,7 @@ import { EcsUser, EcsUserAgent, EcsVulnerability, + EcsAgent, } from '@kbn/ecs'; /** diff --git a/packages/kbn-monaco/BUILD.bazel b/packages/kbn-monaco/BUILD.bazel index 2ca10b073fd18..8d13702e74588 100644 --- a/packages/kbn-monaco/BUILD.bazel +++ b/packages/kbn-monaco/BUILD.bazel @@ -56,11 +56,9 @@ webpack_cli( env = select({ "//:dist": { "NODE_ENV": "production", - "NODE_OPTIONS": "--openssl-legacy-provider", }, "//conditions:default": { "NODE_ENV": "development", - "NODE_OPTIONS": "--openssl-legacy-provider", }, }), visibility = ["//visibility:public"], diff --git a/packages/kbn-optimizer/src/optimizer/observe_worker.ts b/packages/kbn-optimizer/src/optimizer/observe_worker.ts index 49c150fbf2dcb..cf250a7deef6e 100644 --- a/packages/kbn-optimizer/src/optimizer/observe_worker.ts +++ b/packages/kbn-optimizer/src/optimizer/observe_worker.ts @@ -60,7 +60,6 @@ function usingWorkerProc(config: OptimizerConfig, fn: (proc: ChildProcess) => (): ProcResource => { const proc = fork(require.resolve('../worker/run_worker'), [], { execArgv: [ - '--openssl-legacy-provider', `--require=@kbn/babel-register/install`, ...(inspectFlag && config.inspectWorkers ? [`${inspectFlag}=${inspectPortCounter++}`] diff --git a/packages/kbn-slo-schema/src/rest_specs/slo.ts b/packages/kbn-slo-schema/src/rest_specs/slo.ts index 6fb6c69f9293c..e09f14fb947f1 100644 --- a/packages/kbn-slo-schema/src/rest_specs/slo.ts +++ b/packages/kbn-slo-schema/src/rest_specs/slo.ts @@ -131,6 +131,7 @@ type FindSLOResponse = t.OutputOf; type FetchHistoricalSummaryParams = t.TypeOf; type FetchHistoricalSummaryResponse = t.OutputOf; +type HistoricalSummaryResponse = t.OutputOf; type BudgetingMethod = t.TypeOf; @@ -158,6 +159,7 @@ export type { GetSLOResponse, FetchHistoricalSummaryParams, FetchHistoricalSummaryResponse, + HistoricalSummaryResponse, SLOResponse, SLOWithSummaryResponse, UpdateSLOInput, diff --git a/packages/kbn-slo-schema/src/schema/common.ts b/packages/kbn-slo-schema/src/schema/common.ts index 36404aad390f1..b2ef0d5a3a933 100644 --- a/packages/kbn-slo-schema/src/schema/common.ts +++ b/packages/kbn-slo-schema/src/schema/common.ts @@ -44,6 +44,13 @@ const summarySchema = t.type({ errorBudget: errorBudgetSchema, }); +const historicalSummarySchema = t.intersection([ + t.type({ + date: dateType, + }), + summarySchema, +]); + const dateRangeSchema = t.type({ from: dateType, to: dateType }); export { @@ -52,6 +59,7 @@ export { dateRangeSchema, dateType, errorBudgetSchema, + historicalSummarySchema, statusSchema, summarySchema, }; diff --git a/packages/kbn-slo-schema/src/schema/indicators.ts b/packages/kbn-slo-schema/src/schema/indicators.ts index a8936c38f7663..73933fb785794 100644 --- a/packages/kbn-slo-schema/src/schema/indicators.ts +++ b/packages/kbn-slo-schema/src/schema/indicators.ts @@ -7,13 +7,7 @@ */ import * as t from 'io-ts'; -import { - allOrAnyString, - dateRangeSchema, - dateType, - errorBudgetSchema, - statusSchema, -} from './common'; +import { allOrAnyString, dateRangeSchema } from './common'; const apmTransactionDurationIndicatorTypeSchema = t.literal('sli.apm.transactionDuration'); const apmTransactionDurationIndicatorSchema = t.type({ @@ -68,13 +62,6 @@ const indicatorDataSchema = t.type({ total: t.number, }); -const historicalSummarySchema = t.type({ - date: dateType, - errorBudget: errorBudgetSchema, - sliValue: t.number, - status: statusSchema, -}); - const indicatorTypesSchema = t.union([ apmTransactionDurationIndicatorTypeSchema, apmTransactionErrorRateIndicatorTypeSchema, @@ -117,5 +104,4 @@ export { indicatorTypesArraySchema, indicatorTypesSchema, indicatorDataSchema, - historicalSummarySchema, }; diff --git a/packages/kbn-test/src/kbn_client/kbn_client_saved_objects.ts b/packages/kbn-test/src/kbn_client/kbn_client_saved_objects.ts index 33360bf82ef0c..b896aef3d2f56 100644 --- a/packages/kbn-test/src/kbn_client/kbn_client_saved_objects.ts +++ b/packages/kbn-test/src/kbn_client/kbn_client_saved_objects.ts @@ -7,7 +7,6 @@ */ import { inspect } from 'util'; - import * as Rx from 'rxjs'; import { mergeMap } from 'rxjs/operators'; import { isAxiosResponseError } from '@kbn/dev-utils'; @@ -90,6 +89,11 @@ async function concurrently(maxConcurrency: number, arr: T[], fn: (item: T) = } } +/** + * SO client for FTR. + * + * @remarks: Leverage the `ftrApis` plugin under the hood. + */ export class KbnClientSavedObjects { constructor(private readonly log: ToolingLog, private readonly requester: KbnClientRequester) {} @@ -117,8 +121,8 @@ export class KbnClientSavedObjects { const { data } = await this.requester.request>({ description: 'get saved object', path: options.space - ? uriencode`/s/${options.space}/api/saved_objects/${options.type}/${options.id}` - : uriencode`/api/saved_objects/${options.type}/${options.id}`, + ? uriencode`/s/${options.space}/internal/ftr/kbn_client_so/${options.type}/${options.id}` + : uriencode`/internal/ftr/kbn_client_so/${options.type}/${options.id}`, method: 'GET', }); return data; @@ -133,8 +137,8 @@ export class KbnClientSavedObjects { const { data } = await this.requester.request>({ description: 'update saved object', path: options.id - ? uriencode`/api/saved_objects/${options.type}/${options.id}` - : uriencode`/api/saved_objects/${options.type}`, + ? uriencode`/internal/ftr/kbn_client_so/${options.type}/${options.id}` + : uriencode`/internal/ftr/kbn_client_so/${options.type}`, query: { overwrite: options.overwrite, }, @@ -156,7 +160,7 @@ export class KbnClientSavedObjects { const { data } = await this.requester.request>({ description: 'update saved object', - path: uriencode`/api/saved_objects/${options.type}/${options.id}`, + path: uriencode`/internal/ftr/kbn_client_so/${options.type}/${options.id}`, query: { overwrite: options.overwrite, }, @@ -179,8 +183,8 @@ export class KbnClientSavedObjects { const { data } = await this.requester.request({ description: 'delete saved object', path: options.space - ? uriencode`/s/${options.space}/api/saved_objects/${options.type}/${options.id}` - : uriencode`/api/saved_objects/${options.type}/${options.id}`, + ? uriencode`/s/${options.space}/internal/ftr/kbn_client_so/${options.type}/${options.id}` + : uriencode`/internal/ftr/kbn_client_so/${options.type}/${options.id}`, method: 'DELETE', }); @@ -196,8 +200,8 @@ export class KbnClientSavedObjects { const resp = await this.requester.request({ method: 'GET', path: options.space - ? uriencode`/s/${options.space}/api/saved_objects/_find` - : '/api/saved_objects/_find', + ? uriencode`/s/${options.space}/internal/ftr/kbn_client_so/_find` + : `/internal/ftr/kbn_client_so/_find`, query: { per_page: 1000, type: options.types, @@ -270,8 +274,8 @@ export class KbnClientSavedObjects { await this.requester.request({ method: 'DELETE', path: options.space - ? uriencode`/s/${options.space}/api/saved_objects/${obj.type}/${obj.id}?force=true` - : uriencode`/api/saved_objects/${obj.type}/${obj.id}?force=true`, + ? uriencode`/s/${options.space}/internal/ftr/kbn_client_so/${obj.type}/${obj.id}` + : uriencode`/internal/ftr/kbn_client_so/${obj.type}/${obj.id}`, }); deleted++; } catch (error) { diff --git a/packages/kbn-ui-shared-deps-npm/BUILD.bazel b/packages/kbn-ui-shared-deps-npm/BUILD.bazel index 7bcc1b3c4b380..2814c674e9626 100644 --- a/packages/kbn-ui-shared-deps-npm/BUILD.bazel +++ b/packages/kbn-ui-shared-deps-npm/BUILD.bazel @@ -84,11 +84,9 @@ webpack_cli( env = select({ "//:dist": { "NODE_ENV": "production", - "NODE_OPTIONS": "--openssl-legacy-provider", }, "//conditions:default": { "NODE_ENV": "development", - "NODE_OPTIONS": "--openssl-legacy-provider", }, }) ) diff --git a/packages/kbn-ui-shared-deps-src/BUILD.bazel b/packages/kbn-ui-shared-deps-src/BUILD.bazel index 49c2cc62dcfe5..0b350c51331ff 100644 --- a/packages/kbn-ui-shared-deps-src/BUILD.bazel +++ b/packages/kbn-ui-shared-deps-src/BUILD.bazel @@ -45,11 +45,9 @@ webpack_cli( env = select({ "//:dist": { "NODE_ENV": "production", - "NODE_OPTIONS": "--openssl-legacy-provider", }, "//conditions:default": { "NODE_ENV": "development", - "NODE_OPTIONS": "--openssl-legacy-provider", }, }), visibility = ["//visibility:public"], diff --git a/packages/kbn-utility-types/index.ts b/packages/kbn-utility-types/index.ts index ab3ad9f60a2a0..52f707f2bc0d4 100644 --- a/packages/kbn-utility-types/index.ts +++ b/packages/kbn-utility-types/index.ts @@ -138,3 +138,5 @@ export interface DeepPartialArray extends Array> {} export type DeepPartialObject = { [P in keyof T]+?: DeepPartial }; export type { DotObject, DedotObject } from './src/dot'; + +export type ArrayElement = A extends ReadonlyArray ? T : never; diff --git a/src/core/server/index.ts b/src/core/server/index.ts index 37306d63acf6b..3364f4e4026e1 100644 --- a/src/core/server/index.ts +++ b/src/core/server/index.ts @@ -215,7 +215,7 @@ export type { AppenderConfigType, } from '@kbn/core-logging-server'; export type { Logger, LoggerFactory, LogMeta, LogRecord, LogLevel } from '@kbn/logging'; -export type { Ecs, EcsEventCategory, EcsEventKind, EcsEventOutcome, EcsEventType } from '@kbn/ecs'; +export type { Ecs, EcsEvent } from '@kbn/ecs'; export type { NodeInfo, NodeRoles } from '@kbn/core-node-server'; diff --git a/src/core/server/integration_tests/core_app/core_app_routes.test.ts b/src/core/server/integration_tests/core_app/core_app_routes.test.ts index 153a1a435d9dd..8fa0cae5a2c51 100644 --- a/src/core/server/integration_tests/core_app/core_app_routes.test.ts +++ b/src/core/server/integration_tests/core_app/core_app_routes.test.ts @@ -53,6 +53,11 @@ describe('Core app routes', () => { const response = await request.get(root, '/base-path/foo/').expect(302); expect(response.get('location')).toEqual('/base-path/foo'); }); + + it('URI encodes redirect path', async () => { + const response = await request.get(root, '/%5Csome-path/').expect(302); + expect(response.get('location')).toEqual('/base-path/%5Csome-path'); + }); }); describe('`/` route', () => { diff --git a/src/dev/build/tasks/patch_native_modules_task.ts b/src/dev/build/tasks/patch_native_modules_task.ts index 596b94933385e..2c4436f387dfe 100644 --- a/src/dev/build/tasks/patch_native_modules_task.ts +++ b/src/dev/build/tasks/patch_native_modules_task.ts @@ -41,17 +41,17 @@ interface Package { const packages: Package[] = [ { name: 're2', - version: '1.17.7', + version: '1.17.4', destinationPath: 'node_modules/re2/build/Release/re2.node', extractMethod: 'gunzip', archives: { 'darwin-x64': { - url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.7/darwin-x64-108.gz', - sha256: '4ed378c5a7fe6134b717afe7642254aff1ed7a881cbcaa53a012ac3efab49f99', + url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.4/darwin-x64-93.gz', + sha256: '9558c5cb39622e9b3653203e772b129d6c634e7dbd7af1b244352fc1d704601f', }, 'linux-x64': { - url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.7/linux-x64-108.gz', - sha256: '197a617ca2965f220848561afed71ff6df653f6d79910cf38e866c84ab38a236', + url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.4/linux-x64-93.gz', + sha256: '4d06747b266c75b6f7ced93977692c0586ce6a52924cabb569bd966378941aa1', }, // ARM builds are currently done manually as Github Actions used in upstream project @@ -67,8 +67,8 @@ const packages: Package[] = [ // * capture the sha256 with: `shasum -a 256 linux-arm64-*` // * upload the `linux-arm64-*.gz` artifact to the `yarn-prebuilt-artifacts` bucket in GCS using the correct version number 'linux-arm64': { - url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.7/linux-arm64-108.gz', - sha256: 'a690087a1a1fd9887aac1abdab68d1992600e218be10783da6d3381cca950c1a', + url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.4/linux-arm64-93.gz', + sha256: '25409584f76f3d6ed85463d84adf094eb6e256ed1cb0b754b95bcbda6691fc26', }, // A similar process is necessary for building on ARM macs: @@ -78,13 +78,13 @@ const packages: Package[] = [ // * capture the sha256 with: `shasum -a 256 darwin-arm64-*` // * upload the `darwin-arm64-*.gz` artifact to the `yarn-prebuilt-artifacts` bucket in GCS using the correct version number 'darwin-arm64': { - url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.7/darwin-arm64-108.gz', - sha256: '42afc32137ff5c5bebae5d68347a9786906748c2f28e06194d8950707f2ae90e', + url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.4/darwin-arm64-93.gz', + sha256: 'd4b708749ddef1c87019f6b80e051ed0c29ccd1de34f233c47d8dcaddf803872', }, 'win32-x64': { - url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.7/win32-x64-108.gz', - sha256: 'ff72fe02de652262659c8e17e44a932f3c873362233756b40d1a97538d05de92', + url: 'https://us-central1-elastic-kibana-184716.cloudfunctions.net/kibana-ci-proxy-cache/node-re2/uhop/node-re2/releases/download/1.17.4/win32-x64-93.gz', + sha256: '0320d0c0385432944c6fb3c8c8fcd78d440ce5626f7618f9ec71d88e44820674', }, }, }, diff --git a/src/plugins/console/README.md b/src/plugins/console/README.md index 6920ae8b944cf..ac4cc8f76dd38 100644 --- a/src/plugins/console/README.md +++ b/src/plugins/console/README.md @@ -17,6 +17,32 @@ GET _search {"query":{"match_all":{}}} ``` +### Kibana API support ([#100253](https://github.com/elastic/kibana/pull/128562)) +Console plugin now supports Kibana API endpoints. `kbn:` prefix must be used in the request URL to send a request to Kibana API. For example, the following request sends a request to the Kibana API to retrieve the list of available spaces: +``` +GET kbn:api/spaces/space +``` + +### Request-body comments +Single-line and multiline comments can be added to the request body. The comments are displayed in the request editor, but are not sent to the cluster. The comments are useful for adding notes to the request body. For example, the following request body contains a single-line comment and a multiline comment: +``` +POST /_some_endpoint +{ + // This is a single-line comment + /* This is a multiline comment */ + "field": "value" +} +``` + +### Variables +Console plugin now supports variables. The variables can be used in the request body and in the request URL. The variables are defined in the `Variables` flyout in the Console UI and used in the request body and URL by wrapping the variable name with `${}`. For example, the following request body contains a variable: +``` +POST /_some_endpoint +{ + "field": "${variable}" +} +``` + ## Architecture Console uses Ace editor that is wrapped with [`CoreEditor`](https://github.com/elastic/kibana/blob/main/src/plugins/console/public/types/core_editor.ts), so that if needed it can easily be replaced with another editor, for example Monaco. The autocomplete logic is located in [`autocomplete`](https://github.com/elastic/kibana/blob/main/src/plugins/console/public/lib/autocomplete) folder. Autocomplete rules are computed by classes in `components` sub-folder. @@ -234,3 +260,22 @@ Some autocomplete definitions need to be configured with dynamic values that can A list of variables is defined in the `parametrizedComponentFactories` function in [`kb.js`](https://github.com/elastic/kibana/blob/main/src/plugins/console/public/lib/kb/kb.js) file. The values of these variables are assigned dynamically for every cluster. Use these variables with curly braces, for example `{indices}`, `{types}`, `{id}`, `{username}`, `{template}`, `{nodes}` etc. + +### Architecture changes in 8.3 release (timeline: 07-04-2022 - 19-06-2022) +One of the main changes in architecture is refactoring the retrieval of autocomplete suggestions. Console used to send a separate request to ES for each autocomplete entity (mappings, aliases, templates, data-streams etc) to retrieve the autocomplete suggestions via the original [hand-rolled ES proxy](https://github.com/elastic/kibana/blob/main/src/plugins/console/server/routes/api/console/proxy/create_handler.ts). This had a few drawbacks: +- The number of requests was dependent on the number of autocomplete entities, which was not scalable and could cause performance issues +- It added unnecessary dependencies on the ES proxy +- We risked fetching an enormous response payload for users who have a large number of mappings. + +To address these issues, we created a specific [route](https://github.com/elastic/kibana/blob/main/src/plugins/console/server/routes/api/console/autocomplete_entities/index.ts) in the Kibana server to retrieve all autocomplete entities in one request and send it to the client. The response for mappings capped to 10MB to avoid sending a huge payload. The client-side code was refactored to use the new response format. For more details, see [#130633](https://github.com/elastic/kibana/pull/130633). + +Another change is replacing jQuery with the core http client to communicate with the Kibana server. Console used a custom jQuery ajax [function](https://github.com/elastic/kibana/blob/8.0/src/plugins/console/public/lib/es/es.ts) to send requests to the Kibana server to have lower-level control over the requests, specifically controls like `crossDomain: true`. This is no longer needed since we are using the core http client. For more details, see [#127867](https://github.com/elastic/kibana/pull/127867). + +### Outstanding issues +#### Autocomplete suggestions for Kibana API endpoints +Console currently supports autocomplete suggestions for Elasticsearch API endpoints. The autocomplete suggestions for Kibana API endpoints are not supported yet. +Related issue: [#130661](https://github.com/elastic/kibana/issues/130661) + +#### Migration to Monaco Editor +Console plugin is currently using Ace Editor and it is planned to migrate to Monaco Editor in the future. +Related issue: [#57435](https://github.com/elastic/kibana/issues/57435) \ No newline at end of file diff --git a/src/plugins/discover/public/application/main/components/layout/discover_layout.scss b/src/plugins/discover/public/application/main/components/layout/discover_layout.scss index b2d9ab190e075..5cb1f54edfd2e 100644 --- a/src/plugins/discover/public/application/main/components/layout/discover_layout.scss +++ b/src/plugins/discover/public/application/main/components/layout/discover_layout.scss @@ -31,10 +31,6 @@ discover-app { overflow: hidden; } -.dscPageBody__sidebar { - position: relative; -} - .dscPageContent__wrapper { padding: $euiSizeS $euiSizeS $euiSizeS 0; overflow: hidden; // Ensures horizontal scroll of table diff --git a/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx b/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx index 8f1dcc4ba8dfb..ab8c5da67d04a 100644 --- a/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx +++ b/src/plugins/discover/public/application/main/components/layout/discover_layout.tsx @@ -321,7 +321,7 @@ export function DiscoverLayout({ history={history} /> - + ( )); const DiscoverFieldTypeIcon: React.FC<{ field: DataViewField }> = memo(({ field }) => { - const typeForIcon = getTypeForFieldIcon(field); - return ( - - ); + return ; }); const FieldName: React.FC<{ field: DataViewField; highlight?: string }> = memo( diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.scss b/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.scss deleted file mode 100644 index 59b6e49b0fe0e..0000000000000 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.scss +++ /dev/null @@ -1,15 +0,0 @@ -.dscFieldSearch__formWrapper { - padding: $euiSizeM; -} - -.dscFieldTypesHelp__popover { - flex-grow: 0; - min-width: 0 !important; // Reduce width of icon-only button -} - -.dscFieldTypesHelp__panel { - width: $euiSize * 22; - @include euiBreakpoint('xs', 's') { - width: $euiSize * 20; - } -} \ No newline at end of file diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.test.tsx b/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.test.tsx deleted file mode 100644 index eafe3fec1eeaf..0000000000000 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.test.tsx +++ /dev/null @@ -1,152 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import React from 'react'; -import { act } from 'react-dom/test-utils'; -import { mountWithIntl } from '@kbn/test-jest-helpers'; -import { findTestSubject } from '@elastic/eui/lib/test'; -import { DiscoverFieldSearch, Props } from './discover_field_search'; -import { EuiButtonGroupProps, EuiPopover } from '@elastic/eui'; -import { ReactWrapper } from 'enzyme'; -import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public'; - -describe('DiscoverFieldSearch', () => { - const defaultProps = { - onChange: jest.fn(), - value: 'test', - types: ['any', 'string', '_source'], - presentFieldTypes: ['string', 'date', 'boolean', 'number'], - isPlainRecord: false, - }; - - function mountComponent(props?: Props) { - const compProps = props || defaultProps; - return mountWithIntl( - - - - ); - } - - function findButtonGroup(component: ReactWrapper, id: string) { - return component.find(`[data-test-subj="${id}ButtonGroup"]`).first(); - } - - test('enter value', () => { - const component = mountComponent(); - const input = findTestSubject(component, 'fieldFilterSearchInput'); - input.simulate('change', { target: { value: 'new filter' } }); - expect(defaultProps.onChange).toBeCalledTimes(1); - expect(defaultProps.onChange).toHaveBeenCalledWith('name', 'new filter'); - }); - - test('change in active filters should change facet selection and call onChange', () => { - const onChange = jest.fn(); - const component = mountComponent({ ...defaultProps, ...{ onChange } }); - const btn = findTestSubject(component, 'toggleFieldFilterButton'); - const badge = btn.find('.euiNotificationBadge').last(); - expect(badge.text()).toEqual('0'); - btn.simulate('click'); - const aggregatableButtonGroup = findButtonGroup(component, 'aggregatable'); - - act(() => { - // @ts-expect-error - (aggregatableButtonGroup.props() as EuiButtonGroupProps).onChange('aggregatable-true', null); - }); - component.update(); - expect(badge.text()).toEqual('1'); - expect(onChange).toBeCalledWith('aggregatable', true); - }); - - test('change in active filters should change filters count', () => { - const component = mountComponent(); - let btn = findTestSubject(component, 'toggleFieldFilterButton'); - btn.simulate('click'); - btn = findTestSubject(component, 'toggleFieldFilterButton'); - const badge = btn.find('.euiNotificationBadge').last(); - // no active filters - expect(badge.text()).toEqual('0'); - // change value of aggregatable select - const aggregatableButtonGroup = findButtonGroup(component, 'aggregatable'); - act(() => { - // @ts-expect-error - (aggregatableButtonGroup.props() as EuiButtonGroupProps).onChange('aggregatable-true', null); - }); - component.update(); - expect(badge.text()).toEqual('1'); - // change value of searchable select - const searchableButtonGroup = findButtonGroup(component, 'searchable'); - act(() => { - // @ts-expect-error - (searchableButtonGroup.props() as EuiButtonGroupProps).onChange('searchable-true', null); - }); - component.update(); - expect(badge.text()).toEqual('2'); - // change value of searchable select - act(() => { - // @ts-expect-error - (searchableButtonGroup.props() as EuiButtonGroupProps).onChange('searchable-any', null); - }); - component.update(); - expect(badge.text()).toEqual('1'); - }); - - test('change in filters triggers onChange', () => { - const onChange = jest.fn(); - const component = mountComponent({ ...defaultProps, ...{ onChange } }); - const btn = findTestSubject(component, 'toggleFieldFilterButton'); - btn.simulate('click'); - const aggregtableButtonGroup = findButtonGroup(component, 'aggregatable'); - act(() => { - // @ts-expect-error - (aggregtableButtonGroup.props() as EuiButtonGroupProps).onChange('aggregatable-true', null); - }); - expect(onChange).toBeCalledTimes(1); - }); - - test('change in type filters triggers onChange with appropriate value', () => { - const onChange = jest.fn(); - const component = mountComponent({ ...defaultProps, ...{ onChange } }); - const btn = findTestSubject(component, 'toggleFieldFilterButton'); - btn.simulate('click'); - const typeSelector = findTestSubject(component, 'typeSelect'); - typeSelector.simulate('change', { target: { value: 'string' } }); - expect(onChange).toBeCalledWith('type', 'string'); - typeSelector.simulate('change', { target: { value: 'any' } }); - expect(onChange).toBeCalledWith('type', 'any'); - }); - - test('click on filter button should open and close popover', () => { - const component = mountComponent(); - const btn = findTestSubject(component, 'toggleFieldFilterButton'); - btn.simulate('click'); - let popover = component.find(EuiPopover); - expect(popover.get(0).props.isOpen).toBe(true); - btn.simulate('click'); - popover = component.find(EuiPopover); - expect(popover.get(0).props.isOpen).toBe(false); - }); - - test('click help button should open popover with types of field docs', () => { - const component = mountComponent(); - - const btn = findTestSubject(component, 'fieldTypesHelpButton'); - btn.simulate('click'); - let popover = component.find(EuiPopover); - expect(popover.get(1).props.isOpen).toBe(true); - - const rows = component.find('.euiTableRow'); - expect(rows.length).toBe(4); - - btn.simulate('click'); - popover = component.find(EuiPopover); - expect(popover.get(1).props.isOpen).toBe(false); - }); -}); diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.tsx b/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.tsx deleted file mode 100644 index 8d7103f70efe9..0000000000000 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_field_search.tsx +++ /dev/null @@ -1,426 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import './discover_field_search.scss'; - -import React, { OptionHTMLAttributes, ReactNode, useMemo, useState } from 'react'; -import { i18n } from '@kbn/i18n'; -import { - EuiBasicTable, - EuiFieldSearch, - EuiFilterGroup, - EuiFlexGroup, - EuiFlexItem, - EuiPopover, - EuiPopoverTitle, - EuiSelect, - EuiForm, - EuiFormRow, - EuiButtonGroup, - EuiFilterButton, - EuiSpacer, - EuiIcon, - EuiBasicTableColumn, - EuiLink, - EuiText, - EuiPanel, -} from '@elastic/eui'; -import { FormattedMessage } from '@kbn/i18n-react'; -import { FieldIcon } from '@kbn/react-field'; -import { getFieldTypeDescription } from './lib/get_field_type_description'; -import { KNOWN_FIELD_TYPES } from '../../../../../common/field_types'; -import { useDiscoverServices } from '../../../../hooks/use_discover_services'; - -export interface State { - searchable: string; - aggregatable: string; - type: string; - [index: string]: string | boolean; -} - -export interface Props { - /** - * triggered on input of user into search field - */ - onChange: (field: string, value: string | boolean | undefined) => void; - /** - * types for the type filter - */ - types: string[]; - /** - * types presented in current data view - */ - presentFieldTypes: string[]; - /** - * the input value of the user - */ - value?: string; - /** - * is text base lang mode - */ - isPlainRecord: boolean; - - /** - * For a11y - */ - fieldSearchDescriptionId?: string; -} - -interface FieldTypeTableItem { - id: number; - dataType: string; - description: string; -} - -/** - * Component is Discover's side bar to search of available fields - * Additionally there's a button displayed that allows the user to show/hide more filter fields - */ -export function DiscoverFieldSearch({ - onChange, - value, - types, - presentFieldTypes, - isPlainRecord, - fieldSearchDescriptionId, -}: Props) { - const searchPlaceholder = i18n.translate('discover.fieldChooser.searchPlaceHolder', { - defaultMessage: 'Search field names', - }); - const aggregatableLabel = i18n.translate('discover.fieldChooser.filter.aggregatableLabel', { - defaultMessage: 'Aggregatable', - }); - const searchableLabel = i18n.translate('discover.fieldChooser.filter.searchableLabel', { - defaultMessage: 'Searchable', - }); - const typeLabel = i18n.translate('discover.fieldChooser.filter.typeLabel', { - defaultMessage: 'Type', - }); - const typeOptions = types - ? types.map((type) => { - return { value: type, text: type }; - }) - : [{ value: 'any', text: 'any' }]; - - const [activeFiltersCount, setActiveFiltersCount] = useState(0); - const [isPopoverOpen, setPopoverOpen] = useState(false); - const [isHelpOpen, setIsHelpOpen] = useState(false); - const [values, setValues] = useState({ - searchable: 'any', - aggregatable: 'any', - type: 'any', - }); - - const { docLinks } = useDiscoverServices(); - - const items: FieldTypeTableItem[] = useMemo(() => { - const knownTypes = Object.values(KNOWN_FIELD_TYPES) as string[]; - return presentFieldTypes - .filter((element) => knownTypes.includes(element)) - .sort((one, another) => one.localeCompare(another)) - .map((element, index) => ({ - id: index, - dataType: element, - description: getFieldTypeDescription(element, docLinks), - })); - }, [presentFieldTypes, docLinks]); - - const onHelpClick = () => setIsHelpOpen((prevIsHelpOpen) => !prevIsHelpOpen); - const closeHelp = () => setIsHelpOpen(false); - - const columnsSidebar: Array> = [ - { - field: 'dataType', - name: i18n.translate('discover.fieldTypesPopover.dataTypeColumnTitle', { - defaultMessage: 'Data type', - }), - width: '110px', - render: (name: string) => ( - - - - - {name} - - ), - }, - { - field: 'description', - name: i18n.translate('discover.fieldTypesPopover.descriptionColumnTitle', { - defaultMessage: 'Description', - }), - // eslint-disable-next-line react/no-danger - render: (description: string) =>
    , - }, - ]; - - const filterBtnAriaLabel = isPopoverOpen - ? i18n.translate('discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel', { - defaultMessage: 'Hide field filter settings', - }) - : i18n.translate('discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel', { - defaultMessage: 'Show field filter settings', - }); - - const handleFilterButtonClicked = () => { - setPopoverOpen(!isPopoverOpen); - }; - - const applyFilterValue = (id: string, filterValue: string | boolean) => { - switch (filterValue) { - case 'any': - if (id !== 'type') { - onChange(id, undefined); - } else { - onChange(id, filterValue); - } - break; - case 'true': - onChange(id, true); - break; - case 'false': - onChange(id, false); - break; - default: - onChange(id, filterValue); - } - }; - - const isFilterActive = (name: string, filterValue: string | boolean) => { - return filterValue !== 'any'; - }; - - const handleValueChange = (name: string, filterValue: string | boolean) => { - const previousValue = values[name]; - updateFilterCount(name, previousValue, filterValue); - const updatedValues = { ...values }; - updatedValues[name] = filterValue; - setValues(updatedValues); - applyFilterValue(name, filterValue); - }; - - const updateFilterCount = ( - name: string, - previousValue: string | boolean, - currentValue: string | boolean - ) => { - const previouslyFilterActive = isFilterActive(name, previousValue); - const filterActive = isFilterActive(name, currentValue); - const diff = Number(filterActive) - Number(previouslyFilterActive); - setActiveFiltersCount(activeFiltersCount + diff); - }; - - const buttonContent = ( - 0} - numFilters={0} - hasActiveFilters={activeFiltersCount > 0} - numActiveFilters={activeFiltersCount} - onClick={handleFilterButtonClicked} - > - - - ); - - const select = ( - id: string, - selectOptions: Array<{ text: ReactNode } & OptionHTMLAttributes>, - selectValue: string - ) => { - return ( - ) => - handleValueChange(id, e.target.value) - } - aria-label={i18n.translate('discover.fieldChooser.filter.fieldSelectorLabel', { - defaultMessage: 'Selection of {id} filter options', - values: { id }, - })} - data-test-subj={`${id}Select`} - compressed - /> - ); - }; - - const toggleButtons = (id: string) => { - return [ - { - id: `${id}-any`, - label: i18n.translate('discover.fieldChooser.filter.toggleButton.any', { - defaultMessage: 'any', - }), - }, - { - id: `${id}-true`, - label: i18n.translate('discover.fieldChooser.filter.toggleButton.yes', { - defaultMessage: 'yes', - }), - }, - { - id: `${id}-false`, - label: i18n.translate('discover.fieldChooser.filter.toggleButton.no', { - defaultMessage: 'no', - }), - }, - ]; - }; - - const buttonGroup = (id: string, legend: string) => { - return ( - handleValueChange(id, optionId.replace(`${id}-`, ''))} - buttonSize="compressed" - isFullWidth - data-test-subj={`${id}ButtonGroup`} - /> - ); - }; - - const selectionPanel = ( -
    - - - {buttonGroup('aggregatable', aggregatableLabel)} - - - {buttonGroup('searchable', searchableLabel)} - - - {select('type', typeOptions, values.type)} - - -
    - ); - - const helpButton = ( - - - - ); - - return ( - - - - onChange('name', event.target.value)} - placeholder={searchPlaceholder} - value={value} - /> - - - - {!isPlainRecord && ( - - - { - setPopoverOpen(false); - }} - button={buttonContent} - > - - {i18n.translate('discover.fieldChooser.filter.filterByTypeLabel', { - defaultMessage: 'Filter by type', - })} - - {selectionPanel} - - - - {i18n.translate('discover.fieldChooser.popoverTitle', { - defaultMessage: 'Field types', - })} - - - - - - -

    - {i18n.translate('discover.fieldTypesPopover.learnMoreText', { - defaultMessage: 'Learn more about', - })} -   - - - -

    -     -     -     -     -     - )} -     - ); -} diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.scss b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.scss index d7190b61e33f3..806893269da34 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.scss +++ b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.scss @@ -2,7 +2,7 @@ overflow: hidden; margin: 0 !important; flex-grow: 1; - padding: $euiSizeS 0 $euiSizeS $euiSizeS; + padding: 0; width: $euiSize * 19; height: 100%; @@ -13,6 +13,14 @@ } } +.dscSidebar__list { + padding: $euiSizeS 0 $euiSizeS $euiSizeS; + + @include euiBreakpoint('xs', 's') { + padding: $euiSizeS 0 0 0; + } +} + .dscSidebar__group { height: 100%; } diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.test.tsx b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.test.tsx index 86fda1b9a196d..28cb0b9bfde27 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.test.tsx +++ b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.test.tsx @@ -17,7 +17,6 @@ import { DiscoverSidebarProps, } from './discover_sidebar'; import type { AggregateQuery, Query } from '@kbn/es-query'; -import { getDefaultFieldFilter } from './lib/field_filter'; import { createDiscoverServicesMock } from '../../../../__mocks__/services'; import { stubLogstashDataView } from '@kbn/data-plugin/common/stubs'; import { KibanaContextProvider } from '@kbn/kibana-react-plugin/public'; @@ -29,7 +28,7 @@ import { VIEW_MODE } from '../../../../../common/constants'; import { DiscoverMainProvider } from '../../services/discover_state_provider'; import * as ExistingFieldsHookApi from '@kbn/unified-field-list-plugin/public/hooks/use_existing_fields'; import { ExistenceFetchStatus } from '@kbn/unified-field-list-plugin/public'; -import { getDataViewFieldList } from './lib/get_data_view_field_list'; +import { getDataViewFieldList } from './lib/get_field_list'; const mockGetActions = jest.fn>>, [string, { fieldName: string }]>( () => Promise.resolve([]) @@ -66,7 +65,7 @@ function getCompProps(): DiscoverSidebarProps { } } - const allFields = getDataViewFieldList(dataView, fieldCounts, false); + const allFields = getDataViewFieldList(dataView, fieldCounts); (ExistingFieldsHookApi.useExistingFieldsReader as jest.Mock).mockClear(); (ExistingFieldsHookApi.useExistingFieldsReader as jest.Mock).mockImplementation(() => ({ @@ -100,8 +99,6 @@ function getCompProps(): DiscoverSidebarProps { onRemoveField: jest.fn(), selectedDataView: dataView, trackUiMetric: jest.fn(), - fieldFilter: getDefaultFieldFilter(), - setFieldFilter: jest.fn(), onFieldEdited: jest.fn(), editField: jest.fn(), viewMode: VIEW_MODE.DOCUMENT_LEVEL, @@ -112,6 +109,7 @@ function getCompProps(): DiscoverSidebarProps { useNewFieldsApi: true, showFieldList: true, isAffectedByGlobalFilter: false, + isProcessing: false, }; } diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.tsx b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.tsx index ae16233c1fa6b..fc41760cc731e 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.tsx +++ b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar.tsx @@ -20,6 +20,8 @@ import { isOfAggregateQueryType } from '@kbn/es-query'; import { DataViewPicker } from '@kbn/unified-search-plugin/public'; import { type DataViewField, getFieldSubtypeMulti } from '@kbn/data-views-plugin/public'; import { + FieldList, + FieldListFilters, FieldListGrouped, FieldListGroupedProps, FieldsGroupNames, @@ -31,7 +33,6 @@ import { VIEW_MODE } from '../../../../../common/constants'; import { useAppStateSelector } from '../../services/discover_app_state_container'; import { useDiscoverServices } from '../../../../hooks/use_discover_services'; import { DiscoverField } from './discover_field'; -import { DiscoverFieldSearch } from './discover_field_search'; import { FIELDS_LIMIT_SETTING, PLUGIN_ID } from '../../../../../common'; import { getSelectedFields, @@ -39,7 +40,6 @@ import { type SelectedFieldsResult, INITIAL_SELECTED_FIELDS_RESULT, } from './lib/group_fields'; -import { doesFieldMatchFilters, FieldFilterState, setFieldFilterProp } from './lib/field_filter'; import { DiscoverSidebarResponsiveProps } from './discover_sidebar_responsive'; import { getUiActions } from '../../../../kibana_services'; import { getRawRecordType } from '../../utils/get_raw_record_type'; @@ -49,13 +49,9 @@ const fieldSearchDescriptionId = htmlIdGenerator()(); export interface DiscoverSidebarProps extends DiscoverSidebarResponsiveProps { /** - * Current state of the field filter, filtering fields by name, type, ... + * Show loading instead of the field list if processing */ - fieldFilter: FieldFilterState; - /** - * Change current state of fieldFilter - */ - setFieldFilter: (next: FieldFilterState) => void; + isProcessing: boolean; /** * Callback to close the flyout if sidebar is rendered in a flyout @@ -82,7 +78,7 @@ export interface DiscoverSidebarProps extends DiscoverSidebarResponsiveProps { createNewDataView?: () => void; /** - * All fields: fields from data view and unmapped fields + * All fields: fields from data view and unmapped fields or columns from text-based search */ allFields: DataViewField[] | null; @@ -108,16 +104,15 @@ export interface DiscoverSidebarProps extends DiscoverSidebarResponsiveProps { } export function DiscoverSidebarComponent({ + isProcessing, alwaysShowActionButtons = false, columns, - fieldFilter, documents$, allFields, onAddField, onAddFilter, onRemoveField, selectedDataView, - setFieldFilter, trackUiMetric, useNewFieldsApi = false, onFieldEdited, @@ -137,41 +132,6 @@ export function DiscoverSidebarComponent({ ); const query = useAppStateSelector((state) => state.query); - const onChangeFieldSearch = useCallback( - (filterName: string, value: string | boolean | undefined) => { - const newState = setFieldFilterProp(fieldFilter, filterName, value); - setFieldFilter(newState); - }, - [fieldFilter, setFieldFilter] - ); - - const { fieldTypes, presentFieldTypes } = useMemo(() => { - const result = ['any']; - const dataViewFieldTypes = new Set(); - if (Array.isArray(allFields)) { - for (const field of allFields) { - if (field.type !== '_source') { - // If it's a string type, we want to distinguish between keyword and text - // For this purpose we need the ES type - const type = - field.type === 'string' && - field.esTypes && - ['keyword', 'text'].includes(field.esTypes[0]) - ? field.esTypes?.[0] - : field.type; - // _id and _index would map to string, that's why we don't add the string type here - if (type && type !== 'string') { - dataViewFieldTypes.add(type); - } - if (result.indexOf(field.type) === -1) { - result.push(field.type); - } - } - } - } - return { fieldTypes: result, presentFieldTypes: Array.from(dataViewFieldTypes) }; - }, [allFields]); - const showFieldStats = useMemo(() => viewMode === VIEW_MODE.DOCUMENT_LEVEL, [viewMode]); const [selectedFieldsState, setSelectedFieldsState] = useState( INITIAL_SELECTED_FIELDS_RESULT @@ -181,9 +141,14 @@ export function DiscoverSidebarComponent({ >(undefined); useEffect(() => { - const result = getSelectedFields(selectedDataView, columns); + const result = getSelectedFields({ + dataView: selectedDataView, + columns, + allFields, + isPlainRecord, + }); setSelectedFieldsState(result); - }, [selectedDataView, columns, setSelectedFieldsState]); + }, [selectedDataView, columns, setSelectedFieldsState, allFields, isPlainRecord]); useEffect(() => { if (isPlainRecord || !useNewFieldsApi) { @@ -244,12 +209,6 @@ export function DiscoverSidebarComponent({ }, [columns, selectedDataView, query]); const popularFieldsLimit = useMemo(() => uiSettings.get(FIELDS_LIMIT_SETTING), [uiSettings]); - const onFilterField: GroupedFieldsParams['onFilterField'] = useCallback( - (field) => { - return doesFieldMatchFilters(field, fieldFilter); - }, - [fieldFilter] - ); const onSupportedFieldFilter: GroupedFieldsParams['onSupportedFieldFilter'] = useCallback( (field) => { @@ -267,7 +226,7 @@ export function DiscoverSidebarComponent({ }; } }, []); - const { fieldListGroupedProps } = useGroupedFields({ + const { fieldListFiltersProps, fieldListGroupedProps } = useGroupedFields({ dataViewId: (!isPlainRecord && selectedDataView?.id) || null, // passing `null` for text-based queries allFields, popularFieldsLimit: !isPlainRecord ? popularFieldsLimit : 0, @@ -277,18 +236,17 @@ export function DiscoverSidebarComponent({ dataViews, core, }, - onFilterField, onSupportedFieldFilter, onOverrideFieldGroupDetails, }); const renderFieldItem: FieldListGroupedProps['renderFieldItem'] = useCallback( - ({ field, groupName }) => ( + ({ field, groupName, fieldSearchHighlight }) => (
  • )} - -
    - - -
    - {showFieldList && ( - - )} + } + className="dscSidebar__list" + > + {showFieldList ? ( + + ) : ( + + )} + {!!editField && ( + + editField()} + size="s" + > + {i18n.translate('discover.fieldChooser.addField.label', { + defaultMessage: 'Add a field', + })} + + + )} + {isPlainRecord && ( + + + {i18n.translate('discover.textBasedLanguages.visualize.label', { + defaultMessage: 'Visualize in Lens', + })} + + + )} + - {!!editField && ( - - editField()} - size="s" - > - {i18n.translate('discover.fieldChooser.addField.label', { - defaultMessage: 'Add a field', - })} - - - )} - {isPlainRecord && ( - - - {i18n.translate('discover.textBasedLanguages.visualize.label', { - defaultMessage: 'Visualize in Lens', - })} - - - )} ); diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.test.tsx b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.test.tsx index e6370fb0713b0..26b2216eb0e04 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.test.tsx +++ b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.test.tsx @@ -396,7 +396,8 @@ describe('discover responsive sidebar', function () { findTestSubject(comp, 'discoverFieldListPanelAddExistFilter-extension').simulate('click'); expect(props.onAddFilter).toHaveBeenCalledWith('_exists_', 'extension', '+'); }); - it('should allow filtering by string, and calcFieldCount should just be executed once', async function () { + + it('should allow searching by string, and calcFieldCount should just be executed once', async function () { const comp = await mountComponent(props); expect(findTestSubject(comp, 'fieldListGroupedAvailableFields-count').text()).toBe('3'); @@ -405,7 +406,7 @@ describe('discover responsive sidebar', function () { ); await act(async () => { - await findTestSubject(comp, 'fieldFilterSearchInput').simulate('change', { + await findTestSubject(comp, 'fieldListFiltersFieldSearch').simulate('change', { target: { value: 'bytes' }, }); }); @@ -417,6 +418,34 @@ describe('discover responsive sidebar', function () { expect(mockCalcFieldCounts.mock.calls.length).toBe(1); }); + it('should allow filtering by field type', async function () { + const comp = await mountComponent(props); + + expect(findTestSubject(comp, 'fieldListGroupedAvailableFields-count').text()).toBe('3'); + expect(findTestSubject(comp, 'fieldListGrouped__ariaDescription').text()).toBe( + '1 selected field. 4 popular fields. 3 available fields. 20 empty fields. 2 meta fields.' + ); + + await act(async () => { + await findTestSubject(comp, 'fieldListFiltersFieldTypeFilterToggle').simulate('click'); + }); + + await comp.update(); + + await act(async () => { + await findTestSubject(comp, 'typeFilter-number').simulate('click'); + }); + + await comp.update(); + + expect(findTestSubject(comp, 'fieldListGroupedAvailableFields-count').text()).toBe('2'); + expect(findTestSubject(comp, 'fieldListGrouped__ariaDescription').text()).toBe( + '1 popular field. 2 available fields. 1 empty field. 0 meta fields.' + ); + + expect(mockCalcFieldCounts.mock.calls.length).toBe(1); + }, 10000); + it('should show "Add a field" button to create a runtime field', async () => { const services = createMockServices(); const comp = await mountComponent(props, {}, services); @@ -433,6 +462,11 @@ describe('discover responsive sidebar', function () { fetchStatus: FetchStatus.COMPLETE, recordRawType: RecordRawType.PLAIN, result: getDataTableRecords(stubLogstashDataView), + textBasedQueryColumns: [ + { id: '1', name: 'extension', meta: { type: 'text' } }, + { id: '1', name: 'bytes', meta: { type: 'number' } }, + { id: '1', name: '@timestamp', meta: { type: 'date' } }, + ], }) as DataDocuments$, }; const compInViewerMode = await mountComponent(propsWithTextBasedMode, { @@ -461,15 +495,15 @@ describe('discover responsive sidebar', function () { expect(selectedFieldsCount.text()).toBe('2'); expect(popularFieldsCount.exists()).toBe(false); - expect(availableFieldsCount.text()).toBe('4'); + expect(availableFieldsCount.text()).toBe('3'); expect(emptyFieldsCount.exists()).toBe(false); expect(metaFieldsCount.exists()).toBe(false); expect(unmappedFieldsCount.exists()).toBe(false); - expect(mockCalcFieldCounts.mock.calls.length).toBe(1); + expect(mockCalcFieldCounts.mock.calls.length).toBe(0); expect(findTestSubject(compInViewerMode, 'fieldListGrouped__ariaDescription').text()).toBe( - '2 selected fields. 4 available fields.' + '2 selected fields. 3 available fields.' ); }); diff --git a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.tsx b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.tsx index 7d31fff6e5a2f..b2b2715067d8c 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.tsx +++ b/src/plugins/discover/public/application/main/components/sidebar/discover_sidebar_responsive.tsx @@ -19,7 +19,6 @@ import { EuiIcon, EuiLink, EuiPortal, - EuiProgress, EuiShowFor, EuiTitle, } from '@elastic/eui'; @@ -30,7 +29,6 @@ import { } from '@kbn/unified-field-list-plugin/public'; import { VIEW_MODE } from '../../../../../common/constants'; import { useDiscoverServices } from '../../../../hooks/use_discover_services'; -import { getDefaultFieldFilter } from './lib/field_filter'; import { DiscoverSidebar } from './discover_sidebar'; import { AvailableFields$, @@ -49,6 +47,8 @@ import { DiscoverSidebarReducerStatus, } from './lib/sidebar_reducer'; +const EMPTY_FIELD_COUNTS = {}; + export interface DiscoverSidebarResponsiveProps { /** * Determines whether add/remove buttons are displayed non only when focused @@ -127,7 +127,6 @@ export function DiscoverSidebarResponsive(props: DiscoverSidebarResponsiveProps) (state) => getRawRecordType(state.query) === RecordRawType.PLAIN ); const { selectedDataView, onFieldEdited, onDataViewCreated } = props; - const [fieldFilter, setFieldFilter] = useState(getDefaultFieldFilter()); const [isFlyoutVisible, setIsFlyoutVisible] = useState(false); const [sidebarState, dispatchSidebarStateAction] = useReducer( discoverSidebarReducer, @@ -163,7 +162,10 @@ export function DiscoverSidebarResponsive(props: DiscoverSidebarResponsiveProps) type: DiscoverSidebarReducerActionType.DOCUMENTS_LOADED, payload: { dataView: selectedDataViewRef.current, - fieldCounts: calcFieldCounts(documentState.result), + fieldCounts: isPlainRecordType + ? EMPTY_FIELD_COUNTS + : calcFieldCounts(documentState.result), + textBasedQueryColumns: documentState.textBasedQueryColumns, isPlainRecord: isPlainRecordType, }, }); @@ -173,7 +175,7 @@ export function DiscoverSidebarResponsive(props: DiscoverSidebarResponsiveProps) type: DiscoverSidebarReducerActionType.DOCUMENTS_LOADED, payload: { dataView: selectedDataViewRef.current, - fieldCounts: {}, + fieldCounts: EMPTY_FIELD_COUNTS, isPlainRecord: isPlainRecordType, }, }); @@ -324,13 +326,11 @@ export function DiscoverSidebarResponsive(props: DiscoverSidebarResponsiveProps) <> {!props.isClosed && ( - {isProcessing && } { - return setFieldFilterProp(acc, kv[0], kv[1]); - }, state); - expect(actualState).toMatchInlineSnapshot(` - Object { - "aggregatable": true, - "name": "test", - "searchable": true, - "type": "string", - } - `); - }); - it('filters a given list', () => { - const defaultState = getDefaultFieldFilter(); - const fieldList = [ - { - name: 'bytes', - displayName: 'Bye,bye,Bytes', - type: 'number', - esTypes: ['long'], - count: 10, - scripted: false, - searchable: false, - aggregatable: false, - }, - { - name: 'extension', - displayName: 'Extension', - type: 'string', - esTypes: ['text'], - count: 10, - scripted: true, - searchable: true, - aggregatable: true, - }, - ] as DataViewField[]; - - [ - { filter: {}, result: ['bytes', 'extension'] }, - { filter: { name: 'by' }, result: ['bytes'] }, - { filter: { name: 'Ext' }, result: ['extension'] }, - { filter: { name: 'Bytes' }, result: ['bytes'] }, - { filter: { aggregatable: true }, result: ['extension'] }, - { filter: { aggregatable: true, searchable: false }, result: [] }, - { filter: { type: 'string' }, result: ['extension'] }, - ].forEach((test) => { - const filtered = fieldList - .filter((field) => doesFieldMatchFilters(field, { ...defaultState, ...test.filter })) - .map((field) => field.name); - - expect(filtered).toEqual(test.result); - }); - }); -}); diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/field_filter.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/field_filter.ts deleted file mode 100644 index 1f2ab0b9b64cd..0000000000000 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/field_filter.ts +++ /dev/null @@ -1,59 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { DataViewField } from '@kbn/data-views-plugin/public'; - -export interface FieldFilterState { - type: string; - name: string; - aggregatable: null | boolean; - searchable: null | boolean; -} - -export function getDefaultFieldFilter(): FieldFilterState { - return { - type: 'any', - name: '', - aggregatable: null, - searchable: null, - }; -} - -export function setFieldFilterProp( - state: FieldFilterState, - name: string, - value: string | boolean | null | undefined -): FieldFilterState { - const newState = { ...state }; - if (name === 'aggregatable') { - newState.aggregatable = typeof value !== 'boolean' ? null : value; - } else if (name === 'searchable') { - newState.searchable = typeof value !== 'boolean' ? null : value; - } else if (name === 'name') { - newState.name = String(value); - } else if (name === 'type') { - newState.type = String(value); - } - return newState; -} - -export function doesFieldMatchFilters( - field: DataViewField, - filterState: FieldFilterState -): boolean { - const matchFilter = filterState.type === 'any' || field.type === filterState.type; - const isAggregatable = - filterState.aggregatable === null || field.aggregatable === filterState.aggregatable; - const isSearchable = - filterState.searchable === null || field.searchable === filterState.searchable; - const needle = filterState.name ? filterState.name.toLowerCase() : ''; - const haystack = `${field.name}${field.displayName || ''}`.toLowerCase(); - const matchName = !filterState.name || haystack.indexOf(needle) !== -1; - - return matchFilter && isAggregatable && isSearchable && matchName; -} diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/get_data_view_field_list.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/get_field_list.ts similarity index 59% rename from src/plugins/discover/public/application/main/components/sidebar/lib/get_data_view_field_list.ts rename to src/plugins/discover/public/application/main/components/sidebar/lib/get_field_list.ts index 5d055d94184ed..78823bb0f468f 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/get_data_view_field_list.ts +++ b/src/plugins/discover/public/application/main/components/sidebar/lib/get_field_list.ts @@ -7,16 +7,16 @@ */ import { difference } from 'lodash'; -import type { DataView, DataViewField } from '@kbn/data-views-plugin/public'; +import { type DataView, DataViewField } from '@kbn/data-views-plugin/public'; +import type { DatatableColumn } from '@kbn/expressions-plugin/common'; import { fieldWildcardFilter } from '@kbn/kibana-utils-plugin/public'; import { isNestedFieldParent } from '../../../utils/nested_fields'; export function getDataViewFieldList( dataView: DataView | undefined | null, - fieldCounts: Record | undefined | null, - isPlainRecord: boolean + fieldCounts: Record | undefined | null ): DataViewField[] | null { - if (isPlainRecord && !fieldCounts) { + if (!fieldCounts) { // still loading data return null; } @@ -28,7 +28,7 @@ export function getDataViewFieldList( if (sourceFiltersValues) { const filter = fieldWildcardFilter(sourceFiltersValues, dataView.metaFields); dataViewFields = dataViewFields.filter((field) => { - return filter(field.name) || currentFieldCounts[field.name]; // don't filter out a field which was present in hits (ex. for text-based queries, selected fields) + return filter(field.name) || currentFieldCounts[field.name]; // don't filter out a field which was present in hits (ex. for selected fields) }); } @@ -38,24 +38,42 @@ export function getDataViewFieldList( difference(fieldNamesInDocs, fieldNamesInDataView).forEach((unknownFieldName) => { if (dataView && isNestedFieldParent(unknownFieldName, dataView)) { - unknownFields.push({ - displayName: String(unknownFieldName), - name: String(unknownFieldName), - type: 'nested', - } as DataViewField); + unknownFields.push( + new DataViewField({ + name: String(unknownFieldName), + type: 'nested', + searchable: false, + aggregatable: false, + }) + ); } else { - unknownFields.push({ - displayName: String(unknownFieldName), - name: String(unknownFieldName), - type: 'unknown', - } as DataViewField); + unknownFields.push( + new DataViewField({ + name: String(unknownFieldName), + type: 'unknown', + searchable: false, + aggregatable: false, + }) + ); } }); - return [ - ...(isPlainRecord - ? dataViewFields.filter((field) => currentFieldCounts[field.name]) - : dataViewFields), - ...unknownFields, - ]; + return [...dataViewFields, ...unknownFields]; +} + +export function getTextBasedQueryFieldList( + textBasedQueryColumns?: DatatableColumn[] +): DataViewField[] { + if (!textBasedQueryColumns) { + return []; + } + return textBasedQueryColumns.map( + (column) => + new DataViewField({ + name: column.name, + type: column.meta?.type ?? 'unknown', + searchable: false, + aggregatable: false, + }) + ); } diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/get_field_type_description.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/get_field_type_description.ts deleted file mode 100644 index 3b5b6aaa016ce..0000000000000 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/get_field_type_description.ts +++ /dev/null @@ -1,118 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import type { DocLinksStart } from '@kbn/core/public'; -import { i18n } from '@kbn/i18n'; -import { KNOWN_FIELD_TYPES } from '../../../../../../common/field_types'; - -const UNKNOWN_FIELD_TYPE_DESC = i18n.translate('discover.fieldNameDescription.unknownField', { - defaultMessage: 'Unknown field', -}); - -export function getFieldTypeDescription(type: string, docLinks: DocLinksStart) { - const knownType: KNOWN_FIELD_TYPES = type as KNOWN_FIELD_TYPES; - switch (knownType) { - case KNOWN_FIELD_TYPES.BOOLEAN: - return i18n.translate('discover.fieldNameDescription.booleanField', { - defaultMessage: 'True and false values.', - }); - case KNOWN_FIELD_TYPES.CONFLICT: - return i18n.translate('discover.fieldNameDescription.conflictField', { - defaultMessage: 'Field has values of different types. Resolve in Management > Data Views.', - }); - case KNOWN_FIELD_TYPES.DATE: - return i18n.translate('discover.fieldNameDescription.dateField', { - defaultMessage: 'A date string or the number of seconds or milliseconds since 1/1/1970.', - }); - case KNOWN_FIELD_TYPES.DATE_RANGE: - return i18n.translate('discover.fieldNameDescription.dateRangeField', { - defaultMessage: 'Range of {dateFieldTypeLink} values. {viewSupportedDateFormatsLink}', - values: { - dateFieldTypeLink: - `    ` + - i18n.translate('discover.fieldNameDescription.dateRangeFieldLinkText', { - defaultMessage: 'date', - }) + - '', - viewSupportedDateFormatsLink: - `` + - i18n.translate('discover.fieldNameDescription.viewSupportedDateFormatsLinkText', { - defaultMessage: 'View supported date formats.', - }) + - '', - }, - }); - case KNOWN_FIELD_TYPES.GEO_POINT: - return i18n.translate('discover.fieldNameDescription.geoPointField', { - defaultMessage: 'Latitude and longitude points.', - }); - case KNOWN_FIELD_TYPES.GEO_SHAPE: - return i18n.translate('discover.fieldNameDescription.geoShapeField', { - defaultMessage: 'Complex shapes, such as polygons.', - }); - case KNOWN_FIELD_TYPES.HISTOGRAM: - return i18n.translate('discover.fieldNameDescription.histogramField', { - defaultMessage: 'Pre-aggregated numerical values in the form of a histogram.', - }); - case KNOWN_FIELD_TYPES.IP: - return i18n.translate('discover.fieldNameDescription.ipAddressField', { - defaultMessage: 'IPv4 and IPv6 addresses.', - }); - case KNOWN_FIELD_TYPES.IP_RANGE: - return i18n.translate('discover.fieldNameDescription.ipAddressRangeField', { - defaultMessage: 'Range of ip values supporting either IPv4 or IPv6 (or mixed) addresses.', - }); - case KNOWN_FIELD_TYPES.MURMUR3: - return i18n.translate('discover.fieldNameDescription.murmur3Field', { - defaultMessage: 'Field that computes and stores hashes of values.', - }); - case KNOWN_FIELD_TYPES.NUMBER: - return i18n.translate('discover.fieldNameDescription.numberField', { - defaultMessage: 'Long, integer, short, byte, double, and float values.', - }); - case KNOWN_FIELD_TYPES.STRING: - return i18n.translate('discover.fieldNameDescription.stringField', { - defaultMessage: 'Full text such as the body of an email or a product description.', - }); - case KNOWN_FIELD_TYPES.TEXT: - return i18n.translate('discover.fieldNameDescription.textField', { - defaultMessage: 'Full text such as the body of an email or a product description.', - }); - case KNOWN_FIELD_TYPES.KEYWORD: - return i18n.translate('discover.fieldNameDescription.keywordField', { - defaultMessage: - 'Structured content such as an ID, email address, hostname, status code, or tag.', - }); - case KNOWN_FIELD_TYPES.NESTED: - return i18n.translate('discover.fieldNameDescription.nestedField', { - defaultMessage: 'JSON object that preserves the relationship between its subfields.', - }); - case KNOWN_FIELD_TYPES.VERSION: - return i18n.translate('discover.fieldNameDescription.versionField', { - defaultMessage: 'Software versions. Supports {SemanticVersioningLink} precedence rules.', - values: { - SemanticVersioningLink: - `` + - i18n.translate( - 'discover.advancedSettings.discover.fieldNameDescription.versionFieldLinkText', - { - defaultMessage: 'Semantic Versioning', - } - ) + - '', - }, - }); - default: - // If you see a typescript error here, that's a sign that there are missing switch cases ^^ - const _exhaustiveCheck: never = knownType; - return UNKNOWN_FIELD_TYPE_DESC || _exhaustiveCheck; - } -} diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.test.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.test.ts index 7dee06ec512bc..53d0bc96d3ca8 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.test.ts +++ b/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.test.ts @@ -12,7 +12,12 @@ import { getSelectedFields, shouldShowField, INITIAL_SELECTED_FIELDS_RESULT } fr describe('group_fields', function () { it('should pick fields as unknown_selected if they are unknown', function () { - const actual = getSelectedFields(dataView, ['currency']); + const actual = getSelectedFields({ + dataView, + columns: ['currency'], + allFields: dataView.fields, + isPlainRecord: false, + }); expect(actual).toMatchInlineSnapshot(` Object { "selectedFields": Array [ @@ -29,13 +34,47 @@ describe('group_fields', function () { `); }); + it('should pick fields as nested for a nested field root', function () { + const actual = getSelectedFields({ + dataView, + columns: ['nested1', 'bytes'], + allFields: [ + { + name: 'nested1', + type: 'nested', + }, + ] as DataViewField[], + isPlainRecord: false, + }); + expect(actual.selectedFieldsMap).toMatchInlineSnapshot(` + Object { + "bytes": true, + "nested1": true, + } + `); + }); + it('should work correctly if no columns selected', function () { - expect(getSelectedFields(dataView, [])).toBe(INITIAL_SELECTED_FIELDS_RESULT); - expect(getSelectedFields(dataView, ['_source'])).toBe(INITIAL_SELECTED_FIELDS_RESULT); + expect( + getSelectedFields({ dataView, columns: [], allFields: dataView.fields, isPlainRecord: false }) + ).toBe(INITIAL_SELECTED_FIELDS_RESULT); + expect( + getSelectedFields({ + dataView, + columns: ['_source'], + allFields: dataView.fields, + isPlainRecord: false, + }) + ).toBe(INITIAL_SELECTED_FIELDS_RESULT); }); it('should pick fields into selected group', function () { - const actual = getSelectedFields(dataView, ['bytes', '@timestamp']); + const actual = getSelectedFields({ + dataView, + columns: ['bytes', '@timestamp'], + allFields: dataView.fields, + isPlainRecord: false, + }); expect(actual.selectedFields.map((field) => field.name)).toEqual(['bytes', '@timestamp']); expect(actual.selectedFieldsMap).toStrictEqual({ bytes: true, @@ -44,7 +83,12 @@ describe('group_fields', function () { }); it('should pick fields into selected group if they contain multifields', function () { - const actual = getSelectedFields(dataView, ['machine.os', 'machine.os.raw']); + const actual = getSelectedFields({ + dataView, + columns: ['machine.os', 'machine.os.raw'], + allFields: dataView.fields, + isPlainRecord: false, + }); expect(actual.selectedFields.map((field) => field.name)).toEqual([ 'machine.os', 'machine.os.raw', @@ -56,7 +100,12 @@ describe('group_fields', function () { }); it('should sort selected fields by columns order', function () { - const actual1 = getSelectedFields(dataView, ['bytes', 'extension.keyword', 'unknown']); + const actual1 = getSelectedFields({ + dataView, + columns: ['bytes', 'extension.keyword', 'unknown'], + allFields: dataView.fields, + isPlainRecord: false, + }); expect(actual1.selectedFields.map((field) => field.name)).toEqual([ 'bytes', 'extension.keyword', @@ -68,7 +117,12 @@ describe('group_fields', function () { unknown: true, }); - const actual2 = getSelectedFields(dataView, ['extension', 'bytes', 'unknown']); + const actual2 = getSelectedFields({ + dataView, + columns: ['extension', 'bytes', 'unknown'], + allFields: dataView.fields, + isPlainRecord: false, + }); expect(actual2.selectedFields.map((field) => field.name)).toEqual([ 'extension', 'bytes', @@ -81,6 +135,33 @@ describe('group_fields', function () { }); }); + it('should pick fields only from allFields instead of data view fields for a text based query', function () { + const actual = getSelectedFields({ + dataView, + columns: ['bytes'], + allFields: [ + { + name: 'bytes', + type: 'text', + }, + ] as DataViewField[], + isPlainRecord: true, + }); + expect(actual).toMatchInlineSnapshot(` + Object { + "selectedFields": Array [ + Object { + "name": "bytes", + "type": "text", + }, + ], + "selectedFieldsMap": Object { + "bytes": true, + }, + } + `); + }); + it('should show any fields if for text-based searches', function () { expect(shouldShowField(dataView.getFieldByName('bytes'), true)).toBe(true); expect(shouldShowField({ type: 'unknown', name: 'unknown' } as DataViewField, true)).toBe(true); diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.tsx b/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.tsx index eaae1c90d3833..11bbd285f4b7e 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.tsx +++ b/src/plugins/discover/public/application/main/components/sidebar/lib/group_fields.tsx @@ -36,22 +36,30 @@ export interface SelectedFieldsResult { selectedFieldsMap: Record; } -export function getSelectedFields( - dataView: DataView | undefined, - columns: string[] -): SelectedFieldsResult { +export function getSelectedFields({ + dataView, + columns, + allFields, + isPlainRecord, +}: { + dataView: DataView | undefined; + columns: string[]; + allFields: DataViewField[] | null; + isPlainRecord: boolean; +}): SelectedFieldsResult { const result: SelectedFieldsResult = { selectedFields: [], selectedFieldsMap: {}, }; - if (!Array.isArray(columns) || !columns.length) { + if (!Array.isArray(columns) || !columns.length || !allFields) { return INITIAL_SELECTED_FIELDS_RESULT; } // add selected columns, that are not part of the data view, to be removable for (const column of columns) { const selectedField = - dataView?.getFieldByName?.(column) || + (!isPlainRecord && dataView?.getFieldByName?.(column)) || + allFields.find((field) => field.name === column) || // for example to pick a `nested` root field or find a selected field in text-based response ({ name: column, displayName: column, diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.test.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.test.ts index 131f9c358317f..c5ea2878f800e 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.test.ts +++ b/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.test.ts @@ -18,6 +18,7 @@ import { getInitialState, } from './sidebar_reducer'; import { DataViewField } from '@kbn/data-views-plugin/common'; +import type { DatatableColumn } from '@kbn/expressions-plugin/common'; describe('sidebar reducer', function () { it('should set an initial state', function () { @@ -84,11 +85,12 @@ describe('sidebar reducer', function () { allFields: [ ...stubDataViewWithoutTimeField.fields, // merging in unmapped fields - { - displayName: unmappedFieldName, + new DataViewField({ name: unmappedFieldName, type: 'unknown', - } as DataViewField, + aggregatable: false, + searchable: false, + }), ], fieldCounts, status: DiscoverSidebarReducerStatus.COMPLETED, @@ -99,33 +101,54 @@ describe('sidebar reducer', function () { payload: { isPlainRecord: true, dataView: stubDataViewWithoutTimeField, - fieldCounts, + fieldCounts: {}, + textBasedQueryColumns: [ + { + id: '1', + name: 'text1', + meta: { + type: 'number', + }, + }, + { + id: '2', + name: 'text2', + meta: { + type: 'keyword', + }, + }, + ] as DatatableColumn[], }, }); expect(resultForTextBasedQuery).toStrictEqual({ dataView: stubDataViewWithoutTimeField, allFields: [ - stubDataViewWithoutTimeField.fields.find((field) => field.name === dataViewFieldName), - // merging in unmapped fields - { - displayName: 'field1', - name: 'field1', - type: 'unknown', - } as DataViewField, + new DataViewField({ + name: 'text1', + type: 'number', + aggregatable: false, + searchable: false, + }), + new DataViewField({ + name: 'text2', + type: 'keyword', + aggregatable: false, + searchable: false, + }), ], - fieldCounts, + fieldCounts: {}, status: DiscoverSidebarReducerStatus.COMPLETED, }); - const resultForTextBasedQueryWhileLoading = discoverSidebarReducer(state, { + const resultWhileLoading = discoverSidebarReducer(state, { type: DiscoverSidebarReducerActionType.DOCUMENTS_LOADED, payload: { - isPlainRecord: true, + isPlainRecord: false, dataView: stubDataViewWithoutTimeField, fieldCounts: null, }, }); - expect(resultForTextBasedQueryWhileLoading).toStrictEqual({ + expect(resultWhileLoading).toStrictEqual({ dataView: stubDataViewWithoutTimeField, allFields: null, fieldCounts: null, diff --git a/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.ts b/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.ts index 0c579275029b1..54e9a2c95ce12 100644 --- a/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.ts +++ b/src/plugins/discover/public/application/main/components/sidebar/lib/sidebar_reducer.ts @@ -7,7 +7,8 @@ */ import { type DataView, type DataViewField } from '@kbn/data-views-plugin/common'; -import { getDataViewFieldList } from './get_data_view_field_list'; +import type { DatatableColumn } from '@kbn/expressions-plugin/common'; +import { getDataViewFieldList, getTextBasedQueryFieldList } from './get_field_list'; export enum DiscoverSidebarReducerActionType { RESET = 'RESET', @@ -39,6 +40,7 @@ type DiscoverSidebarReducerAction = type: DiscoverSidebarReducerActionType.DOCUMENTS_LOADED; payload: { fieldCounts: DiscoverSidebarReducerState['fieldCounts']; + textBasedQueryColumns?: DatatableColumn[]; // from text-based searches isPlainRecord: boolean; dataView: DataView | null | undefined; }; @@ -94,11 +96,9 @@ export function discoverSidebarReducer( status: DiscoverSidebarReducerStatus.PROCESSING, }; case DiscoverSidebarReducerActionType.DOCUMENTS_LOADED: - const mappedAndUnmappedFields = getDataViewFieldList( - action.payload.dataView, - action.payload.fieldCounts, - action.payload.isPlainRecord - ); + const mappedAndUnmappedFields = action.payload.isPlainRecord + ? getTextBasedQueryFieldList(action.payload.textBasedQueryColumns) + : getDataViewFieldList(action.payload.dataView, action.payload.fieldCounts); return { ...state, dataView: action.payload.dataView, diff --git a/src/plugins/discover/public/application/main/services/discover_data_state_container.ts b/src/plugins/discover/public/application/main/services/discover_data_state_container.ts index 5cadb099c483e..0a845dc92315c 100644 --- a/src/plugins/discover/public/application/main/services/discover_data_state_container.ts +++ b/src/plugins/discover/public/application/main/services/discover_data_state_container.ts @@ -7,6 +7,7 @@ */ import { BehaviorSubject, filter, map, Observable, share, Subject, tap } from 'rxjs'; import { AutoRefreshDoneFn } from '@kbn/data-plugin/public'; +import type { DatatableColumn } from '@kbn/expressions-plugin/common'; import { RequestAdapter } from '@kbn/inspector-plugin/common'; import { SavedSearch } from '@kbn/saved-search-plugin/public'; import { AggregateQuery, Query } from '@kbn/es-query'; @@ -68,6 +69,7 @@ export interface DataMainMsg extends DataMsg { export interface DataDocumentsMsg extends DataMsg { result?: DataTableRecord[]; + textBasedQueryColumns?: DatatableColumn[]; // columns from text-based request } export interface DataTotalHitsMsg extends DataMsg { diff --git a/src/plugins/discover/public/application/main/utils/fetch_all.test.ts b/src/plugins/discover/public/application/main/utils/fetch_all.test.ts index 95b1cd7618b4d..40aeb04fb8e95 100644 --- a/src/plugins/discover/public/application/main/utils/fetch_all.test.ts +++ b/src/plugins/discover/public/application/main/utils/fetch_all.test.ts @@ -82,8 +82,8 @@ describe('test fetchAll', () => { }; searchSource = savedSearchMock.searchSource.createChild(); - mockFetchDocuments.mockReset().mockResolvedValue([]); - mockFetchSQL.mockReset().mockResolvedValue([]); + mockFetchDocuments.mockReset().mockResolvedValue({ records: [] }); + mockFetchSQL.mockReset().mockResolvedValue({ records: [] }); }); test('changes of fetchStatus when starting with FetchStatus.UNINITIALIZED', async () => { @@ -108,7 +108,7 @@ describe('test fetchAll', () => { { _id: '2', _index: 'logs' }, ]; const documents = hits.map((hit) => buildDataTableRecord(hit, dataViewMock)); - mockFetchDocuments.mockResolvedValue(documents); + mockFetchDocuments.mockResolvedValue({ records: documents }); fetchAll(subjects, searchSource, false, deps); await waitForNextTick(); expect(await collect()).toEqual([ @@ -130,7 +130,7 @@ describe('test fetchAll', () => { ]; searchSource.getField('index')!.isTimeBased = () => false; const documents = hits.map((hit) => buildDataTableRecord(hit, dataViewMock)); - mockFetchDocuments.mockResolvedValue(documents); + mockFetchDocuments.mockResolvedValue({ records: documents }); subjects.totalHits$.next({ fetchStatus: FetchStatus.LOADING, @@ -181,7 +181,7 @@ describe('test fetchAll', () => { searchSource.getField('index')!.isTimeBased = () => false; const hits = [{ _id: '1', _index: 'logs' }]; const documents = hits.map((hit) => buildDataTableRecord(hit, dataViewMock)); - mockFetchDocuments.mockResolvedValue(documents); + mockFetchDocuments.mockResolvedValue({ records: documents }); subjects.totalHits$.next({ fetchStatus: FetchStatus.LOADING, recordRawType: RecordRawType.DOCUMENT, @@ -248,7 +248,10 @@ describe('test fetchAll', () => { { _id: '2', _index: 'logs' }, ]; const documents = hits.map((hit) => buildDataTableRecord(hit, dataViewMock)); - mockFetchSQL.mockResolvedValue(documents); + mockFetchSQL.mockResolvedValue({ + records: documents, + textBasedQueryColumns: [{ id: '1', name: 'test1', meta: { type: 'number' } }], + }); const query = { sql: 'SELECT * from foo' }; deps = { appStateContainer: { @@ -275,6 +278,7 @@ describe('test fetchAll', () => { fetchStatus: FetchStatus.COMPLETE, recordRawType: 'plain', result: documents, + textBasedQueryColumns: [{ id: '1', name: 'test1', meta: { type: 'number' } }], query, }, ]); diff --git a/src/plugins/discover/public/application/main/utils/fetch_all.ts b/src/plugins/discover/public/application/main/utils/fetch_all.ts index c2a3c0856af06..656957d85f5d6 100644 --- a/src/plugins/discover/public/application/main/utils/fetch_all.ts +++ b/src/plugins/discover/public/application/main/utils/fetch_all.ts @@ -86,32 +86,33 @@ export function fetchAll( sendLoadingMsg(dataSubjects.totalHits$, { recordRawType }); // Start fetching all required requests - const documents = + const response = useSql && query ? fetchSql(query, dataView, data, services.expressions, inspectorAdapters) : fetchDocuments(searchSource.createCopy(), fetchDeps); // Handle results of the individual queries and forward the results to the corresponding dataSubjects - documents - .then((docs) => { + response + .then(({ records, textBasedQueryColumns }) => { // If the total hits (or chart) query is still loading, emit a partial // hit count that's at least our retrieved document count if (dataSubjects.totalHits$.getValue().fetchStatus === FetchStatus.LOADING) { dataSubjects.totalHits$.next({ fetchStatus: FetchStatus.PARTIAL, - result: docs.length, + result: records.length, recordRawType, }); } dataSubjects.documents$.next({ fetchStatus: FetchStatus.COMPLETE, - result: docs, + result: records, + textBasedQueryColumns, recordRawType, query, }); - checkHitCount(dataSubjects.main$, docs.length); + checkHitCount(dataSubjects.main$, records.length); }) // Only the document query should send its errors to main$, to cause the full Discover app // to get into an error state. The other queries will not cause all of Discover to error out diff --git a/src/plugins/discover/public/application/main/utils/fetch_documents.test.ts b/src/plugins/discover/public/application/main/utils/fetch_documents.test.ts index 28738cdc522c9..22415aa782194 100644 --- a/src/plugins/discover/public/application/main/utils/fetch_documents.test.ts +++ b/src/plugins/discover/public/application/main/utils/fetch_documents.test.ts @@ -36,7 +36,9 @@ describe('test fetchDocuments', () => { const documents = hits.map((hit) => buildDataTableRecord(hit, dataViewMock)); savedSearchMock.searchSource.fetch$ = () => of({ rawResponse: { hits: { hits } } } as IKibanaSearchResponse>); - expect(fetchDocuments(savedSearchMock.searchSource, getDeps())).resolves.toEqual(documents); + expect(fetchDocuments(savedSearchMock.searchSource, getDeps())).resolves.toEqual({ + records: documents, + }); }); test('rejects on query failure', () => { diff --git a/src/plugins/discover/public/application/main/utils/fetch_documents.ts b/src/plugins/discover/public/application/main/utils/fetch_documents.ts index 9a2913aea6d0b..db092cb449057 100644 --- a/src/plugins/discover/public/application/main/utils/fetch_documents.ts +++ b/src/plugins/discover/public/application/main/utils/fetch_documents.ts @@ -9,7 +9,7 @@ import { i18n } from '@kbn/i18n'; import { filter, map } from 'rxjs/operators'; import { lastValueFrom } from 'rxjs'; import { isCompleteResponse, ISearchSource } from '@kbn/data-plugin/public'; -import { EsHitRecord } from '../../../types'; +import type { RecordsFetchResponse, EsHitRecord } from '../../../types'; import { buildDataTableRecordList } from '../../../utils/build_data_record'; import { SAMPLE_SIZE_SETTING } from '../../../../common'; import { FetchDeps } from './fetch_all'; @@ -21,7 +21,7 @@ import { FetchDeps } from './fetch_all'; export const fetchDocuments = ( searchSource: ISearchSource, { abortController, inspectorAdapters, searchSessionId, services }: FetchDeps -) => { +): Promise => { searchSource.setField('size', services.uiSettings.get(SAMPLE_SIZE_SETTING)); searchSource.setField('trackTotalHits', false); searchSource.setField('highlightAll', true); @@ -61,5 +61,5 @@ export const fetchDocuments = ( }) ); - return lastValueFrom(fetch$); + return lastValueFrom(fetch$).then((records) => ({ records })); }; diff --git a/src/plugins/discover/public/application/main/utils/fetch_sql.ts b/src/plugins/discover/public/application/main/utils/fetch_sql.ts index b61d5334e4453..60a0831e0d6c9 100644 --- a/src/plugins/discover/public/application/main/utils/fetch_sql.ts +++ b/src/plugins/discover/public/application/main/utils/fetch_sql.ts @@ -14,7 +14,7 @@ import type { ExpressionsStart } from '@kbn/expressions-plugin/public'; import type { Datatable } from '@kbn/expressions-plugin/public'; import type { DataView } from '@kbn/data-views-plugin/common'; import { textBasedQueryStateToAstWithValidation } from '@kbn/data-plugin/common'; -import { DataTableRecord } from '../../../types'; +import type { RecordsFetchResponse, DataTableRecord } from '../../../types'; interface SQLErrorResponse { error: { @@ -31,7 +31,7 @@ export function fetchSql( inspectorAdapters: Adapters, filters?: Filter[], inputQuery?: Query -) { +): Promise { const timeRange = data.query.timefilter.timefilter.getTime(); return textBasedQueryStateToAstWithValidation({ filters, @@ -46,6 +46,7 @@ export function fetchSql( inspectorAdapters, }); let finalData: DataTableRecord[] = []; + let textBasedQueryColumns: Datatable['columns'] | undefined; let error: string | undefined; execution.pipe(pluck('result')).subscribe((resp) => { const response = resp as Datatable | SQLErrorResponse; @@ -54,6 +55,7 @@ export function fetchSql( } else { const table = response as Datatable; const rows = table?.rows ?? []; + textBasedQueryColumns = table?.columns ?? undefined; finalData = rows.map( (row: Record, idx: number) => ({ @@ -68,11 +70,17 @@ export function fetchSql( if (error) { throw new Error(error); } else { - return finalData || []; + return { + records: finalData || [], + textBasedQueryColumns, + }; } }); } - return []; + return { + records: [] as DataTableRecord[], + textBasedQueryColumns: [], + }; }) .catch((err) => { throw new Error(err.message); diff --git a/src/plugins/discover/public/components/field_name/__snapshots__/field_name.test.tsx.snap b/src/plugins/discover/public/components/field_name/__snapshots__/field_name.test.tsx.snap index 21777f772c9a5..e7cf7eddd0b94 100644 --- a/src/plugins/discover/public/components/field_name/__snapshots__/field_name.test.tsx.snap +++ b/src/plugins/discover/public/components/field_name/__snapshots__/field_name.test.tsx.snap @@ -10,9 +10,9 @@ Array [ > - Geo point field + Geo point
    • , @@ -44,9 +44,9 @@ Array [ > - Number field + Number
    , @@ -78,9 +78,9 @@ Array [ > - String field + String
    , @@ -146,9 +146,9 @@ Array [ > - Number field + Number , @@ -180,9 +180,9 @@ Array [ > - Number field + Number , diff --git a/src/plugins/discover/public/components/field_name/field_name.tsx b/src/plugins/discover/public/components/field_name/field_name.tsx index ca386d344e42f..488e412eea107 100644 --- a/src/plugins/discover/public/components/field_name/field_name.tsx +++ b/src/plugins/discover/public/components/field_name/field_name.tsx @@ -12,9 +12,8 @@ import { EuiBadge, EuiFlexGroup, EuiFlexItem, EuiToolTip, EuiHighlight } from '@ import { FormattedMessage } from '@kbn/i18n-react'; import { i18n } from '@kbn/i18n'; import { FieldIcon, FieldIconProps } from '@kbn/react-field'; -import { getFieldSubtypeMulti } from '@kbn/data-views-plugin/public'; -import type { DataViewField } from '@kbn/data-views-plugin/public'; -import { getFieldTypeName } from '../../utils/get_field_type_name'; +import { type DataViewField, getFieldSubtypeMulti } from '@kbn/data-views-plugin/public'; +import { getFieldTypeName } from '@kbn/unified-field-list-plugin/public'; interface Props { fieldName: string; diff --git a/src/plugins/discover/public/embeddable/saved_search_embeddable.test.ts b/src/plugins/discover/public/embeddable/saved_search_embeddable.test.ts index 0e30156381ade..6f09c9fb65ea5 100644 --- a/src/plugins/discover/public/embeddable/saved_search_embeddable.test.ts +++ b/src/plugins/discover/public/embeddable/saved_search_embeddable.test.ts @@ -36,6 +36,16 @@ jest.mock('react-dom', () => { }); const waitOneTick = () => new Promise((resolve) => setTimeout(resolve, 0)); +function getSearchResponse(nrOfHits: number) { + const hits = new Array(nrOfHits).map((idx) => ({ id: idx })); + return of({ + rawResponse: { + hits: { hits, total: nrOfHits }, + }, + isPartial: false, + isRunning: false, + }); +} describe('saved search embeddable', () => { let mountpoint: HTMLDivElement; @@ -46,9 +56,10 @@ describe('saved search embeddable', () => { let showFieldStatisticsMockValue: boolean = false; let viewModeMockValue: VIEW_MODE = VIEW_MODE.DOCUMENT_LEVEL; - const createEmbeddable = (searchMock?: jest.Mock) => { + const createEmbeddable = (searchMock?: jest.Mock, customTitle?: string) => { const savedSearchMock = { id: 'mock-id', + title: 'saved search', sort: [['message', 'asc']] as Array<[string, string]>, searchSource: createSearchSourceMock({ index: dataViewMock }, undefined, searchMock), viewMode: viewModeMockValue, @@ -73,6 +84,9 @@ describe('saved search embeddable', () => { rowHeight: 30, rowsPerPage: 50, }; + if (customTitle) { + searchInput.title = customTitle; + } executeTriggerActions = jest.fn(); @@ -154,13 +168,7 @@ describe('saved search embeddable', () => { it('should render saved search embeddable when successfully loading data', async () => { // mock return data - const search = jest.fn().mockReturnValue( - of({ - rawResponse: { hits: { hits: [{ id: 1 }], total: 1 } }, - isPartial: false, - isRunning: false, - }) - ); + const search = jest.fn().mockReturnValue(getSearchResponse(1)); const { embeddable } = createEmbeddable(search); jest.spyOn(embeddable, 'updateOutput'); @@ -186,13 +194,7 @@ describe('saved search embeddable', () => { it('should render saved search embeddable when empty data is returned', async () => { // mock return data - const search = jest.fn().mockReturnValue( - of({ - rawResponse: { hits: { hits: [], total: 0 } }, - isPartial: false, - isRunning: false, - }) - ); + const search = jest.fn().mockReturnValue(getSearchResponse(0)); const { embeddable } = createEmbeddable(search); jest.spyOn(embeddable, 'updateOutput'); @@ -262,14 +264,8 @@ describe('saved search embeddable', () => { expect(loadedOutput.error).not.toBe(undefined); }); - it('a custom title should not start another search which would cause an Abort error', async () => { - const search = jest.fn().mockReturnValue( - of({ - rawResponse: { hits: { hits: [], total: 0 } }, - isPartial: false, - isRunning: false, - }) - ); + it('should not fetch data if only a new input title is set', async () => { + const search = jest.fn().mockReturnValue(getSearchResponse(1)); const { embeddable, searchInput } = createEmbeddable(search); embeddable.render(mountpoint); @@ -281,4 +277,43 @@ describe('saved search embeddable', () => { await waitOneTick(); expect(search).toHaveBeenCalledTimes(1); }); + it('should not reload when the input title doesnt change', async () => { + const search = jest.fn().mockReturnValue(getSearchResponse(1)); + const { embeddable } = createEmbeddable(search, 'custom title'); + embeddable.reload = jest.fn(); + embeddable.render(mountpoint); + // wait for data fetching + await waitOneTick(); + embeddable.updateOutput({ title: 'custom title' }); + await waitOneTick(); + + expect(embeddable.reload).toHaveBeenCalledTimes(0); + expect(search).toHaveBeenCalledTimes(1); + }); + + it('should reload when a different input title is set', async () => { + const search = jest.fn().mockReturnValue(getSearchResponse(1)); + const { embeddable } = createEmbeddable(search, 'custom title'); + embeddable.reload = jest.fn(); + embeddable.render(mountpoint); + + await waitOneTick(); + embeddable.updateOutput({ title: 'custom title changed' }); + await waitOneTick(); + + expect(embeddable.reload).toHaveBeenCalledTimes(1); + expect(search).toHaveBeenCalledTimes(1); + }); + it('should not reload and fetch when a input title matches the saved search title', async () => { + const search = jest.fn().mockReturnValue(getSearchResponse(1)); + const { embeddable } = createEmbeddable(search); + embeddable.reload = jest.fn(); + embeddable.render(mountpoint); + await waitOneTick(); + embeddable.updateOutput({ title: 'saved search' }); + await waitOneTick(); + + expect(embeddable.reload).toHaveBeenCalledTimes(0); + expect(search).toHaveBeenCalledTimes(1); + }); }); diff --git a/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx b/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx index 69a8f4115a45e..f26e5e9e2e9dd 100644 --- a/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx +++ b/src/plugins/discover/public/embeddable/saved_search_embeddable.tsx @@ -145,7 +145,7 @@ export class SavedSearchEmbeddable this.inspectorAdapters = { requests: new RequestAdapter(), }; - this.panelTitle = savedSearch.title ?? ''; + this.panelTitle = this.input.title ? this.input.title : savedSearch.title ?? ''; this.initializeSearchEmbeddableProps(); this.subscription = this.getUpdated$().subscribe(() => { @@ -240,8 +240,8 @@ export class SavedSearchEmbeddable loading: false, }); - this.searchProps!.rows = result; - this.searchProps!.totalHitCount = result.length; + this.searchProps!.rows = result.records; + this.searchProps!.totalHitCount = result.records.length; this.searchProps!.isLoading = false; this.searchProps!.isPlainRecord = true; this.searchProps!.showTimeCol = false; @@ -423,7 +423,6 @@ export class SavedSearchEmbeddable if (!searchProps || !searchProps.dataView) { return false; } - return ( !onlyDisabledFiltersChanged(this.input.filters, this.prevFilters) || !isEqual(this.prevQuery, this.input.query) || diff --git a/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/legacy/table.tsx b/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/legacy/table.tsx index 91e3bbc73fdf1..1a63ccf69477e 100644 --- a/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/legacy/table.tsx +++ b/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/legacy/table.tsx @@ -9,7 +9,7 @@ import '../table.scss'; import React, { useCallback, useMemo } from 'react'; import { EuiInMemoryTable } from '@elastic/eui'; -import { getTypeForFieldIcon } from '../../../../../utils/get_type_for_field_icon'; +import { getFieldIconType } from '@kbn/unified-field-list-plugin/public'; import { useDiscoverServices } from '../../../../../hooks/use_discover_services'; import { SHOW_MULTIFIELDS } from '../../../../../../common'; import { DocViewRenderProps, FieldRecordLegacy } from '../../../doc_views_types'; @@ -76,7 +76,7 @@ export const DocViewerLegacyTable = ({ const fieldType = isNestedFieldParent(field, dataView) ? 'nested' : fieldMapping - ? getTypeForFieldIcon(fieldMapping) + ? getFieldIconType(fieldMapping) : undefined; const ignored = getIgnoredReason(fieldMapping ?? field, hit.raw._ignored); return { diff --git a/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/table.tsx b/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/table.tsx index 0eab3a68c8218..56232a31f9a0f 100644 --- a/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/table.tsx +++ b/src/plugins/discover/public/services/doc_views/components/doc_viewer_table/table.tsx @@ -29,7 +29,7 @@ import { i18n } from '@kbn/i18n'; import { FormattedMessage } from '@kbn/i18n-react'; import { debounce } from 'lodash'; import { Storage } from '@kbn/kibana-utils-plugin/public'; -import { getTypeForFieldIcon } from '../../../../utils/get_type_for_field_icon'; +import { getFieldIconType } from '@kbn/unified-field-list-plugin/public'; import { useDiscoverServices } from '../../../../hooks/use_discover_services'; import { usePager } from '../../../../hooks/use_pager'; import { FieldName } from '../../../../components/field_name/field_name'; @@ -166,7 +166,7 @@ export const DocViewerTable = ({ const fieldType = isNestedFieldParent(field, dataView) ? 'nested' : fieldMapping - ? getTypeForFieldIcon(fieldMapping) + ? getFieldIconType(fieldMapping) : undefined; const ignored = getIgnoredReason(fieldMapping ?? field, hit.raw._ignored); diff --git a/src/plugins/discover/public/types.ts b/src/plugins/discover/public/types.ts index f96edccb5f9bf..2419f15b8a429 100644 --- a/src/plugins/discover/public/types.ts +++ b/src/plugins/discover/public/types.ts @@ -7,6 +7,7 @@ */ import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; +import { type DatatableColumn } from '@kbn/expressions-plugin/common'; export type ValueToStringConverter = ( rowIndex: number, @@ -38,3 +39,8 @@ export interface DataTableRecord { */ isAnchor?: boolean; } + +export interface RecordsFetchResponse { + records: DataTableRecord[]; + textBasedQueryColumns?: DatatableColumn[]; +} diff --git a/src/plugins/discover/public/utils/get_field_type_name.test.ts b/src/plugins/discover/public/utils/get_field_type_name.test.ts deleted file mode 100644 index bada07e8ad9f7..0000000000000 --- a/src/plugins/discover/public/utils/get_field_type_name.test.ts +++ /dev/null @@ -1,35 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { getFieldTypeName, UNKNOWN_FIELD_TYPE_MESSAGE } from './get_field_type_name'; -import { KNOWN_FIELD_TYPES } from '../../common/field_types'; - -describe('getFieldTypeName', () => { - describe('known field types should be recognized', () => { - it.each(Object.values(KNOWN_FIELD_TYPES))( - `'%s' should return a string that does not match '${UNKNOWN_FIELD_TYPE_MESSAGE}'`, - (field) => { - const fieldTypeName = getFieldTypeName(field); - expect(typeof fieldTypeName).toBe('string'); - expect(fieldTypeName).not.toBe(UNKNOWN_FIELD_TYPE_MESSAGE); - } - ); - }); - - it(`should return '${UNKNOWN_FIELD_TYPE_MESSAGE}' when passed undefined`, () => { - expect(getFieldTypeName(undefined)).toBe(UNKNOWN_FIELD_TYPE_MESSAGE); - }); - - it(`should return '${UNKNOWN_FIELD_TYPE_MESSAGE}' when passed 'unknown'`, () => { - expect(getFieldTypeName('unknown')).toBe(UNKNOWN_FIELD_TYPE_MESSAGE); - }); - - it('should return the original type string back when passed an unknown field type', () => { - expect(getFieldTypeName('unknown_field_type')).toBe('unknown_field_type'); - }); -}); diff --git a/src/plugins/discover/public/utils/get_field_type_name.ts b/src/plugins/discover/public/utils/get_field_type_name.ts deleted file mode 100644 index 81a4346f63902..0000000000000 --- a/src/plugins/discover/public/utils/get_field_type_name.ts +++ /dev/null @@ -1,105 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { i18n } from '@kbn/i18n'; -import { KBN_FIELD_TYPES } from '@kbn/data-plugin/public'; -import { KNOWN_FIELD_TYPES } from '../../common/field_types'; - -export const UNKNOWN_FIELD_TYPE_MESSAGE = i18n.translate( - 'discover.fieldNameIcons.unknownFieldAriaLabel', - { - defaultMessage: 'Unknown field', - } -); - -export function getFieldTypeName(type?: string) { - if (!type || type === KBN_FIELD_TYPES.UNKNOWN) { - return UNKNOWN_FIELD_TYPE_MESSAGE; - } - - if (type === 'source') { - // TODO: check if we can remove this logic as outdated - - // Note that this type is currently not provided, type for _source is undefined - return i18n.translate('discover.fieldNameIcons.sourceFieldAriaLabel', { - defaultMessage: 'Source field', - }); - } - - const knownType: KNOWN_FIELD_TYPES = type as KNOWN_FIELD_TYPES; - switch (knownType) { - case KNOWN_FIELD_TYPES.BOOLEAN: - return i18n.translate('discover.fieldNameIcons.booleanAriaLabel', { - defaultMessage: 'Boolean field', - }); - case KNOWN_FIELD_TYPES.CONFLICT: - return i18n.translate('discover.fieldNameIcons.conflictFieldAriaLabel', { - defaultMessage: 'Conflicting field', - }); - case KNOWN_FIELD_TYPES.DATE: - return i18n.translate('discover.fieldNameIcons.dateFieldAriaLabel', { - defaultMessage: 'Date field', - }); - case KNOWN_FIELD_TYPES.DATE_RANGE: - return i18n.translate('discover.fieldNameIcons.dateRangeFieldAriaLabel', { - defaultMessage: 'Date range field', - }); - case KNOWN_FIELD_TYPES.GEO_POINT: - return i18n.translate('discover.fieldNameIcons.geoPointFieldAriaLabel', { - defaultMessage: 'Geo point field', - }); - case KNOWN_FIELD_TYPES.GEO_SHAPE: - return i18n.translate('discover.fieldNameIcons.geoShapeFieldAriaLabel', { - defaultMessage: 'Geo shape field', - }); - case KNOWN_FIELD_TYPES.HISTOGRAM: - return i18n.translate('discover.fieldNameIcons.histogramFieldAriaLabel', { - defaultMessage: 'Histogram field', - }); - case KNOWN_FIELD_TYPES.IP: - return i18n.translate('discover.fieldNameIcons.ipAddressFieldAriaLabel', { - defaultMessage: 'IP address field', - }); - case KNOWN_FIELD_TYPES.IP_RANGE: - return i18n.translate('discover.fieldNameIcons.ipRangeFieldAriaLabel', { - defaultMessage: 'IP range field', - }); - case KNOWN_FIELD_TYPES.MURMUR3: - return i18n.translate('discover.fieldNameIcons.murmur3FieldAriaLabel', { - defaultMessage: 'Murmur3 field', - }); - case KNOWN_FIELD_TYPES.NUMBER: - return i18n.translate('discover.fieldNameIcons.numberFieldAriaLabel', { - defaultMessage: 'Number field', - }); - case KNOWN_FIELD_TYPES.STRING: - return i18n.translate('discover.fieldNameIcons.stringFieldAriaLabel', { - defaultMessage: 'String field', - }); - case KNOWN_FIELD_TYPES.TEXT: - return i18n.translate('discover.fieldNameIcons.textFieldAriaLabel', { - defaultMessage: 'Text field', - }); - case KNOWN_FIELD_TYPES.KEYWORD: - return i18n.translate('discover.fieldNameIcons.keywordFieldAriaLabel', { - defaultMessage: 'Keyword field', - }); - case KNOWN_FIELD_TYPES.NESTED: - return i18n.translate('discover.fieldNameIcons.nestedFieldAriaLabel', { - defaultMessage: 'Nested field', - }); - case KNOWN_FIELD_TYPES.VERSION: - return i18n.translate('discover.fieldNameIcons.versionFieldAriaLabel', { - defaultMessage: 'Version field', - }); - default: - // If you see a typescript error here, that's a sign that there are missing switch cases ^^ - const _exhaustiveCheck: never = knownType; - return knownType || _exhaustiveCheck; - } -} diff --git a/src/plugins/discover/public/utils/get_type_for_field_icon.test.ts b/src/plugins/discover/public/utils/get_type_for_field_icon.test.ts deleted file mode 100644 index 33decc463d013..0000000000000 --- a/src/plugins/discover/public/utils/get_type_for_field_icon.test.ts +++ /dev/null @@ -1,48 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { DataViewField } from '@kbn/data-views-plugin/common'; -import { getTypeForFieldIcon } from './get_type_for_field_icon'; - -describe('getTypeForFieldIcon', () => { - it('extracts type for non-string types', () => { - expect( - getTypeForFieldIcon({ - type: 'not-string', - esTypes: ['bar'], - } as DataViewField) - ).toBe('not-string'); - }); - - it('extracts type when type is string but esTypes is unavailable', () => { - expect( - getTypeForFieldIcon({ - type: 'string', - esTypes: undefined, - } as DataViewField) - ).toBe('string'); - }); - - it('extracts esType when type is string and esTypes is available', () => { - expect( - getTypeForFieldIcon({ - type: 'string', - esTypes: ['version'], - } as DataViewField) - ).toBe('version'); - }); - - it('extracts type for meta fields', () => { - expect( - getTypeForFieldIcon({ - type: 'string', - esTypes: ['_id'], - } as DataViewField) - ).toBe('string'); - }); -}); diff --git a/src/plugins/discover/public/utils/get_type_for_field_icon.ts b/src/plugins/discover/public/utils/get_type_for_field_icon.ts deleted file mode 100644 index 3d05e8365e59c..0000000000000 --- a/src/plugins/discover/public/utils/get_type_for_field_icon.ts +++ /dev/null @@ -1,22 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { DataViewField } from '@kbn/data-views-plugin/common'; - -/** - * Extracts the type from a data view field that will match the right icon. - * - * We define custom logic for Discover in order to distinguish between various "string" types. - */ -export const getTypeForFieldIcon = (field: DataViewField) => { - const esType = field.esTypes?.[0] || null; - if (esType && ['_id', '_index'].includes(esType)) { - return field.type; - } - return field.type === 'string' && esType ? esType : field.type; -}; diff --git a/src/plugins/files/server/audit_events.ts b/src/plugins/files/server/audit_events.ts index 98affff3c0082..702d00d946e7f 100644 --- a/src/plugins/files/server/audit_events.ts +++ b/src/plugins/files/server/audit_events.ts @@ -6,7 +6,7 @@ * Side Public License, v 1. */ -import { EcsEventOutcome } from '@kbn/ecs'; +import { EcsEvent } from '@kbn/ecs'; import { AuditEvent } from '@kbn/security-plugin/server'; export type AuditAction = 'create' | 'delete'; @@ -15,7 +15,7 @@ interface CreateAuditEventArgs { message: string; action: AuditAction; error?: Error; - outcome?: EcsEventOutcome; + outcome?: EcsEvent['outcome']; } export function createAuditEvent({ diff --git a/src/plugins/ftr_apis/README.md b/src/plugins/ftr_apis/README.md new file mode 100644 index 0000000000000..fc620c9ac4f56 --- /dev/null +++ b/src/plugins/ftr_apis/README.md @@ -0,0 +1,8 @@ +# ftrApis plugin + +This plugin exposes a set of APIs used internally during functional tests by the FTR. + +The APIs currently exposed are: +1. APIs used by the `KbnClientSavedObjects` (SO service of the FTR) + +**Remark: these APIs shouldn't be called directly for any reason** diff --git a/packages/kbn-ecs/src/ecs/agent.ts b/src/plugins/ftr_apis/jest.config.js similarity index 51% rename from packages/kbn-ecs/src/ecs/agent.ts rename to src/plugins/ftr_apis/jest.config.js index 711880d5989af..e9dd449c2e308 100644 --- a/packages/kbn-ecs/src/ecs/agent.ts +++ b/src/plugins/ftr_apis/jest.config.js @@ -6,16 +6,11 @@ * Side Public License, v 1. */ -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-agent.html - * - * @internal - */ -export interface EcsAgent { - build?: { original: string }; - ephemeral_id?: string; - id?: string; - name?: string; - type?: string; - version?: string; -} +module.exports = { + preset: '@kbn/test', + rootDir: '../../..', + roots: ['/src/plugins/ftr_apis'], + coverageDirectory: '/target/kibana-coverage/jest/src/plugins/ftr_apis', + coverageReporters: ['text', 'html'], + collectCoverageFrom: ['/src/plugins/ftr_apis/{common,public,server}/**/*.{js,ts,tsx}'], +}; diff --git a/src/plugins/ftr_apis/kibana.json b/src/plugins/ftr_apis/kibana.json new file mode 100644 index 0000000000000..44e77c3900b31 --- /dev/null +++ b/src/plugins/ftr_apis/kibana.json @@ -0,0 +1,11 @@ +{ + "id": "ftrApis", + "owner": { + "name": "Core", + "githubTeam": "kibana-core" + }, + "version": "kibana", + "configPath": ["ftr_apis"], + "server": true, + "ui": false +} diff --git a/src/plugins/ftr_apis/server/config.ts b/src/plugins/ftr_apis/server/config.ts new file mode 100644 index 0000000000000..14d2cbafed9c8 --- /dev/null +++ b/src/plugins/ftr_apis/server/config.ts @@ -0,0 +1,20 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import { schema, type TypeOf } from '@kbn/config-schema'; +import type { PluginConfigDescriptor } from '@kbn/core/server'; + +const configSchema = schema.object({ + disableApis: schema.boolean({ defaultValue: false }), +}); + +export type ConfigType = TypeOf; + +export const config: PluginConfigDescriptor = { + schema: configSchema, +}; diff --git a/packages/kbn-ecs/src/ecs/autonomous_system.ts b/src/plugins/ftr_apis/server/index.ts similarity index 57% rename from packages/kbn-ecs/src/ecs/autonomous_system.ts rename to src/plugins/ftr_apis/server/index.ts index ca9841bd4d7a7..5c33f6c4a067a 100644 --- a/packages/kbn-ecs/src/ecs/autonomous_system.ts +++ b/src/plugins/ftr_apis/server/index.ts @@ -6,12 +6,11 @@ * Side Public License, v 1. */ -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-as.html - * - * @internal - */ -export interface EcsAutonomousSystem { - number?: number; - organization?: { name: string }; +import type { PluginInitializerContext } from '@kbn/core/server'; +import { FtrApisPlugin } from './plugin'; + +export function plugin(initializerContext: PluginInitializerContext) { + return new FtrApisPlugin(initializerContext); } + +export { config } from './config'; diff --git a/src/plugins/ftr_apis/server/plugin.ts b/src/plugins/ftr_apis/server/plugin.ts new file mode 100644 index 0000000000000..42fd40212f346 --- /dev/null +++ b/src/plugins/ftr_apis/server/plugin.ts @@ -0,0 +1,28 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { CoreSetup, Plugin, PluginInitializerContext } from '@kbn/core/server'; +import { registerRoutes } from './routes'; +import type { ConfigType } from './config'; + +export class FtrApisPlugin implements Plugin { + private readonly config: ConfigType; + + constructor(initializerContext: PluginInitializerContext) { + this.config = initializerContext.config.get(); + } + + public setup({ http, savedObjects }: CoreSetup) { + const router = http.createRouter(); + if (!this.config.disableApis) { + registerRoutes(router); + } + } + + public start() {} +} diff --git a/packages/kbn-ecs/src/ecs/interface.ts b/src/plugins/ftr_apis/server/routes/index.ts similarity index 63% rename from packages/kbn-ecs/src/ecs/interface.ts rename to src/plugins/ftr_apis/server/routes/index.ts index e1129b60efd24..ae71eb3ee2673 100644 --- a/packages/kbn-ecs/src/ecs/interface.ts +++ b/src/plugins/ftr_apis/server/routes/index.ts @@ -6,13 +6,9 @@ * Side Public License, v 1. */ -/** - * https://www.elastic.co/guide/en/ecs/master/ecs-interface.html - * - * @internal - */ -export interface EcsInterface { - alias?: string; - id?: string; - name?: string; -} +import type { IRouter } from '@kbn/core/server'; +import { registerKbnClientSoRoutes } from './kbn_client_so'; + +export const registerRoutes = (router: IRouter) => { + registerKbnClientSoRoutes(router); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/bulk_delete.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/bulk_delete.ts new file mode 100644 index 0000000000000..1d0af8c799c97 --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/bulk_delete.ts @@ -0,0 +1,38 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { schema } from '@kbn/config-schema'; +import { KBN_CLIENT_API_PREFIX, listHiddenTypes, catchAndReturnBoomErrors } from './utils'; + +export const registerBulkDeleteRoute = (router: IRouter) => { + router.post( + { + path: `${KBN_CLIENT_API_PREFIX}/_bulk_delete`, + options: { + tags: ['access:ftrApis'], + }, + validate: { + body: schema.arrayOf( + schema.object({ + type: schema.string(), + id: schema.string(), + }) + ), + }, + }, + catchAndReturnBoomErrors(async (ctx, req, res) => { + const { savedObjects } = await ctx.core; + const hiddenTypes = listHiddenTypes(savedObjects.typeRegistry); + const soClient = savedObjects.getClient({ includedHiddenTypes: hiddenTypes }); + + const statuses = await soClient.bulkDelete(req.body, { force: true }); + return res.ok({ body: statuses }); + }) + ); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/create.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/create.ts new file mode 100644 index 0000000000000..479c0403aaabd --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/create.ts @@ -0,0 +1,62 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { schema } from '@kbn/config-schema'; +import { KBN_CLIENT_API_PREFIX, listHiddenTypes, catchAndReturnBoomErrors } from './utils'; + +export const registerCreateRoute = (router: IRouter) => { + router.post( + { + path: `${KBN_CLIENT_API_PREFIX}/{type}/{id?}`, + options: { + tags: ['access:ftrApis'], + }, + validate: { + params: schema.object({ + type: schema.string(), + id: schema.maybe(schema.string()), + }), + query: schema.object({ + overwrite: schema.boolean({ defaultValue: false }), + }), + body: schema.object({ + attributes: schema.recordOf(schema.string(), schema.any()), + migrationVersion: schema.maybe(schema.recordOf(schema.string(), schema.string())), + references: schema.maybe( + schema.arrayOf( + schema.object({ + name: schema.string(), + type: schema.string(), + id: schema.string(), + }) + ) + ), + }), + }, + }, + catchAndReturnBoomErrors(async (ctx, req, res) => { + const { type, id } = req.params; + const { overwrite } = req.query; + const { attributes, migrationVersion, references } = req.body; + const { savedObjects } = await ctx.core; + + const hiddenTypes = listHiddenTypes(savedObjects.typeRegistry); + const soClient = savedObjects.getClient({ includedHiddenTypes: hiddenTypes }); + + const options = { + id, + overwrite, + migrationVersion, + references, + }; + const result = await soClient.create(type, attributes, options); + return res.ok({ body: result }); + }) + ); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/delete.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/delete.ts new file mode 100644 index 0000000000000..35d16611c48dd --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/delete.ts @@ -0,0 +1,38 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { schema } from '@kbn/config-schema'; +import { KBN_CLIENT_API_PREFIX, listHiddenTypes, catchAndReturnBoomErrors } from './utils'; + +export const registerDeleteRoute = (router: IRouter) => { + router.delete( + { + path: `${KBN_CLIENT_API_PREFIX}/{type}/{id}`, + options: { + tags: ['access:ftrApis'], + }, + validate: { + params: schema.object({ + type: schema.string(), + id: schema.string(), + }), + }, + }, + catchAndReturnBoomErrors(async (ctx, req, res) => { + const { type, id } = req.params; + const { savedObjects } = await ctx.core; + + const hiddenTypes = listHiddenTypes(savedObjects.typeRegistry); + const soClient = savedObjects.getClient({ includedHiddenTypes: hiddenTypes }); + + const result = await soClient.delete(type, id, { force: true }); + return res.ok({ body: result }); + }) + ); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/find.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/find.ts new file mode 100644 index 0000000000000..4ded164377646 --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/find.ts @@ -0,0 +1,48 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { schema } from '@kbn/config-schema'; +import { KBN_CLIENT_API_PREFIX, listHiddenTypes, catchAndReturnBoomErrors } from './utils'; + +export const registerFindRoute = (router: IRouter) => { + router.get( + { + path: `${KBN_CLIENT_API_PREFIX}/_find`, + options: { + tags: ['access:ftrApis'], + }, + validate: { + query: schema.object({ + per_page: schema.number({ min: 0, defaultValue: 20 }), + page: schema.number({ min: 0, defaultValue: 1 }), + type: schema.oneOf([schema.string(), schema.arrayOf(schema.string())]), + search: schema.maybe(schema.string()), + fields: schema.maybe(schema.oneOf([schema.string(), schema.arrayOf(schema.string())])), + }), + }, + }, + catchAndReturnBoomErrors(async (ctx, req, res) => { + const query = req.query; + + const { savedObjects } = await ctx.core; + const hiddenTypes = listHiddenTypes(savedObjects.typeRegistry); + const soClient = savedObjects.getClient({ includedHiddenTypes: hiddenTypes }); + + const result = await soClient.find({ + perPage: query.per_page, + page: query.page, + type: Array.isArray(query.type) ? query.type : [query.type], + search: query.search, + fields: typeof query.fields === 'string' ? [query.fields] : query.fields, + }); + + return res.ok({ body: result }); + }) + ); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/get.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/get.ts new file mode 100644 index 0000000000000..ae03e528501a1 --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/get.ts @@ -0,0 +1,38 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { schema } from '@kbn/config-schema'; +import { KBN_CLIENT_API_PREFIX, listHiddenTypes, catchAndReturnBoomErrors } from './utils'; + +export const registerGetRoute = (router: IRouter) => { + router.get( + { + path: `${KBN_CLIENT_API_PREFIX}/{type}/{id}`, + options: { + tags: ['access:ftrApis'], + }, + validate: { + params: schema.object({ + type: schema.string(), + id: schema.string(), + }), + }, + }, + catchAndReturnBoomErrors(async (ctx, req, res) => { + const { type, id } = req.params; + const { savedObjects } = await ctx.core; + + const hiddenTypes = listHiddenTypes(savedObjects.typeRegistry); + const soClient = savedObjects.getClient({ includedHiddenTypes: hiddenTypes }); + + const object = await soClient.get(type, id); + return res.ok({ body: object }); + }) + ); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/index.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/index.ts new file mode 100644 index 0000000000000..b22f234d8455b --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/index.ts @@ -0,0 +1,24 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { registerBulkDeleteRoute } from './bulk_delete'; +import { registerCreateRoute } from './create'; +import { registerDeleteRoute } from './delete'; +import { registerFindRoute } from './find'; +import { registerGetRoute } from './get'; +import { registerUpdateRoute } from './update'; + +export const registerKbnClientSoRoutes = (router: IRouter) => { + registerBulkDeleteRoute(router); + registerCreateRoute(router); + registerDeleteRoute(router); + registerFindRoute(router); + registerGetRoute(router); + registerUpdateRoute(router); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/update.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/update.ts new file mode 100644 index 0000000000000..e6d568771631e --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/update.ts @@ -0,0 +1,53 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import type { IRouter } from '@kbn/core/server'; +import { schema } from '@kbn/config-schema'; +import { KBN_CLIENT_API_PREFIX, listHiddenTypes, catchAndReturnBoomErrors } from './utils'; + +export const registerUpdateRoute = (router: IRouter) => { + router.put( + { + path: `${KBN_CLIENT_API_PREFIX}/{type}/{id}`, + options: { + tags: ['access:ftrApis'], + }, + validate: { + params: schema.object({ + type: schema.string(), + id: schema.string(), + }), + body: schema.object({ + attributes: schema.recordOf(schema.string(), schema.any()), + migrationVersion: schema.maybe(schema.string()), + references: schema.maybe( + schema.arrayOf( + schema.object({ + name: schema.string(), + type: schema.string(), + id: schema.string(), + }) + ) + ), + }), + }, + }, + catchAndReturnBoomErrors(async (ctx, req, res) => { + const { type, id } = req.params; + const { attributes, migrationVersion, references } = req.body; + const { savedObjects } = await ctx.core; + + const hiddenTypes = listHiddenTypes(savedObjects.typeRegistry); + const soClient = savedObjects.getClient({ includedHiddenTypes: hiddenTypes }); + + const options = { version: migrationVersion, references }; + const result = await soClient.update(type, id, attributes, options); + return res.ok({ body: result }); + }) + ); +}; diff --git a/src/plugins/ftr_apis/server/routes/kbn_client_so/utils.ts b/src/plugins/ftr_apis/server/routes/kbn_client_so/utils.ts new file mode 100644 index 0000000000000..f4bab0fd7f31c --- /dev/null +++ b/src/plugins/ftr_apis/server/routes/kbn_client_so/utils.ts @@ -0,0 +1,36 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0 and the Server Side Public License, v 1; you may not use this file except + * in compliance with, at your election, the Elastic License 2.0 or the Server + * Side Public License, v 1. + */ + +import Boom from '@hapi/boom'; +import type { ISavedObjectTypeRegistry, RequestHandlerWrapper } from '@kbn/core/server'; + +export const KBN_CLIENT_API_PREFIX = '/internal/ftr/kbn_client_so'; + +export const listHiddenTypes = (registry: ISavedObjectTypeRegistry): string[] => { + return registry + .getAllTypes() + .map((type) => type.name) + .filter((typeName) => registry.isHidden(typeName)); +}; + +export const catchAndReturnBoomErrors: RequestHandlerWrapper = (handler) => { + return async (context, request, response) => { + try { + return await handler(context, request, response); + } catch (e) { + if (Boom.isBoom(e) && e.output.statusCode !== 500) { + return response.customError({ + body: e.output.payload, + statusCode: e.output.statusCode, + headers: e.output.headers as { [key: string]: string }, + }); + } + throw e; + } + }; +}; diff --git a/src/plugins/ftr_apis/tsconfig.json b/src/plugins/ftr_apis/tsconfig.json new file mode 100644 index 0000000000000..30044452e0a33 --- /dev/null +++ b/src/plugins/ftr_apis/tsconfig.json @@ -0,0 +1,19 @@ +{ + "extends": "../../../tsconfig.base.json", + "compilerOptions": { + "outDir": "target/types", + "isolatedModules": true + }, + "include": [ + "common/**/*", + "public/**/*", + "server/**/*" + ], + "exclude": [ + "target/**/*", + ], + "kbn_references": [ + "@kbn/core", + "@kbn/config-schema", + ] +} diff --git a/src/plugins/guided_onboarding/assets/panel_bg_bottom.svg b/src/plugins/guided_onboarding/assets/panel_bg_bottom.svg new file mode 100644 index 0000000000000..e2b1f7f2f643b --- /dev/null +++ b/src/plugins/guided_onboarding/assets/panel_bg_bottom.svg @@ -0,0 +1,2739 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/guided_onboarding/assets/panel_bg_bottom_dark.svg b/src/plugins/guided_onboarding/assets/panel_bg_bottom_dark.svg new file mode 100644 index 0000000000000..521500b7d1352 --- /dev/null +++ b/src/plugins/guided_onboarding/assets/panel_bg_bottom_dark.svg @@ -0,0 +1,2720 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/guided_onboarding/assets/panel_bg_top.svg b/src/plugins/guided_onboarding/assets/panel_bg_top.svg new file mode 100644 index 0000000000000..561d57f3fb773 --- /dev/null +++ b/src/plugins/guided_onboarding/assets/panel_bg_top.svg @@ -0,0 +1,573 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts b/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts index 4768d4112bcea..fe889ce580249 100644 --- a/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts +++ b/src/plugins/guided_onboarding/public/components/guide_panel.styles.ts @@ -8,6 +8,9 @@ import { EuiThemeComputed } from '@elastic/eui'; import { css } from '@emotion/react'; +import panelBgTop from '../../assets/panel_bg_top.svg'; +import panelBgBottom from '../../assets/panel_bg_bottom.svg'; +import panelBgBottomDark from '../../assets/panel_bg_bottom_dark.svg'; /** * @@ -16,16 +19,24 @@ import { css } from '@emotion/react'; * In order to leverage a11y features, we are using the EuiFlyout and applying customizations * See https://github.com/elastic/eui/issues/6241 for more details */ -export const getGuidePanelStyles = (euiTheme: EuiThemeComputed) => ({ +export const getGuidePanelStyles = ({ + euiTheme, + isDarkTheme, +}: { + euiTheme: EuiThemeComputed; + isDarkTheme: boolean; +}) => ({ setupButton: css` margin-right: ${euiTheme.size.m}; `, flyoutOverrides: { + flyoutHeader: css` + background: url(${panelBgTop}) top right no-repeat; + `, flyoutContainer: css` top: 55px !important; // Unsetting bottom and height default values to create auto height bottom: unset !important; - height: unset !important; right: calc(${euiTheme.size.s} + 128px); // Accounting for margin on button border-radius: 6px; animation: euiModal 350ms cubic-bezier(0.34, 1.61, 0.7, 1); @@ -47,8 +58,9 @@ export const getGuidePanelStyles = (euiTheme: EuiThemeComputed) => ({ `, flyoutFooter: css` border-radius: 0 0 6px 6px; - background: transparent; + background: url(${isDarkTheme ? panelBgBottomDark : panelBgBottom}) 0 7px no-repeat; padding: 24px 30px; + height: 125px; `, flyoutFooterLink: css` color: ${euiTheme.colors.darkShade}; diff --git a/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx b/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx index d9cce292ad340..7b0fd713c09cc 100644 --- a/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx +++ b/src/plugins/guided_onboarding/public/components/guide_panel.test.tsx @@ -31,10 +31,15 @@ import { mockPluginStateInProgress, } from '../services/api.mocks'; import { GuidePanel } from './guide_panel'; +import { IUiSettingsClient } from '@kbn/core/public'; const applicationMock = applicationServiceMock.createStartContract(); const notificationsMock = notificationServiceMock.createStartContract(); +const uiSettingsMock = { + get: jest.fn(), +} as unknown as IUiSettingsClient; + const mockGetResponse = (path: string, pluginState: PluginState) => { if (path === `${API_BASE_PATH}/configs/${testGuideId}`) { return Promise.resolve({ @@ -57,7 +62,12 @@ const setupComponentWithPluginStateMock = async ( const setupGuidePanelComponent = async (api: GuidedOnboardingApi) => { let testBed: TestBed; const GuidePanelComponent = () => ( - + ); await act(async () => { testBed = registerTestBed(GuidePanelComponent)(); diff --git a/src/plugins/guided_onboarding/public/components/guide_panel.tsx b/src/plugins/guided_onboarding/public/components/guide_panel.tsx index 7b84e9b586b7b..c04ba2e9e35be 100644 --- a/src/plugins/guided_onboarding/public/components/guide_panel.tsx +++ b/src/plugins/guided_onboarding/public/components/guide_panel.tsx @@ -29,7 +29,7 @@ import { import { i18n } from '@kbn/i18n'; -import { ApplicationStart, NotificationsStart } from '@kbn/core/public'; +import { ApplicationStart, NotificationsStart, IUiSettingsClient } from '@kbn/core/public'; import type { GuideState, GuideStep as GuideStepStatus } from '@kbn/guided-onboarding'; import type { GuideId, GuideConfig, StepConfig } from '@kbn/guided-onboarding'; @@ -46,6 +46,7 @@ interface GuidePanelProps { api: GuidedOnboardingApi; application: ApplicationStart; notifications: NotificationsStart; + uiSettings: IUiSettingsClient; } const getProgress = (state?: GuideState): number => { @@ -95,7 +96,7 @@ const errorSection = ( /> ); -export const GuidePanel = ({ api, application, notifications }: GuidePanelProps) => { +export const GuidePanel = ({ api, application, notifications, uiSettings }: GuidePanelProps) => { const { euiTheme } = useEuiTheme(); const [isGuideOpen, setIsGuideOpen] = useState(false); const [isQuitGuideModalOpen, setIsQuitGuideModalOpen] = useState(false); @@ -103,7 +104,8 @@ export const GuidePanel = ({ api, application, notifications }: GuidePanelProps) const [guideConfig, setGuideConfig] = useState(undefined); const [isLoading, setIsLoading] = useState(false); - const styles = getGuidePanelStyles(euiTheme); + const isDarkTheme = uiSettings.get('theme:darkMode'); + const styles = getGuidePanelStyles({ euiTheme, isDarkTheme }); const toggleGuide = () => { setIsGuideOpen((prevIsGuideOpen) => !prevIsGuideOpen); @@ -257,7 +259,7 @@ export const GuidePanel = ({ api, application, notifications }: GuidePanelProps) > {guideConfig && pluginState && pluginState.status !== 'error' ? ( <> - + {backToGuidesButton}

    diff --git a/src/plugins/guided_onboarding/public/plugin.tsx b/src/plugins/guided_onboarding/public/plugin.tsx index dee46bfb9b382..4c5e02ddac9c4 100755 --- a/src/plugins/guided_onboarding/public/plugin.tsx +++ b/src/plugins/guided_onboarding/public/plugin.tsx @@ -17,6 +17,7 @@ import { CoreTheme, ApplicationStart, NotificationsStart, + IUiSettingsClient, } from '@kbn/core/public'; import { KibanaThemeProvider } from '@kbn/kibana-react-plugin/public'; @@ -40,7 +41,7 @@ export class GuidedOnboardingPlugin core: CoreStart, { cloud }: AppPluginStartDependencies ): GuidedOnboardingPluginStart { - const { chrome, http, theme, application, notifications } = core; + const { chrome, http, theme, application, notifications, uiSettings } = core; // Initialize services apiService.setup(http, !!cloud?.isCloudEnabled); @@ -56,6 +57,7 @@ export class GuidedOnboardingPlugin api: apiService, application, notifications, + uiSettings, }), }); } @@ -74,17 +76,24 @@ export class GuidedOnboardingPlugin api, application, notifications, + uiSettings, }: { targetDomElement: HTMLElement; theme$: Rx.Observable; api: ApiService; application: ApplicationStart; notifications: NotificationsStart; + uiSettings: IUiSettingsClient; }) { ReactDOM.render( - + , targetDomElement diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts index 75bd45dba4845..ec389fda1f084 100644 --- a/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts +++ b/src/plugins/kibana_usage_collection/server/collectors/management/schema.ts @@ -518,10 +518,6 @@ export const stackManagementSchema: MakeSchemaFrom = { type: 'boolean', _meta: { description: 'Non-default value of setting.' }, }, - 'lens:useFieldExistenceSampling': { - type: 'boolean', - _meta: { description: 'Non-default value of setting.' }, - }, 'metrics:allowCheckingForFailedShards': { type: 'boolean', _meta: { description: 'Non-default value of setting.' }, diff --git a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts index ac7386e4beda1..6a0743256465f 100644 --- a/src/plugins/kibana_usage_collection/server/collectors/management/types.ts +++ b/src/plugins/kibana_usage_collection/server/collectors/management/types.ts @@ -141,7 +141,6 @@ export interface UsageStats { 'discover:rowHeightOption': number; hideAnnouncements: boolean; isDefaultIndexMigrated: boolean; - 'lens:useFieldExistenceSampling': boolean; 'metrics:allowCheckingForFailedShards': boolean; 'observability:apmLabsButton': boolean; 'observability:enableAwsLambdaMetrics': boolean; diff --git a/src/plugins/share/public/components/__snapshots__/share_context_menu.test.tsx.snap b/src/plugins/share/public/components/__snapshots__/share_context_menu.test.tsx.snap index 6bbcd15168727..a88572a99a1e3 100644 --- a/src/plugins/share/public/components/__snapshots__/share_context_menu.test.tsx.snap +++ b/src/plugins/share/public/components/__snapshots__/share_context_menu.test.tsx.snap @@ -14,7 +14,7 @@ exports[`shareContextMenuExtensions should render a custom panel title when prov urlService={Object {}} />, "id": 1, - "title": "Permalink", + "title": "Get link", }, Object { "content": , "id": 1, - "title": "Permalink", + "title": "Get link", }, Object { "content":
    @@ -113,7 +113,7 @@ exports[`shareContextMenuExtensions should sort ascending on sort order first an "data-test-subj": "sharePanel-Permalinks", "disabled": false, "icon": "link", - "name": "Permalinks", + "name": "Get links", "panel": 1, }, Object { @@ -150,7 +150,7 @@ exports[`should disable the share URL when set 1`] = ` urlService={Object {}} />, "id": 1, - "title": "Permalink", + "title": "Get link", }, Object { "content": , "id": 1, - "title": "Permalink", + "title": "Get link", }, ] } @@ -225,7 +225,7 @@ exports[`should render context menu panel when there are more than one panel 1`] urlService={Object {}} />, "id": 1, - "title": "Permalink", + "title": "Get link", }, Object { "content": { const permalinkPanel = { id: panels.length + 1, title: i18n.translate('share.contextMenu.permalinkPanelTitle', { - defaultMessage: 'Permalink', + defaultMessage: 'Get link', }), content: ( { }; menuItems.push({ name: i18n.translate('share.contextMenu.permalinksLabel', { - defaultMessage: 'Permalinks', + defaultMessage: 'Get links', }), icon: 'link', panel: permalinkPanel.id, sortOrder: 0, disabled: Boolean(this.props.disabledShareUrl), + // do not break functional tests + 'data-test-subj': 'Permalinks', }); panels.push(permalinkPanel); @@ -157,7 +159,9 @@ export class ShareContextMenu extends Component { return -1; }) .map((menuItem) => { - menuItem['data-test-subj'] = `sharePanel-${menuItem.name.replace(' ', '')}`; + menuItem['data-test-subj'] = `sharePanel-${ + menuItem['data-test-subj'] ?? menuItem.name.replace(' ', '') + }`; delete menuItem.sortOrder; return menuItem; }), diff --git a/src/plugins/share/public/components/url_panel_content.tsx b/src/plugins/share/public/components/url_panel_content.tsx index fb2de6811b4d5..f145a6ebece4e 100644 --- a/src/plugins/share/public/components/url_panel_content.tsx +++ b/src/plugins/share/public/components/url_panel_content.tsx @@ -481,7 +481,7 @@ export class UrlPanelContent extends Component { const generateLinkAsHelp = this.isNotSaved() ? ( ) : undefined; diff --git a/src/plugins/telemetry/schema/oss_plugins.json b/src/plugins/telemetry/schema/oss_plugins.json index 939f9a5d05901..1219d8c7aad4e 100644 --- a/src/plugins/telemetry/schema/oss_plugins.json +++ b/src/plugins/telemetry/schema/oss_plugins.json @@ -9036,12 +9036,6 @@ "description": "Non-default value of setting." } }, - "lens:useFieldExistenceSampling": { - "type": "boolean", - "_meta": { - "description": "Non-default value of setting." - } - }, "metrics:allowCheckingForFailedShards": { "type": "boolean", "_meta": { diff --git a/src/plugins/unified_field_list/common/index.ts b/src/plugins/unified_field_list/common/index.ts index 72274d44a7263..747db7a56bbae 100755 --- a/src/plugins/unified_field_list/common/index.ts +++ b/src/plugins/unified_field_list/common/index.ts @@ -7,4 +7,3 @@ */ export const PLUGIN_ID = 'unifiedFieldList'; -export const FIELD_EXISTENCE_SETTING = 'lens:useFieldExistenceSampling'; diff --git a/src/plugins/unified_field_list/common/utils/field_existing_utils.ts b/src/plugins/unified_field_list/common/utils/field_existing_utils.ts index 334de4aca95df..f89338404730e 100644 --- a/src/plugins/unified_field_list/common/utils/field_existing_utils.ts +++ b/src/plugins/unified_field_list/common/utils/field_existing_utils.ts @@ -19,7 +19,6 @@ export type SearchHandler = ( /** * The number of docs to sample to determine field empty status. */ -const SAMPLE_SIZE = 500; export interface Field { name: string; @@ -40,7 +39,6 @@ export async function fetchFieldExistence({ timeFieldName, includeFrozen, metaFields, - useSampling, }: { search: SearchHandler; dataView: DataView; @@ -49,24 +47,9 @@ export async function fetchFieldExistence({ toDate?: string; timeFieldName?: string; includeFrozen: boolean; - useSampling: boolean; metaFields: string[]; dataViewsService: DataViewsContract; }) { - if (useSampling) { - return legacyFetchFieldExistenceSampling({ - search, - metaFields, - dataView, - dataViewsService, - dslQuery, - fromDate, - toDate, - timeFieldName, - includeFrozen, - }); - } - const allFields = buildFieldList(dataView, metaFields); const existingFieldList = await dataViewsService.getFieldsForIndexPattern(dataView, { // filled in by data views service @@ -79,47 +62,6 @@ export async function fetchFieldExistence({ }; } -async function legacyFetchFieldExistenceSampling({ - search, - metaFields, - dataView, - dslQuery, - fromDate, - toDate, - timeFieldName, - includeFrozen, -}: { - search: SearchHandler; - metaFields: string[]; - dataView: DataView; - dataViewsService: DataViewsContract; - dslQuery: object; - fromDate?: string; - toDate?: string; - timeFieldName?: string; - includeFrozen: boolean; -}) { - const fields = buildFieldList(dataView, metaFields); - const runtimeMappings = dataView.getRuntimeMappings(); - - const docs = await fetchDataViewStats({ - search, - fromDate, - toDate, - dslQuery, - index: dataView.title, - timeFieldName: timeFieldName || dataView.timeFieldName, - fields, - runtimeMappings, - includeFrozen, - }); - - return { - indexPatternTitle: dataView.title, - existingFieldNames: legacyExistingFields(docs, fields), - }; -} - /** * Exported only for unit tests. */ @@ -138,60 +80,6 @@ export function buildFieldList(indexPattern: DataView, metaFields: string[]): Fi }); } -async function fetchDataViewStats({ - search, - index, - dslQuery, - timeFieldName, - fromDate, - toDate, - fields, - runtimeMappings, - includeFrozen, -}: { - search: SearchHandler; - index: string; - dslQuery: object; - timeFieldName?: string; - fromDate?: string; - toDate?: string; - fields: Field[]; - runtimeMappings: estypes.MappingRuntimeFields; - includeFrozen: boolean; -}) { - const query = toQuery(timeFieldName, fromDate, toDate, dslQuery); - - const scriptedFields = fields.filter((f) => f.isScript); - const response = await search({ - index, - ...(includeFrozen ? { ignore_throttled: false } : {}), - body: { - size: SAMPLE_SIZE, - query, - // Sorted queries are usually able to skip entire shards that don't match - sort: timeFieldName && fromDate && toDate ? [{ [timeFieldName]: 'desc' }] : [], - fields: ['*'], - _source: false, - runtime_mappings: runtimeMappings, - script_fields: scriptedFields.reduce((acc, field) => { - acc[field.name] = { - script: { - lang: field.lang!, - source: field.script!, - }, - }; - return acc; - }, {} as Record), - // Small improvement because there is overhead in counting - track_total_hits: false, - // Per-shard timeout, must be lower than overall. Shards return partial results on timeout - timeout: '4500ms', - }, - }); - - return response?.hits.hits; -} - function toQuery( timeFieldName: string | undefined, fromDate: string | undefined, diff --git a/src/plugins/unified_field_list/public/components/field_icon/__snapshots__/field_icon.test.tsx.snap b/src/plugins/unified_field_list/public/components/field_icon/__snapshots__/field_icon.test.tsx.snap index 89bde8769a0c7..66a9236679abc 100644 --- a/src/plugins/unified_field_list/public/components/field_icon/__snapshots__/field_icon.test.tsx.snap +++ b/src/plugins/unified_field_list/public/components/field_icon/__snapshots__/field_icon.test.tsx.snap @@ -16,13 +16,6 @@ exports[`UnifiedFieldList renders Document type properly 1`] = ` /> `; -exports[`UnifiedFieldList renders Histogram type properly 1`] = ` - -`; - exports[`UnifiedFieldList renders properly 1`] = ` ', () => { const component = shallow(); expect(component).toMatchSnapshot(); }); - - test('renders Histogram type properly', () => { - const component = shallow(); - expect(component).toMatchSnapshot(); - }); }); diff --git a/src/plugins/unified_field_list/public/components/field_icon/field_icon.tsx b/src/plugins/unified_field_list/public/components/field_icon/field_icon.tsx index 1485ebe1c8d02..070716911706c 100644 --- a/src/plugins/unified_field_list/public/components/field_icon/field_icon.tsx +++ b/src/plugins/unified_field_list/public/components/field_icon/field_icon.tsx @@ -24,8 +24,5 @@ const FieldIcon = React.memo(InnerFieldIcon) as GenericFieldIcon; export default FieldIcon; function normalizeFieldType(type: string) { - if (type === 'histogram') { - return 'number'; - } return type === 'document' ? 'number' : type; } diff --git a/src/plugins/unified_field_list/public/components/field_list_filters/field_type_filter.test.tsx b/src/plugins/unified_field_list/public/components/field_list_filters/field_type_filter.test.tsx index 01bc1c4147f15..7a9701f31a9d1 100644 --- a/src/plugins/unified_field_list/public/components/field_list_filters/field_type_filter.test.tsx +++ b/src/plugins/unified_field_list/public/components/field_list_filters/field_type_filter.test.tsx @@ -59,7 +59,7 @@ describe('UnifiedFieldList ', () => { await openPopover(wrapper, props); - expect(wrapper.find(EuiContextMenuItem)?.length).toBe(11); + expect(wrapper.find(EuiContextMenuItem)?.length).toBe(10); expect( wrapper .find(EuiContextMenuItem) @@ -67,7 +67,7 @@ describe('UnifiedFieldList ', () => { .join(', ') ).toBe( // format:type_icon type_name help_icon count - 'BooleanBooleanInfo1, ConflictConflictInfo1, DateDateInfo4, Geo pointGeo pointInfo2, Geo shapeGeo shapeInfo1, IP addressIP addressInfo1, KeywordKeywordInfo4, Murmur3Murmur3Info2, NumberNumberInfo3, StringStringInfo1, TextTextInfo5' + 'BooleanBooleanInfo1, ConflictConflictInfo1, DateDateInfo4, Geo pointGeo pointInfo2, Geo shapeGeo shapeInfo1, IP addressIP addressInfo1, KeywordKeywordInfo5, Murmur3Murmur3Info2, NumberNumberInfo3, TextTextInfo5' ); expect(props.getCustomFieldType).toHaveBeenCalledTimes(props.allFields?.length ?? 0); expect(props.onChange).not.toBeCalled(); @@ -111,7 +111,7 @@ describe('UnifiedFieldList ', () => { await openPopover(wrapper, props); const clearAllButton = findClearAllButton(wrapper, props)?.first(); - expect(wrapper.find(EuiContextMenuItem)?.length).toBe(11); + expect(wrapper.find(EuiContextMenuItem)?.length).toBe(10); expect(clearAllButton?.length).toBe(1); expect( wrapper @@ -120,7 +120,7 @@ describe('UnifiedFieldList ', () => { .join(', ') ).toBe( // format:selection_icon type_icon type_name help_icon count - 'empty-BooleanBooleanInfo1, empty-ConflictConflictInfo1, check-DateDateInfo4, empty-Geo pointGeo pointInfo2, empty-Geo shapeGeo shapeInfo1, empty-IP addressIP addressInfo1, empty-KeywordKeywordInfo4, empty-Murmur3Murmur3Info2, check-NumberNumberInfo3, empty-StringStringInfo1, empty-TextTextInfo5' + 'empty-BooleanBooleanInfo1, empty-ConflictConflictInfo1, check-DateDateInfo4, empty-Geo pointGeo pointInfo2, empty-Geo shapeGeo shapeInfo1, empty-IP addressIP addressInfo1, empty-KeywordKeywordInfo5, empty-Murmur3Murmur3Info2, check-NumberNumberInfo3, empty-TextTextInfo5' ); await toggleType(wrapper, 'boolean'); diff --git a/src/plugins/unified_field_list/public/components/field_list_grouped/field_list_grouped.test.tsx b/src/plugins/unified_field_list/public/components/field_list_grouped/field_list_grouped.test.tsx index 9190c6de2859e..7cabd28bc171d 100644 --- a/src/plugins/unified_field_list/public/components/field_list_grouped/field_list_grouped.test.tsx +++ b/src/plugins/unified_field_list/public/components/field_list_grouped/field_list_grouped.test.tsx @@ -16,6 +16,7 @@ import { ReactWrapper } from 'enzyme'; import { dataViewPluginMocks } from '@kbn/data-views-plugin/public/mocks'; import { coreMock } from '@kbn/core/public/mocks'; import FieldListGrouped, { type FieldListGroupedProps } from './field_list_grouped'; +import { FieldListFilters } from '../field_list_filters'; import { ExistenceFetchStatus } from '../../types'; import { FieldsAccordion } from './fields_accordion'; import { NoFieldsCallout } from './no_fields_callout'; @@ -68,13 +69,19 @@ describe('UnifiedFieldList + useGroupedFields()', () => { async function mountGroupedList({ listProps, hookParams }: WrapperProps): Promise { const Wrapper: React.FC = (props) => { const { + fieldListFiltersProps, fieldListGroupedProps: { fieldGroups }, } = useGroupedFields({ ...props.hookParams, services: mockedServices, }); - return ; + return ( + <> + + + + ); }; let wrapper: ReactWrapper; @@ -301,7 +308,7 @@ describe('UnifiedFieldList + useGroupedFields()', () => { ).toStrictEqual([25, 88, 0, 0]); }); - it('renders correctly when filtered', async () => { + it('renders correctly when fields are searched and filtered', async () => { const hookParams = { dataViewId: dataView.id!, allFields: manyFields, @@ -319,12 +326,12 @@ describe('UnifiedFieldList + useGroupedFields()', () => { ); await act(async () => { - await wrapper.setProps({ - hookParams: { - ...hookParams, - onFilterField: (field: DataViewField) => field.name.startsWith('@'), - }, - }); + await wrapper + .find('[data-test-subj="fieldListFiltersFieldSearch"]') + .last() + .simulate('change', { + target: { value: '@' }, + }); await wrapper.update(); }); @@ -333,17 +340,34 @@ describe('UnifiedFieldList + useGroupedFields()', () => { ); await act(async () => { - await wrapper.setProps({ - hookParams: { - ...hookParams, - onFilterField: (field: DataViewField) => field.name.startsWith('_'), - }, - }); + await wrapper + .find('[data-test-subj="fieldListFiltersFieldSearch"]') + .last() + .simulate('change', { + target: { value: '_' }, + }); + await wrapper.update(); + }); + + expect(wrapper.find(`#${defaultProps.screenReaderDescriptionId}`).first().text()).toBe( + '3 available fields. 24 unmapped fields. 0 empty fields. 3 meta fields.' + ); + + await act(async () => { + await wrapper + .find('[data-test-subj="fieldListFiltersFieldTypeFilterToggle"]') + .last() + .simulate('click'); + await wrapper.update(); + }); + + await act(async () => { + await wrapper.find('[data-test-subj="typeFilter-date"]').first().simulate('click'); await wrapper.update(); }); expect(wrapper.find(`#${defaultProps.screenReaderDescriptionId}`).first().text()).toBe( - '0 available fields. 12 unmapped fields. 0 empty fields. 3 meta fields.' + '1 available field. 4 unmapped fields. 0 empty fields. 0 meta fields.' ); }); diff --git a/src/plugins/unified_field_list/public/hooks/use_grouped_fields.test.tsx b/src/plugins/unified_field_list/public/hooks/use_grouped_fields.test.tsx index 5fa7344955b52..053e7d912d375 100644 --- a/src/plugins/unified_field_list/public/hooks/use_grouped_fields.test.tsx +++ b/src/plugins/unified_field_list/public/hooks/use_grouped_fields.test.tsx @@ -6,8 +6,7 @@ * Side Public License, v 1. */ -import { renderHook } from '@testing-library/react-hooks'; -import { act } from 'react-test-renderer'; +import { renderHook, act } from '@testing-library/react-hooks'; import { stubDataViewWithoutTimeField, stubLogstashDataView as dataView, @@ -168,6 +167,7 @@ describe('UnifiedFieldList useGroupedFields()', () => { let fieldListGroupedProps = result.current.fieldListGroupedProps; const fieldGroups = fieldListGroupedProps.fieldGroups; + const scrollToTopResetCounter1 = fieldListGroupedProps.scrollToTopResetCounter; expect( Object.keys(fieldGroups!).map( @@ -195,25 +195,26 @@ describe('UnifiedFieldList useGroupedFields()', () => { fieldListGroupedProps = result.current.fieldListGroupedProps; expect(fieldListGroupedProps.fieldsExistenceStatus).toBe(ExistenceFetchStatus.succeeded); expect(fieldListGroupedProps.fieldsExistInIndex).toBe(true); + expect(result.current.fieldListGroupedProps.scrollToTopResetCounter).not.toBe( + scrollToTopResetCounter1 + ); (ExistenceApi.useExistingFieldsReader as jest.Mock).mockRestore(); }); - it('should work correctly when filtered', async () => { + it('should work correctly when searched and filtered', async () => { const props: GroupedFieldsParams = { dataViewId: dataView.id!, allFields: allFieldsIncludingUnmapped, services: mockedServices, }; - const { result, waitForNextUpdate, rerender } = renderHook(useGroupedFields, { + const { result, waitForNextUpdate } = renderHook(useGroupedFields, { initialProps: props, }); await waitForNextUpdate(); - const fieldListGroupedProps = result.current.fieldListGroupedProps; - let fieldGroups = fieldListGroupedProps.fieldGroups; - const scrollToTopResetCounter1 = fieldListGroupedProps.scrollToTopResetCounter; + let fieldGroups = result.current.fieldListGroupedProps.fieldGroups; expect( Object.keys(fieldGroups!).map( @@ -232,9 +233,8 @@ describe('UnifiedFieldList useGroupedFields()', () => { 'MetaFields-3-3', ]); - rerender({ - ...props, - onFilterField: (field: DataViewField) => field.name.startsWith('@'), + act(() => { + result.current.fieldListFiltersProps.onChangeNameFilter('@'); }); fieldGroups = result.current.fieldListGroupedProps.fieldGroups; @@ -256,9 +256,28 @@ describe('UnifiedFieldList useGroupedFields()', () => { 'MetaFields-0-3', ]); - expect(result.current.fieldListGroupedProps.scrollToTopResetCounter).not.toBe( - scrollToTopResetCounter1 - ); + act(() => { + result.current.fieldListFiltersProps.onChangeFieldTypes(['date']); + }); + + fieldGroups = result.current.fieldListGroupedProps.fieldGroups; + + expect( + Object.keys(fieldGroups!).map( + (key) => + `${key}-${fieldGroups![key as FieldsGroupNames]?.fields.length}-${ + fieldGroups![key as FieldsGroupNames]?.fieldCount + }` + ) + ).toStrictEqual([ + 'SpecialFields-0-0', + 'SelectedFields-0-0', + 'PopularFields-0-0', + 'AvailableFields-1-25', + 'UnmappedFields-1-28', + 'EmptyFields-0-0', + 'MetaFields-0-3', + ]); }); it('should not change the scroll position if fields list is extended', async () => { diff --git a/src/plugins/unified_field_list/public/hooks/use_grouped_fields.ts b/src/plugins/unified_field_list/public/hooks/use_grouped_fields.ts index 9ac24aaa86063..1209ed64f1eb5 100644 --- a/src/plugins/unified_field_list/public/hooks/use_grouped_fields.ts +++ b/src/plugins/unified_field_list/public/hooks/use_grouped_fields.ts @@ -43,7 +43,6 @@ export interface GroupedFieldsParams { ) => Partial | undefined | null; onSupportedFieldFilter?: (field: T) => boolean; onSelectedFieldFilter?: (field: T) => boolean; - onFilterField?: (field: T) => boolean; // TODO: deprecate after integrating the unified field search and field filters into Discover } export interface GroupedFieldsResult { @@ -68,7 +67,6 @@ export function useGroupedFields({ onOverrideFieldGroupDetails, onSupportedFieldFilter, onSelectedFieldFilter, - onFilterField, }: GroupedFieldsParams): GroupedFieldsResult { const fieldsExistenceReader = useExistingFieldsReader(); const fieldListFilters = useFieldFilters({ @@ -77,7 +75,7 @@ export function useGroupedFields({ getCustomFieldType, onSupportedFieldFilter, }); - const onFilterFieldList = onFilterField ?? fieldListFilters.onFilterField; + const onFilterFieldList = fieldListFilters.onFilterField; const [dataView, setDataView] = useState(null); const isAffectedByTimeFilter = Boolean(dataView?.timeFieldName); const fieldsExistenceInfoUnavailable: boolean = dataViewId @@ -132,6 +130,10 @@ export function useGroupedFields({ if (dataView?.metaFields?.includes(field.name)) { return 'metaFields'; } + // `nested` root fields are not a part of data view fields list, so we need to check them separately + if (field.type === 'nested') { + return 'availableFields'; + } if (dataView?.getFieldByName && !dataView.getFieldByName(field.name)) { return 'unmappedFields'; } diff --git a/src/plugins/unified_field_list/public/services/field_existing/load_field_existing.ts b/src/plugins/unified_field_list/public/services/field_existing/load_field_existing.ts index f8e369838c51a..0040df5c2a4e1 100644 --- a/src/plugins/unified_field_list/public/services/field_existing/load_field_existing.ts +++ b/src/plugins/unified_field_list/public/services/field_existing/load_field_existing.ts @@ -10,7 +10,6 @@ import { IUiSettingsClient } from '@kbn/core/public'; import { DataPublicPluginStart, UI_SETTINGS } from '@kbn/data-plugin/public'; import type { DataView, DataViewsContract } from '@kbn/data-views-plugin/common'; import { lastValueFrom } from 'rxjs'; -import { FIELD_EXISTENCE_SETTING } from '../../../common'; import { fetchFieldExistence } from '../../../common/utils/field_existing_utils'; interface FetchFieldExistenceParams { @@ -40,7 +39,6 @@ export const loadFieldExisting: LoadFieldExistingHandler = async ({ dataView, }) => { const includeFrozen = uiSettingsClient.get(UI_SETTINGS.SEARCH_INCLUDE_FROZEN); - const useSampling = uiSettingsClient.get(FIELD_EXISTENCE_SETTING); const metaFields = uiSettingsClient.get(UI_SETTINGS.META_FIELDS); return await fetchFieldExistence({ @@ -50,7 +48,6 @@ export const loadFieldExisting: LoadFieldExistingHandler = async ({ timeFieldName, dataViewsService, includeFrozen, - useSampling, metaFields, dataView, search: async (params) => { diff --git a/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.test.ts b/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.test.ts index 82da142c03d3b..70f54ba84685e 100644 --- a/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.test.ts +++ b/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.test.ts @@ -43,6 +43,6 @@ describe('UnifiedFieldList getFieldIconType()', () => { type: 'string', esTypes: ['_id'], } as DataViewField) - ).toBe('string'); + ).toBe('keyword'); }); }); diff --git a/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.ts b/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.ts index ef843012e0c48..e548d4bf1744b 100644 --- a/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.ts +++ b/src/plugins/unified_field_list/public/utils/field_types/get_field_icon_type.ts @@ -22,8 +22,8 @@ export function getFieldIconType( ): string { const type = getCustomFieldType ? getCustomFieldType(field) : getFieldType(field); const esType = field.esTypes?.[0] || null; - if (esType && ['_id', '_index'].includes(esType)) { - return type; + if (esType && ['_id', '_index'].includes(esType) && type === 'string') { + return 'keyword'; } return type === 'string' && esType ? esType : type; } diff --git a/src/plugins/unified_field_list/server/plugin.ts b/src/plugins/unified_field_list/server/plugin.ts index 1171eb4c69be7..7d27861ae6b5b 100644 --- a/src/plugins/unified_field_list/server/plugin.ts +++ b/src/plugins/unified_field_list/server/plugin.ts @@ -14,7 +14,6 @@ import { PluginSetup, } from './types'; import { defineRoutes } from './routes'; -import { getUiSettings } from './ui_settings'; export class UnifiedFieldListPlugin implements Plugin @@ -27,7 +26,6 @@ export class UnifiedFieldListPlugin public setup(core: CoreSetup, plugins: PluginSetup) { this.logger.debug('unifiedFieldList: Setup'); - core.uiSettings.register(getUiSettings()); defineRoutes(core, this.logger); diff --git a/src/plugins/unified_field_list/server/routes/existing_fields.ts b/src/plugins/unified_field_list/server/routes/existing_fields.ts index e17048e217e77..9310b436b6a30 100644 --- a/src/plugins/unified_field_list/server/routes/existing_fields.ts +++ b/src/plugins/unified_field_list/server/routes/existing_fields.ts @@ -14,7 +14,6 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { fetchFieldExistence, isBoomError } from '../../common/utils/field_existing_utils'; import { FIELD_EXISTING_API_PATH } from '../../common/constants'; -import { FIELD_EXISTENCE_SETTING } from '../../common'; import { PluginStart } from '../types'; export async function existingFieldsRoute(setup: CoreSetup, logger: Logger) { @@ -40,9 +39,8 @@ export async function existingFieldsRoute(setup: CoreSetup, logger: await setup.getStartServices(); const savedObjectsClient = savedObjects.getScopedClient(req); const uiSettingsClient = uiSettings.asScopedToClient(savedObjectsClient); - const [includeFrozen, useSampling, metaFields] = await Promise.all([ + const [includeFrozen, metaFields] = await Promise.all([ uiSettingsClient.get(UI_SETTINGS.SEARCH_INCLUDE_FROZEN), - uiSettingsClient.get(FIELD_EXISTENCE_SETTING), uiSettingsClient.get(UI_SETTINGS.META_FIELDS), ]); const esClient = elasticsearch.client.asScoped(req).asCurrentUser; @@ -56,7 +54,6 @@ export async function existingFieldsRoute(setup: CoreSetup, logger: ...req.body, dataViewsService, includeFrozen, - useSampling, metaFields, dataView: await dataViewsService.get(req.params.dataViewId), search: async (params) => { diff --git a/src/plugins/unified_field_list/server/ui_settings.ts b/src/plugins/unified_field_list/server/ui_settings.ts deleted file mode 100644 index fe46b7925bfa0..0000000000000 --- a/src/plugins/unified_field_list/server/ui_settings.ts +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import { i18n } from '@kbn/i18n'; -import { schema } from '@kbn/config-schema'; - -import { UiSettingsParams } from '@kbn/core/server'; -import { FIELD_EXISTENCE_SETTING } from '../common'; - -export const getUiSettings: () => Record = () => ({ - [FIELD_EXISTENCE_SETTING]: { - name: i18n.translate('unifiedFieldList.advancedSettings.useFieldExistenceSampling.title', { - defaultMessage: 'Use field existence sampling', - }), - value: false, - description: i18n.translate( - 'unifiedFieldList.advancedSettings.useFieldExistenceSampling.description', - { - defaultMessage: - 'If enabled, document sampling is used to determine field existence (available or empty) for the Lens field list instead of relying on index mappings.', - } - ), - deprecation: { - message: i18n.translate( - 'unifiedFieldList.advancedSettings.useFieldExistenceSampling.deprecation', - { - defaultMessage: 'This setting is deprecated and will not be supported as of 8.6.', - } - ), - docLinksKey: 'visualizationSettings', - }, - category: ['visualization'], - schema: schema.boolean(), - }, -}); diff --git a/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx b/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx index 5bc71be112175..c1cb11f816535 100644 --- a/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx +++ b/src/plugins/unified_search/public/filter_bar/filter_editor/phrases_values_input.tsx @@ -55,6 +55,7 @@ class PhrasesValuesInputUI extends PhraseSuggestorUI { defaultMessage: 'Select values', })} delimiter="," + isCaseSensitive={true} options={options} getLabel={(option) => option} selectedOptions={values || []} diff --git a/test/api_integration/apis/unified_field_list/index.ts b/test/api_integration/apis/unified_field_list/index.ts index bf146349d4b1a..45b657c0e5496 100644 --- a/test/api_integration/apis/unified_field_list/index.ts +++ b/test/api_integration/apis/unified_field_list/index.ts @@ -11,7 +11,6 @@ import { FtrProviderContext } from '../../ftr_provider_context'; export default function lensApiIntegrationTests({ loadTestFile }: FtrProviderContext) { describe('UnifiedFieldList', () => { loadTestFile(require.resolve('./existing_fields')); - loadTestFile(require.resolve('./legacy_existing_fields')); loadTestFile(require.resolve('./field_stats')); }); } diff --git a/test/api_integration/apis/unified_field_list/legacy_existing_fields.ts b/test/api_integration/apis/unified_field_list/legacy_existing_fields.ts deleted file mode 100644 index 7791f45eee107..0000000000000 --- a/test/api_integration/apis/unified_field_list/legacy_existing_fields.ts +++ /dev/null @@ -1,275 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0 and the Server Side Public License, v 1; you may not use this file except - * in compliance with, at your election, the Elastic License 2.0 or the Server - * Side Public License, v 1. - */ - -import expect from '@kbn/expect'; - -import { FtrProviderContext } from '../../ftr_provider_context'; - -const TEST_START_TIME = '2015-09-19T06:31:44.000'; -const TEST_END_TIME = '2015-09-23T18:31:44.000'; -const COMMON_HEADERS = { - 'kbn-xsrf': 'some-xsrf-token', -}; - -const fieldsWithData = [ - '@message', - '@message.raw', - '@tags', - '@tags.raw', - '@timestamp', - '_id', - '_index', - 'agent', - 'agent.raw', - 'bytes', - 'clientip', - 'extension', - 'extension.raw', - 'geo.coordinates', - 'geo.dest', - 'geo.src', - 'geo.srcdest', - 'headings', - 'headings.raw', - 'host', - 'host.raw', - 'index', - 'index.raw', - 'ip', - 'links', - 'links.raw', - 'machine.os', - 'machine.os.raw', - 'machine.ram', - 'machine.ram_range', - 'memory', - 'phpmemory', - 'referer', - 'request', - 'request.raw', - 'response', - 'response.raw', - 'spaces', - 'spaces.raw', - 'type', - 'url', - 'url.raw', - 'utc_time', - 'xss', - 'xss.raw', - 'runtime_number', - - 'relatedContent.article:modified_time', - 'relatedContent.article:published_time', - 'relatedContent.article:section', - 'relatedContent.article:section.raw', - 'relatedContent.article:tag', - 'relatedContent.article:tag.raw', - 'relatedContent.og:description', - 'relatedContent.og:description.raw', - 'relatedContent.og:image', - 'relatedContent.og:image.raw', - 'relatedContent.og:image:height', - 'relatedContent.og:image:height.raw', - 'relatedContent.og:image:width', - 'relatedContent.og:image:width.raw', - 'relatedContent.og:site_name', - 'relatedContent.og:site_name.raw', - 'relatedContent.og:title', - 'relatedContent.og:title.raw', - 'relatedContent.og:type', - 'relatedContent.og:type.raw', - 'relatedContent.og:url', - 'relatedContent.og:url.raw', - 'relatedContent.twitter:card', - 'relatedContent.twitter:card.raw', - 'relatedContent.twitter:description', - 'relatedContent.twitter:description.raw', - 'relatedContent.twitter:image', - 'relatedContent.twitter:image.raw', - 'relatedContent.twitter:site', - 'relatedContent.twitter:site.raw', - 'relatedContent.twitter:title', - 'relatedContent.twitter:title.raw', - 'relatedContent.url', - 'relatedContent.url.raw', -]; - -const metricBeatData = [ - '@timestamp', - '_id', - '_index', - 'agent.ephemeral_id', - 'agent.ephemeral_id.keyword', - 'agent.hostname', - 'agent.hostname.keyword', - 'agent.id', - 'agent.id.keyword', - 'agent.type', - 'agent.type.keyword', - 'agent.version', - 'agent.version.keyword', - 'ecs.version', - 'ecs.version.keyword', - 'event.dataset', - 'event.dataset.keyword', - 'event.duration', - 'event.module', - 'event.module.keyword', - 'host.architecture', - 'host.architecture.keyword', - 'host.hostname', - 'host.hostname.keyword', - 'host.id', - 'host.id.keyword', - 'host.name', - 'host.name.keyword', - 'host.os.build', - 'host.os.build.keyword', - 'host.os.family', - 'host.os.family.keyword', - 'host.os.kernel', - 'host.os.kernel.keyword', - 'host.os.name', - 'host.os.name.keyword', - 'host.os.platform', - 'host.os.platform.keyword', - 'host.os.version', - 'host.os.version.keyword', - 'metricset.name', - 'metricset.name.keyword', - 'service.type', - 'service.type.keyword', - 'system.cpu.cores', - 'system.cpu.idle.pct', - 'system.cpu.iowait.pct', - 'system.cpu.irq.pct', - 'system.cpu.nice.pct', - 'system.cpu.softirq.pct', - 'system.cpu.steal.pct', - 'system.cpu.system.pct', - 'system.cpu.total.pct', - 'system.cpu.user.pct', -]; - -export default ({ getService }: FtrProviderContext) => { - const esArchiver = getService('esArchiver'); - const supertest = getService('supertest'); - const kibanaServer = getService('kibanaServer'); - - describe('existing_fields apis legacy', () => { - before(async () => { - await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional'); - await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/visualize/default'); - await kibanaServer.savedObjects.cleanStandardList(); - await kibanaServer.importExport.load( - 'x-pack/test/functional/fixtures/kbn_archiver/visualize/default' - ); - await kibanaServer.uiSettings.update({ - 'lens:useFieldExistenceSampling': true, - }); - }); - after(async () => { - await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional'); - await esArchiver.unload('x-pack/test/functional/es_archives/visualize/default'); - await kibanaServer.savedObjects.cleanStandardList(); - await kibanaServer.uiSettings.update({ - 'lens:useFieldExistenceSampling': false, - }); - }); - - describe('existence', () => { - it('should find which fields exist in the sample documents', async () => { - const { body } = await supertest - .post(`/api/unified_field_list/existing_fields/${encodeURIComponent('logstash-*')}`) - .set(COMMON_HEADERS) - .send({ - dslQuery: { - bool: { - filter: [{ match_all: {} }], - }, - }, - fromDate: TEST_START_TIME, - toDate: TEST_END_TIME, - }) - .expect(200); - - expect(body.indexPatternTitle).to.eql('logstash-*'); - expect(body.existingFieldNames.sort()).to.eql(fieldsWithData.sort()); - }); - - it('should succeed for thousands of fields', async () => { - const { body } = await supertest - .post(`/api/unified_field_list/existing_fields/${encodeURIComponent('metricbeat-*')}`) - .set(COMMON_HEADERS) - .send({ - dslQuery: { match_all: {} }, - fromDate: TEST_START_TIME, - toDate: TEST_END_TIME, - }) - .expect(200); - - expect(body.indexPatternTitle).to.eql('metricbeat-*'); - expect(body.existingFieldNames.sort()).to.eql(metricBeatData.sort()); - }); - - it('should return fields filtered by query and filters', async () => { - const expectedFieldNames = [ - '@message', - '@message.raw', - '@tags', - '@tags.raw', - '@timestamp', - '_id', - '_index', - 'agent', - 'agent.raw', - 'bytes', - 'clientip', - 'extension', - 'extension.raw', - 'headings', - 'headings.raw', - 'host', - 'host.raw', - 'index', - 'index.raw', - 'referer', - 'request', - 'request.raw', - 'response', - 'response.raw', - 'runtime_number', - 'spaces', - 'spaces.raw', - 'type', - 'url', - 'url.raw', - 'utc_time', - 'xss', - 'xss.raw', - ]; - - const { body } = await supertest - .post(`/api/unified_field_list/existing_fields/${encodeURIComponent('logstash-*')}`) - .set(COMMON_HEADERS) - .send({ - dslQuery: { - bool: { - filter: [{ match: { referer: 'https://www.taylorswift.com/' } }], - }, - }, - fromDate: TEST_START_TIME, - toDate: TEST_END_TIME, - }) - .expect(200); - expect(body.existingFieldNames.sort()).to.eql(expectedFieldNames.sort()); - }); - }); - }); -}; diff --git a/test/functional/apps/discover/group1/_sidebar.ts b/test/functional/apps/discover/group1/_sidebar.ts index a62a379c20224..9d0878b107073 100644 --- a/test/functional/apps/discover/group1/_sidebar.ts +++ b/test/functional/apps/discover/group1/_sidebar.ts @@ -25,6 +25,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { const monacoEditor = getService('monacoEditor'); const filterBar = getService('filterBar'); const fieldEditor = getService('fieldEditor'); + const retry = getService('retry'); + const INITIAL_FIELD_LIST_SUMMARY = '53 available fields. 0 empty fields. 3 meta fields.'; describe('discover sidebar', function describeIndexTests() { before(async function () { @@ -53,6 +55,109 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.openSidebarFieldFilter(); await PageObjects.discover.closeSidebarFieldFilter(); }); + + it('should filter by field type', async function () { + await PageObjects.header.waitUntilLoadingHasFinished(); + await PageObjects.discover.waitUntilSidebarHasLoaded(); + await PageObjects.discover.openSidebarFieldFilter(); + + expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( + INITIAL_FIELD_LIST_SUMMARY + ); + + await testSubjects.click('typeFilter-keyword'); + + await retry.waitFor('first updates', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === + '7 available fields. 0 empty fields. 2 meta fields.' + ); + }); + + await testSubjects.click('typeFilter-number'); + + await retry.waitFor('second updates', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === + '13 available fields. 0 empty fields. 3 meta fields.' + ); + }); + + await testSubjects.click('fieldListFiltersFieldTypeFilterClearAll'); + + await retry.waitFor('reset', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === INITIAL_FIELD_LIST_SUMMARY + ); + }); + }); + + it('should show filters by type in text-based view', async function () { + await kibanaServer.uiSettings.update({ 'discover:enableSql': true }); + await browser.refresh(); + + await PageObjects.discover.waitUntilSidebarHasLoaded(); + await PageObjects.discover.openSidebarFieldFilter(); + let options = await find.allByCssSelector('[data-test-subj*="typeFilter"]'); + expect(options).to.have.length(6); + await PageObjects.discover.closeSidebarFieldFilter(); + + await PageObjects.discover.selectTextBaseLang('SQL'); + + await PageObjects.discover.waitUntilSidebarHasLoaded(); + await PageObjects.discover.openSidebarFieldFilter(); + options = await find.allByCssSelector('[data-test-subj*="typeFilter"]'); + expect(options).to.have.length(3); + + expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( + '50 selected fields. 51 available fields.' + ); + + await testSubjects.click('typeFilter-number'); + + await retry.waitFor('updates', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === + '6 selected fields. 6 available fields.' + ); + }); + }); + + it('should be able to search by string', async function () { + await PageObjects.header.waitUntilLoadingHasFinished(); + await PageObjects.discover.waitUntilSidebarHasLoaded(); + + expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( + INITIAL_FIELD_LIST_SUMMARY + ); + + await PageObjects.discover.findFieldByName('i'); + + await retry.waitFor('first updates', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === + '30 available fields. 0 empty fields. 2 meta fields.' + ); + }); + + await PageObjects.discover.findFieldByName('p'); + + await retry.waitFor('second updates', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === + '4 available fields. 0 empty fields. 0 meta fields.' + ); + }); + + const fieldSearch = await testSubjects.find('clearSearchButton'); + await fieldSearch.click(); + + await retry.waitFor('reset', async () => { + return ( + (await PageObjects.discover.getSidebarAriaDescription()) === INITIAL_FIELD_LIST_SUMMARY + ); + }); + }); }); describe('field stats', function () { @@ -154,7 +259,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { ); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); }); @@ -253,7 +358,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.selectTextBaseLang('SQL'); @@ -309,7 +414,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.selectIndexPattern('with-timefield'); @@ -335,7 +440,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await kibanaServer.importExport.unload( 'test/functional/fixtures/kbn_archiver/index_pattern_without_timefield' @@ -354,7 +459,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.selectIndexPattern('without-timefield'); @@ -386,7 +491,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await kibanaServer.importExport.unload( @@ -402,7 +507,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.header.waitUntilLoadingHasFinished(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.clickFieldListItem('extension'); @@ -415,7 +520,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); // check that the filter was passed down to the sidebar @@ -433,7 +538,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.selectIndexPattern('indices-stats*'); @@ -451,7 +556,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await kibanaServer.importExport.unload( @@ -465,7 +570,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.header.waitUntilLoadingHasFinished(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.addRuntimeField( @@ -503,7 +608,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); allFields = await PageObjects.discover.getAllFieldNames(); @@ -517,7 +622,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await testSubjects.missingOrFail('discoverNoResultsError'); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.addRuntimeField('_invalid-runtimefield', `emit(‘’);`); @@ -564,7 +669,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await PageObjects.discover.waitUntilSidebarHasLoaded(); expect(await PageObjects.discover.getSidebarAriaDescription()).to.be( - '53 available fields. 0 empty fields. 3 meta fields.' + INITIAL_FIELD_LIST_SUMMARY ); await PageObjects.discover.selectIndexPattern('with-timefield'); diff --git a/test/functional/apps/discover/group2/_sql_view.ts b/test/functional/apps/discover/group2/_sql_view.ts index 4ae63f0e6b1f1..1f567ec67ddff 100644 --- a/test/functional/apps/discover/group2/_sql_view.ts +++ b/test/functional/apps/discover/group2/_sql_view.ts @@ -39,6 +39,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { describe('test', () => { it('should render sql view correctly', async function () { + await PageObjects.discover.waitUntilSidebarHasLoaded(); + expect(await testSubjects.exists('showQueryBarMenu')).to.be(true); expect(await testSubjects.exists('superDatePickerToggleQuickMenuButton')).to.be(true); expect(await testSubjects.exists('addFilter')).to.be(true); @@ -49,15 +51,15 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { expect(await testSubjects.exists('shareTopNavButton')).to.be(true); expect(await testSubjects.exists('docTableExpandToggleColumn')).to.be(true); expect(await testSubjects.exists('dataGridColumnSortingButton')).to.be(true); - expect(await testSubjects.exists('fieldFilterSearchInput')).to.be(true); - expect(await testSubjects.exists('toggleFieldFilterButton')).to.be(true); - expect(await testSubjects.exists('fieldTypesHelpButton')).to.be(true); + expect(await testSubjects.exists('fieldListFiltersFieldSearch')).to.be(true); + expect(await testSubjects.exists('fieldListFiltersFieldTypeFilterToggle')).to.be(true); await testSubjects.click('field-@message-showDetails'); expect(await testSubjects.exists('discoverFieldListPanelEdit-@message')).to.be(true); await PageObjects.discover.selectTextBaseLang('SQL'); + await PageObjects.discover.waitUntilSidebarHasLoaded(); - expect(await testSubjects.exists('fieldFilterSearchInput')).to.be(true); + expect(await testSubjects.exists('fieldListFiltersFieldSearch')).to.be(true); expect(await testSubjects.exists('unifiedTextLangEditor')).to.be(true); expect(await testSubjects.exists('superDatePickerToggleQuickMenuButton')).to.be(true); @@ -70,8 +72,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { expect(await testSubjects.exists('shareTopNavButton')).to.be(false); expect(await testSubjects.exists('docTableExpandToggleColumn')).to.be(false); expect(await testSubjects.exists('dataGridColumnSortingButton')).to.be(false); - expect(await testSubjects.exists('toggleFieldFilterButton')).to.be(false); - expect(await testSubjects.exists('fieldTypesHelpButton')).to.be(false); + expect(await testSubjects.exists('fieldListFiltersFieldTypeFilterToggle')).to.be(true); await testSubjects.click('field-@message-showDetails'); expect(await testSubjects.exists('discoverFieldListPanelEditItem')).to.be(false); }); diff --git a/test/functional/page_objects/discover_page.ts b/test/functional/page_objects/discover_page.ts index 7db95f8063c12..46d2bd94423f9 100644 --- a/test/functional/page_objects/discover_page.ts +++ b/test/functional/page_objects/discover_page.ts @@ -46,12 +46,12 @@ export class DiscoverPageObject extends FtrService { } public async findFieldByName(name: string) { - const fieldSearch = await this.testSubjects.find('fieldFilterSearchInput'); + const fieldSearch = await this.testSubjects.find('fieldListFiltersFieldSearch'); await fieldSearch.type(name); } public async clearFieldSearchInput() { - const fieldSearch = await this.testSubjects.find('fieldFilterSearchInput'); + const fieldSearch = await this.testSubjects.find('fieldListFiltersFieldSearch'); await fieldSearch.clearValue(); } @@ -598,7 +598,13 @@ export class DiscoverPageObject extends FtrService { } await this.waitUntilFieldPopoverIsOpen(); - await this.testSubjects.click(`fieldVisualize-${fieldName}`); + const visualizeButtonTestSubject = `fieldVisualize-${fieldName}`; + // wrap visualize button click in retry to ensure button is clicked and retry if button click is not registered + await this.retry.try(async () => { + await this.testSubjects.click(visualizeButtonTestSubject); + await this.testSubjects.waitForDeleted(visualizeButtonTestSubject); + await this.testSubjects.missingOrFail(visualizeButtonTestSubject); + }); await this.header.waitUntilLoadingHasFinished(); } @@ -665,15 +671,15 @@ export class DiscoverPageObject extends FtrService { } public async openSidebarFieldFilter() { - await this.testSubjects.click('toggleFieldFilterButton'); - await this.testSubjects.existOrFail('filterSelectionPanel'); + await this.testSubjects.click('fieldListFiltersFieldTypeFilterToggle'); + await this.testSubjects.existOrFail('fieldListFiltersFieldTypeFilterOptions'); } public async closeSidebarFieldFilter() { - await this.testSubjects.click('toggleFieldFilterButton'); + await this.testSubjects.click('fieldListFiltersFieldTypeFilterToggle'); await this.retry.waitFor('sidebar filter closed', async () => { - return !(await this.testSubjects.exists('filterSelectionPanel')); + return !(await this.testSubjects.exists('fieldListFiltersFieldTypeFilterOptions')); }); } diff --git a/test/functional/services/listing_table.ts b/test/functional/services/listing_table.ts index ce210be9d222e..96e9ba2e49d34 100644 --- a/test/functional/services/listing_table.ts +++ b/test/functional/services/listing_table.ts @@ -20,6 +20,12 @@ export class ListingTableService extends FtrService { private readonly common = this.ctx.getPageObject('common'); private readonly header = this.ctx.getPageObject('header'); + private readonly tagPopoverToggle = this.ctx.getService('menuToggle').create({ + name: 'Tag Popover', + menuTestSubject: 'tagSelectableList', + toggleButtonTestSubject: 'tagFilterPopoverButton', + }); + private async getSearchFilter() { return await this.testSubjects.find('tableListSearchBox'); } @@ -72,6 +78,7 @@ export class ListingTableService extends FtrService { } else { throw new Error('Waiting'); } + await this.header.waitUntilLoadingHasFinished(); }); } @@ -92,12 +99,35 @@ export class ListingTableService extends FtrService { ); if (morePages) { await this.testSubjects.click('pagerNextButton'); - await this.header.waitUntilLoadingHasFinished(); + await this.waitUntilTableIsLoaded(); } } return visualizationNames; } + /** + * Select tags in the searchbar's tag filter. + */ + public async selectFilterTags(...tagNames: string[]): Promise { + await this.openTagPopover(); + // select the tags + for (const tagName of tagNames) { + await this.testSubjects.click(`tag-searchbar-option-${tagName.replace(' ', '_')}`); + } + await this.closeTagPopover(); + await this.waitUntilTableIsLoaded(); + } + + public async openTagPopover(): Promise { + this.log.debug('ListingTable.openTagPopover'); + await this.tagPopoverToggle.open(); + } + + public async closeTagPopover(): Promise { + this.log.debug('ListingTable.closeTagPopover'); + await this.tagPopoverToggle.close(); + } + /** * Navigates through all pages on Landing page and returns array of items names */ @@ -112,7 +142,7 @@ export class ListingTableService extends FtrService { ); if (morePages) { await this.testSubjects.click('pagerNextButton'); - await this.header.waitUntilLoadingHasFinished(); + await this.waitUntilTableIsLoaded(); } } return visualizationNames; @@ -154,7 +184,7 @@ export class ListingTableService extends FtrService { await this.common.pressEnterKey(); }); - await this.header.waitUntilLoadingHasFinished(); + await this.waitUntilTableIsLoaded(); } /** diff --git a/tsconfig.base.json b/tsconfig.base.json index 1d3dd3cd33b82..fd9ea4a507cc5 100644 --- a/tsconfig.base.json +++ b/tsconfig.base.json @@ -698,6 +698,8 @@ "@kbn/fleet-plugin/*": ["x-pack/plugins/fleet/*"], "@kbn/flot-charts": ["packages/kbn-flot-charts"], "@kbn/flot-charts/*": ["packages/kbn-flot-charts/*"], + "@kbn/ftr-apis-plugin": ["src/plugins/ftr_apis"], + "@kbn/ftr-apis-plugin/*": ["src/plugins/ftr_apis/*"], "@kbn/ftr-common-functional-services": ["packages/kbn-ftr-common-functional-services"], "@kbn/ftr-common-functional-services/*": ["packages/kbn-ftr-common-functional-services/*"], "@kbn/ftr-screenshot-filename": ["packages/kbn-ftr-screenshot-filename"], diff --git a/versions.json b/versions.json index 759e3dbed0e2b..c061ee7c10f00 100644 --- a/versions.json +++ b/versions.json @@ -8,7 +8,7 @@ "currentMinor": true }, { - "version": "8.6.1", + "version": "8.6.2", "branch": "8.6", "currentMajor": true, "previousMinor": true diff --git a/x-pack/plugins/actions/docs/openapi/bundled.json b/x-pack/plugins/actions/docs/openapi/bundled.json index 0919fea40668b..d887c6de5a3e4 100644 --- a/x-pack/plugins/actions/docs/openapi/bundled.json +++ b/x-pack/plugins/actions/docs/openapi/bundled.json @@ -134,20 +134,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "error": { - "type": "string", - "example": "Unauthorized" - }, - "message": { - "type": "string" - }, - "statusCode": { - "type": "integer", - "example": 401 - } - } + "$ref": "#/components/schemas/401_response" } } } @@ -202,20 +189,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "error": { - "type": "string", - "example": "Unauthorized" - }, - "message": { - "type": "string" - }, - "statusCode": { - "type": "integer", - "example": 401 - } - } + "$ref": "#/components/schemas/401_response" } } } @@ -278,20 +252,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "error": { - "type": "string", - "example": "Unauthorized" - }, - "message": { - "type": "string" - }, - "statusCode": { - "type": "integer", - "example": 401 - } - } + "$ref": "#/components/schemas/401_response" } } } @@ -430,20 +391,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "error": { - "type": "string", - "example": "Unauthorized" - }, - "message": { - "type": "string" - }, - "statusCode": { - "type": "integer", - "example": 401 - } - } + "$ref": "#/components/schemas/401_response" } } } @@ -453,21 +401,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "error": { - "type": "string", - "example": "Not Found" - }, - "message": { - "type": "string", - "example": "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found" - }, - "statusCode": { - "type": "integer", - "example": 404 - } - } + "$ref": "#/components/schemas/404_response" } } } @@ -568,20 +502,7 @@ "content": { "application/json": { "schema": { - "type": "object", - "properties": { - "error": { - "type": "string", - "example": "Unauthorized" - }, - "message": { - "type": "string" - }, - "statusCode": { - "type": "integer", - "example": 401 - } - } + "$ref": "#/components/schemas/401_response" } } } @@ -685,23 +606,200 @@ }, "401": { "description": "Authorization information is missing or invalid.", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/401_response" + } + } + } + } + }, + "servers": [ + { + "url": "https://localhost:5601" + } + ] + }, + "servers": [ + { + "url": "https://localhost:5601" + } + ] + }, + "/s/{spaceId}/api/actions/connector/{connectorId}/_execute": { + "post": { + "summary": "Runs a connector.", + "operationId": "runConnector", + "description": "You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges.\n", + "tags": [ + "connectors" + ], + "parameters": [ + { + "$ref": "#/components/parameters/kbn_xsrf" + }, + { + "$ref": "#/components/parameters/connector_id" + }, + { + "$ref": "#/components/parameters/space_id" + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "title": "Run connector request body properties", + "description": "The properties vary depending on the connector type.", + "type": "object", + "required": [ + "params" + ], + "properties": { + "params": { + "oneOf": [ + { + "$ref": "#/components/schemas/run_connector_params_documents" + }, + { + "$ref": "#/components/schemas/run_connector_params_level_message" + }, + { + "title": "Subaction parameters", + "description": "Test an action that involves a subaction.", + "oneOf": [ + { + "$ref": "#/components/schemas/run_connector_subaction_addevent" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_closealert" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_createalert" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_fieldsbyissuetype" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_getchoices" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_getfields" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_getincident" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_issue" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_issues" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_issuetypes" + }, + { + "$ref": "#/components/schemas/run_connector_subaction_pushtoservice" + } + ], + "discriminator": { + "propertyName": "subAction" + } + } + ] + } + } + }, + "examples": { + "runIndexConnectorRequest": { + "$ref": "#/components/examples/run_index_connector_request" + }, + "runJiraConnectorRequest": { + "$ref": "#/components/examples/run_jira_connector_request" + }, + "runServerLogConnectorRequest": { + "$ref": "#/components/examples/run_server_log_connector_request" + }, + "runServiceNowITOMConnectorRequest": { + "$ref": "#/components/examples/run_servicenow_itom_connector_request" + }, + "runSwimlaneConnectorRequest": { + "$ref": "#/components/examples/run_swimlane_connector_request" + } + } + } + } + }, + "responses": { + "200": { + "description": "Indicates a successful call.", "content": { "application/json": { "schema": { "type": "object", + "required": [ + "connector_id", + "status" + ], "properties": { - "error": { + "connector_id": { "type": "string", - "example": "Unauthorized" + "description": "The identifier for the connector." }, - "message": { - "type": "string" + "data": { + "oneOf": [ + { + "type": "object", + "description": "Information returned from the action.", + "additionalProperties": true + }, + { + "type": "array", + "description": "An array of information returned from the action.", + "items": { + "type": "object" + } + } + ] }, - "statusCode": { - "type": "integer", - "example": 401 + "status": { + "type": "string", + "description": "The status of the action.", + "enum": [ + "error", + "ok" + ] } } + }, + "examples": { + "runIndexConnectorResponse": { + "$ref": "#/components/examples/run_index_connector_response" + }, + "runJiraConnectorResponse": { + "$ref": "#/components/examples/run_jira_connector_response" + }, + "runServerLogConnectorResponse": { + "$ref": "#/components/examples/run_server_log_connector_response" + }, + "runServiceNowITOMConnectorResponse": { + "$ref": "#/components/examples/run_servicenow_itom_connector_response" + }, + "runSwimlaneConnectorResponse": { + "$ref": "#/components/examples/run_swimlane_connector_response" + } + } + } + } + }, + "401": { + "description": "Authorization information is missing or invalid.", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/401_response" } } } @@ -2741,6 +2839,29 @@ "propertyName": "connector_type_id" } }, + "401_response": { + "type": "object", + "title": "Unsuccessful rule API response", + "properties": { + "error": { + "type": "string", + "example": "Unauthorized", + "enum": [ + "Unauthorized" + ] + }, + "message": { + "type": "string" + }, + "statusCode": { + "type": "integer", + "example": 401, + "enum": [ + 401 + ] + } + } + }, "update_connector_request_cases_webhook": { "title": "Update Webhook - Case Managment connector request", "type": "object", @@ -2919,6 +3040,29 @@ } } }, + "404_response": { + "type": "object", + "properties": { + "error": { + "type": "string", + "example": "Not Found", + "enum": [ + "Not Found" + ] + }, + "message": { + "type": "string", + "example": "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found" + }, + "statusCode": { + "type": "integer", + "example": 404, + "enum": [ + 404 + ] + } + } + }, "connector_types": { "title": "Connector types", "type": "string", @@ -2953,67 +3097,749 @@ "uptime", "siem" ] - } - }, - "examples": { - "create_index_connector_request": { - "summary": "Create an index connector.", - "value": { - "name": "my-connector", - "connector_type_id": ".index", - "config": { - "index": "test-index" + }, + "run_connector_params_documents": { + "title": "Index connector parameters", + "description": "Test an action that indexes a document into Elasticsearch.", + "type": "object", + "required": [ + "documents" + ], + "properties": { + "documents": { + "type": "array", + "description": "The documents in JSON format for index connectors.", + "items": { + "type": "object", + "additionalProperties": true + } } } }, - "create_index_connector_response": { - "summary": "A new index connector.", - "value": { - "id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad", - "connector_type_id": ".index", - "name": "my-connector", - "config": { - "index": "test-index", - "refresh": false, - "executionTimeField": null + "run_connector_params_level_message": { + "title": "Server log connector parameters", + "description": "Test an action that writes an entry to the Kibana server log.", + "type": "object", + "required": [ + "message" + ], + "properties": { + "level": { + "type": "string", + "description": "The log level of the message for server log connectors.", + "enum": [ + "debug", + "error", + "fatal", + "info", + "trace", + "warn" + ], + "default": "info" }, - "is_preconfigured": false, - "is_deprecated": false, - "is_missing_secrets": false - } - }, - "get_connector_response": { - "summary": "A list of connector types", - "value": { - "id": "df770e30-8b8b-11ed-a780-3b746c987a81", - "name": "my_server_log_connector", - "config": {}, - "connector_type_id": ".server-log", - "is_preconfigured": false, - "is_deprecated": false, - "is_missing_secrets": false - } - }, - "update_index_connector_request": { - "summary": "Update an index connector.", - "value": { - "name": "updated-connector", - "config": { - "index": "updated-index" + "message": { + "type": "string", + "description": "The message for server log connectors." } } }, - "get_connectors_response": { - "summary": "A list of connectors", - "value": [ - { - "id": "preconfigured-email-connector", - "name": "my-preconfigured-email-notification", - "connector_type_id": ".email", - "is_preconfigured": true, - "is_deprecated": false, - "referenced_by_count": 0 - }, + "run_connector_subaction_addevent": { + "title": "The addEvent subaction", + "type": "object", + "required": [ + "subAction" + ], + "description": "The `addEvent` subaction for ServiceNow ITOM connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "addEvent" + ] + }, + "subActionParams": { + "type": "object", + "description": "The set of configuration properties for the action.", + "properties": { + "additional_info": { + "type": "string", + "description": "Additional information about the event." + }, + "description": { + "type": "string", + "description": "The details about the event." + }, + "event_class": { + "type": "string", + "description": "A specific instance of the source." + }, + "message_key": { + "type": "string", + "description": "All actions sharing this key are associated with the same ServiceNow alert. The default value is `:`." + }, + "metric_name": { + "type": "string", + "description": "The name of the metric." + }, + "node": { + "type": "string", + "description": "The host that the event was triggered for." + }, + "resource": { + "type": "string", + "description": "The name of the resource." + }, + "severity": { + "type": "string", + "description": "The severity of the event." + }, + "source": { + "type": "string", + "description": "The name of the event source type." + }, + "time_of_event": { + "type": "string", + "description": "The time of the event." + }, + "type": { + "type": "string", + "description": "The type of event." + } + } + } + } + }, + "run_connector_subaction_closealert": { + "title": "The closeAlert subaction", + "type": "object", + "required": [ + "subAction", + "subActionParams" + ], + "description": "The `closeAlert` subaction for Opsgenie connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "closeAlert" + ] + }, + "subActionParams": { + "type": "object", + "required": [ + "alias" + ], + "properties": { + "alias": { + "type": "string", + "description": "The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert." + }, + "note": { + "type": "string", + "description": "Additional information for the alert." + }, + "source": { + "type": "string", + "description": "The display name for the source of the alert." + }, + "user": { + "type": "string", + "description": "The display name for the owner." + } + } + } + } + }, + "run_connector_subaction_createalert": { + "title": "The createAlert subaction", + "type": "object", + "required": [ + "subAction", + "subActionParams" + ], + "description": "The `createAlert` subaction for Opsgenie connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "createAlert" + ] + }, + "subActionParams": { + "type": "object", + "required": [ + "message" + ], + "properties": { + "actions": { + "type": "array", + "description": "The custom actions available to the alert.", + "items": { + "type": "string" + } + }, + "alias": { + "type": "string", + "description": "The unique identifier used for alert deduplication in Opsgenie." + }, + "description": { + "type": "string", + "description": "A description that provides detailed information about the alert." + }, + "details": { + "type": "object", + "description": "The custom properties of the alert.", + "additionalProperties": true, + "example": { + "key1": "value1", + "key2": "value2" + } + }, + "entity": { + "type": "string", + "description": "The domain of the alert. For example, the application or server name." + }, + "message": { + "type": "string", + "description": "The alert message." + }, + "note": { + "type": "string", + "description": "Additional information for the alert." + }, + "priority": { + "type": "string", + "description": "The priority level for the alert.", + "enum": [ + "P1", + "P2", + "P3", + "P4", + "P5" + ] + }, + "responders": { + "type": "array", + "description": "The entities to receive notifications about the alert. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.\n", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string", + "description": "The identifier for the entity." + }, + "name": { + "type": "string", + "description": "The name of the entity." + }, + "type": { + "type": "string", + "description": "The type of responders, in this case `escalation`.", + "enum": [ + "escalation", + "schedule", + "team", + "user" + ] + }, + "username": { + "type": "string", + "description": "A valid email address for the user." + } + } + } + }, + "source": { + "type": "string", + "description": "The display name for the source of the alert." + }, + "tags": { + "type": "array", + "description": "The tags for the alert.", + "items": { + "type": "string" + } + }, + "user": { + "type": "string", + "description": "The display name for the owner." + }, + "visibleTo": { + "type": "array", + "description": "The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required.", + "items": { + "type": "object", + "required": [ + "type" + ], + "properties": { + "id": { + "type": "string", + "description": "The identifier for the entity." + }, + "name": { + "type": "string", + "description": "The name of the entity." + }, + "type": { + "type": "string", + "description": "Valid values are `team` and `user`.", + "enum": [ + "team", + "user" + ] + }, + "username": { + "type": "string", + "description": "The user name. This property is required only when the `type` is `user`." + } + } + } + } + } + } + } + }, + "run_connector_subaction_fieldsbyissuetype": { + "title": "The fieldsByIssueType subaction", + "type": "object", + "required": [ + "subAction", + "subActionParams" + ], + "description": "The `fieldsByIssueType` subaction for Jira connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "fieldsByIssueType" + ] + }, + "subActionParams": { + "type": "object", + "required": [ + "id" + ], + "properties": { + "id": { + "type": "string", + "description": "The Jira issue type identifier.", + "example": 10024 + } + } + } + } + }, + "run_connector_subaction_getchoices": { + "title": "The getChoices subaction", + "type": "object", + "required": [ + "subAction", + "subActionParams" + ], + "description": "The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "getChoices" + ] + }, + "subActionParams": { + "type": "object", + "description": "The set of configuration properties for the action.", + "required": [ + "fields" + ], + "properties": { + "fields": { + "type": "array", + "description": "An array of fields.", + "items": { + "type": "string" + } + } + } + } + } + }, + "run_connector_subaction_getfields": { + "title": "The getFields subaction", + "type": "object", + "required": [ + "subAction" + ], + "description": "The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "getFields" + ] + } + } + }, + "run_connector_subaction_getincident": { + "title": "The getIncident subaction", + "type": "object", + "description": "The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.", + "required": [ + "subAction", + "subActionParams" + ], + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "getIncident" + ] + }, + "subActionParams": { + "type": "object", + "required": [ + "externalId" + ], + "properties": { + "externalId": { + "type": "string", + "description": "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.", + "example": 71778 + } + } + } + } + }, + "run_connector_subaction_issue": { + "title": "The issue subaction", + "type": "object", + "required": [ + "subAction" + ], + "description": "The `issue` subaction for Jira connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "issue" + ] + }, + "subActionParams": { + "type": "object", + "required": [ + "id" + ], + "properties": { + "id": { + "type": "string", + "description": "The Jira issue identifier.", + "example": 71778 + } + } + } + } + }, + "run_connector_subaction_issues": { + "title": "The issues subaction", + "type": "object", + "required": [ + "subAction", + "subActionParams" + ], + "description": "The `issues` subaction for Jira connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "issues" + ] + }, + "subActionParams": { + "type": "object", + "required": [ + "title" + ], + "properties": { + "title": { + "type": "string", + "description": "The title of the Jira issue." + } + } + } + } + }, + "run_connector_subaction_issuetypes": { + "title": "The issueTypes subaction", + "type": "object", + "required": [ + "subAction" + ], + "description": "The `issueTypes` subaction for Jira connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "issueTypes" + ] + } + } + }, + "run_connector_subaction_pushtoservice": { + "title": "The pushToService subaction", + "type": "object", + "required": [ + "subAction", + "subActionParams" + ], + "description": "The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors.", + "properties": { + "subAction": { + "type": "string", + "description": "The action to test.", + "enum": [ + "pushToService" + ] + }, + "subActionParams": { + "type": "object", + "description": "The set of configuration properties for the action.", + "properties": { + "comments": { + "type": "array", + "description": "Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane.", + "items": { + "type": "object", + "properties": { + "comment": { + "type": "string", + "description": "A comment related to the incident. For example, describe how to troubleshoot the issue." + }, + "commentId": { + "type": "integer", + "description": "A unique identifier for the comment." + } + } + } + }, + "incident": { + "type": "object", + "description": "Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident.", + "properties": { + "alertId": { + "type": "string", + "description": "The alert identifier for Swimlane connectors." + }, + "caseId": { + "type": "string", + "description": "The case identifier for the incident for Swimlane connectors." + }, + "caseName": { + "type": "string", + "description": "The case name for the incident for Swimlane connectors." + }, + "category": { + "type": "string", + "description": "The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors." + }, + "correlation_display": { + "type": "string", + "description": "A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors." + }, + "correlation_id": { + "type": "string", + "description": "The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.\n" + }, + "description": { + "type": "string", + "description": "The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors." + }, + "dest_ip": { + "description": "A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.\n", + "oneOf": [ + { + "type": "string" + }, + { + "type": "array", + "items": { + "type": "string" + } + } + ] + }, + "externalId": { + "type": "string", + "description": "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.\n" + }, + "impact": { + "type": "string", + "description": "The impact of the incident for ServiceNow ITSM connectors." + }, + "issueType": { + "type": "integer", + "description": "The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`." + }, + "labels": { + "type": "array", + "items": { + "type": "string" + }, + "description": "The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.\n" + }, + "malware_hash": { + "description": "A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.", + "oneOf": [ + { + "type": "string" + }, + { + "type": "array", + "items": { + "type": "string" + } + } + ] + }, + "malware_url": { + "type": "string", + "description": "A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.", + "oneOf": [ + { + "type": "string" + }, + { + "type": "array", + "items": { + "type": "string" + } + } + ] + }, + "parent": { + "type": "string", + "description": "The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues." + }, + "priority": { + "type": "string", + "description": "The priority of the incident in Jira and ServiceNow SecOps connectors." + }, + "ruleName": { + "type": "string", + "description": "The rule name for Swimlane connectors." + }, + "severity": { + "type": "string", + "description": "The severity of the incident for ServiceNow ITSM and Swimlane connectors." + }, + "short_description": { + "type": "string", + "description": "A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.\n" + }, + "source_ip": { + "description": "A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.", + "oneOf": [ + { + "type": "string" + }, + { + "type": "array", + "items": { + "type": "string" + } + } + ] + }, + "subcategory": { + "type": "string", + "description": "The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors." + }, + "summary": { + "type": "string", + "description": "A summary of the incident for Jira connectors." + }, + "title": { + "type": "string", + "description": "A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base.\n" + }, + "urgency": { + "type": "string", + "description": "The urgency of the incident for ServiceNow ITSM connectors." + } + } + } + } + } + } + } + }, + "examples": { + "create_index_connector_request": { + "summary": "Create an index connector.", + "value": { + "name": "my-connector", + "connector_type_id": ".index", + "config": { + "index": "test-index" + } + } + }, + "create_index_connector_response": { + "summary": "A new index connector.", + "value": { + "id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad", + "connector_type_id": ".index", + "name": "my-connector", + "config": { + "index": "test-index", + "refresh": false, + "executionTimeField": null + }, + "is_preconfigured": false, + "is_deprecated": false, + "is_missing_secrets": false + } + }, + "get_connector_response": { + "summary": "A list of connector types", + "value": { + "id": "df770e30-8b8b-11ed-a780-3b746c987a81", + "name": "my_server_log_connector", + "config": {}, + "connector_type_id": ".server-log", + "is_preconfigured": false, + "is_deprecated": false, + "is_missing_secrets": false + } + }, + "update_index_connector_request": { + "summary": "Update an index connector.", + "value": { + "name": "updated-connector", + "config": { + "index": "updated-index" + } + } + }, + "get_connectors_response": { + "summary": "A list of connectors", + "value": [ + { + "id": "preconfigured-email-connector", + "name": "my-preconfigured-email-notification", + "connector_type_id": ".email", + "is_preconfigured": true, + "is_deprecated": false, + "referenced_by_count": 0 + }, { "id": "e07d0c80-8b8b-11ed-a780-3b746c987a81", "name": "my-index-connector", @@ -3072,6 +3898,223 @@ ] } ] + }, + "run_index_connector_request": { + "summary": "Run an index connector.", + "value": { + "params": { + "documents": [ + { + "id": "my_doc_id", + "name": "my_doc_name", + "message": "hello, world" + } + ] + } + } + }, + "run_jira_connector_request": { + "summary": "Run a Jira connector to retrieve the list of issue types.", + "value": { + "params": { + "subAction": "issueTypes" + } + } + }, + "run_server_log_connector_request": { + "summary": "Run a server log connector.", + "value": { + "params": { + "level": "warn", + "message": "Test warning message." + } + } + }, + "run_servicenow_itom_connector_request": { + "summary": "Run a ServiceNow ITOM connector to retrieve the list of choices.", + "value": { + "params": { + "subAction": "getChoices", + "subActionParams": { + "fields": [ + "severity", + "urgency" + ] + } + } + } + }, + "run_swimlane_connector_request": { + "summary": "Run a Swimlane connector to create an incident.", + "value": { + "params": { + "subAction": "pushToService", + "subActionParams": { + "comments": [ + { + "commentId": 1, + "comment": "A comment about the incident." + } + ], + "incident": { + "caseId": "1000", + "caseName": "Case name", + "description": "Description of the incident." + } + } + } + } + }, + "run_index_connector_response": { + "summary": "Response from running an index connector.", + "value": { + "connector_id": "fd38c600-96a5-11ed-bb79-353b74189cba", + "data": { + "errors": false, + "items": [ + { + "create": { + "_id": "4JtvwYUBrcyxt2NnfW3y", + "_index": "my-index", + "_primary_term": 1, + "_seq_no": 0, + "_shards": { + "failed": 0, + "successful": 1, + "total": 2 + }, + "_version": 1, + "result": "created", + "status": 201 + } + } + ], + "took": 135 + }, + "status": "ok" + } + }, + "run_jira_connector_response": { + "summary": "Response from retrieving the list of issue types for a Jira connector.", + "value": { + "connector_id": "b3aad810-edbe-11ec-82d1-11348ecbf4a6", + "data": [ + { + "id": 10024, + "name": "Improvement" + }, + { + "id": 10006, + "name": "Task" + }, + { + "id": 10007, + "name": "Sub-task" + }, + { + "id": 10025, + "name": "New Feature" + }, + { + "id": 10023, + "name": "Bug" + }, + { + "id": 10000, + "name": "Epic" + } + ], + "status": "ok" + } + }, + "run_server_log_connector_response": { + "summary": "Response from running a server log connector.", + "value": { + "connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907", + "status": "ok" + } + }, + "run_servicenow_itom_connector_response": { + "summary": "Response from retrieving the list of choices for a ServiceNow ITOM connector.", + "value": { + "connector_id": "9d9be270-2fd2-11ed-b0e0-87533c532698", + "data": [ + { + "dependent_value": "", + "element": "severity", + "label": "Critical", + "value": 1 + }, + { + "dependent_value": "", + "element": "severity", + "label": "Major", + "value": 2 + }, + { + "dependent_value": "", + "element": "severity", + "label": "Minor", + "value": 3 + }, + { + "dependent_value": "", + "element": "severity", + "label": "Warning", + "value": 4 + }, + { + "dependent_value": "", + "element": "severity", + "label": "OK", + "value": 5 + }, + { + "dependent_value": "", + "element": "severity", + "label": "Clear", + "value": 0 + }, + { + "dependent_value": "", + "element": "urgency", + "label": "1 - High", + "value": 1 + }, + { + "dependent_value": "", + "element": "urgency", + "label": "2 - Medium", + "value": 2 + }, + { + "dependent_value": "", + "element": "urgency", + "label": "3 - Low", + "value": 3 + } + ], + "status": "ok" + } + }, + "run_swimlane_connector_response": { + "summary": "Response from creating a Swimlane incident.", + "value": { + "connector_id": "a4746470-2f94-11ed-b0e0-87533c532698", + "data": { + "id": "aKPmBHWzmdRQtx6Mx", + "title": "TEST-457", + "url": "https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx", + "pushedDate": "2022-09-08T16:52:27.866Z", + "comments": [ + { + "commentId": 1, + "pushedDate": "2022-09-08T16:52:27.865Z" + } + ] + }, + "status": "ok" + } } } }, diff --git a/x-pack/plugins/actions/docs/openapi/bundled.yaml b/x-pack/plugins/actions/docs/openapi/bundled.yaml index 1ffc0dc5da1eb..1652412e027e4 100644 --- a/x-pack/plugins/actions/docs/openapi/bundled.yaml +++ b/x-pack/plugins/actions/docs/openapi/bundled.yaml @@ -71,16 +71,7 @@ paths: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '#/components/schemas/401_response' servers: - url: https://localhost:5601 servers: @@ -111,16 +102,7 @@ paths: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '#/components/schemas/401_response' '404': description: Object is not found. content: @@ -158,16 +140,7 @@ paths: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '#/components/schemas/401_response' '404': description: Object is not found. content: @@ -245,32 +218,13 @@ paths: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '#/components/schemas/401_response' '404': description: Object is not found. content: application/json: schema: - type: object - properties: - error: - type: string - example: Not Found - message: - type: string - example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found - statusCode: - type: integer - example: 404 + $ref: '#/components/schemas/404_response' servers: - url: https://localhost:5601 servers: @@ -338,16 +292,7 @@ paths: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '#/components/schemas/401_response' servers: - url: https://localhost:5601 servers: @@ -415,19 +360,114 @@ paths: $ref: '#/components/examples/get_connector_types_response' '401': description: Authorization information is missing or invalid. + content: + application/json: + schema: + $ref: '#/components/schemas/401_response' + servers: + - url: https://localhost:5601 + servers: + - url: https://localhost:5601 + /s/{spaceId}/api/actions/connector/{connectorId}/_execute: + post: + summary: Runs a connector. + operationId: runConnector + description: | + You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges. + tags: + - connectors + parameters: + - $ref: '#/components/parameters/kbn_xsrf' + - $ref: '#/components/parameters/connector_id' + - $ref: '#/components/parameters/space_id' + requestBody: + required: true + content: + application/json: + schema: + title: Run connector request body properties + description: The properties vary depending on the connector type. + type: object + required: + - params + properties: + params: + oneOf: + - $ref: '#/components/schemas/run_connector_params_documents' + - $ref: '#/components/schemas/run_connector_params_level_message' + - title: Subaction parameters + description: Test an action that involves a subaction. + oneOf: + - $ref: '#/components/schemas/run_connector_subaction_addevent' + - $ref: '#/components/schemas/run_connector_subaction_closealert' + - $ref: '#/components/schemas/run_connector_subaction_createalert' + - $ref: '#/components/schemas/run_connector_subaction_fieldsbyissuetype' + - $ref: '#/components/schemas/run_connector_subaction_getchoices' + - $ref: '#/components/schemas/run_connector_subaction_getfields' + - $ref: '#/components/schemas/run_connector_subaction_getincident' + - $ref: '#/components/schemas/run_connector_subaction_issue' + - $ref: '#/components/schemas/run_connector_subaction_issues' + - $ref: '#/components/schemas/run_connector_subaction_issuetypes' + - $ref: '#/components/schemas/run_connector_subaction_pushtoservice' + discriminator: + propertyName: subAction + examples: + runIndexConnectorRequest: + $ref: '#/components/examples/run_index_connector_request' + runJiraConnectorRequest: + $ref: '#/components/examples/run_jira_connector_request' + runServerLogConnectorRequest: + $ref: '#/components/examples/run_server_log_connector_request' + runServiceNowITOMConnectorRequest: + $ref: '#/components/examples/run_servicenow_itom_connector_request' + runSwimlaneConnectorRequest: + $ref: '#/components/examples/run_swimlane_connector_request' + responses: + '200': + description: Indicates a successful call. content: application/json: schema: type: object + required: + - connector_id + - status properties: - error: + connector_id: type: string - example: Unauthorized - message: + description: The identifier for the connector. + data: + oneOf: + - type: object + description: Information returned from the action. + additionalProperties: true + - type: array + description: An array of information returned from the action. + items: + type: object + status: type: string - statusCode: - type: integer - example: 401 + description: The status of the action. + enum: + - error + - ok + examples: + runIndexConnectorResponse: + $ref: '#/components/examples/run_index_connector_response' + runJiraConnectorResponse: + $ref: '#/components/examples/run_jira_connector_response' + runServerLogConnectorResponse: + $ref: '#/components/examples/run_server_log_connector_response' + runServiceNowITOMConnectorResponse: + $ref: '#/components/examples/run_servicenow_itom_connector_response' + runSwimlaneConnectorResponse: + $ref: '#/components/examples/run_swimlane_connector_response' + '401': + description: Authorization information is missing or invalid. + content: + application/json: + schema: + $ref: '#/components/schemas/401_response' servers: - url: https://localhost:5601 servers: @@ -1951,6 +1991,22 @@ components: - $ref: '#/components/schemas/connector_response_properties_xmatters' discriminator: propertyName: connector_type_id + 401_response: + type: object + title: Unsuccessful rule API response + properties: + error: + type: string + example: Unauthorized + enum: + - Unauthorized + message: + type: string + statusCode: + type: integer + example: 401 + enum: + - 401 update_connector_request_cases_webhook: title: Update Webhook - Case Managment connector request type: object @@ -2078,6 +2134,22 @@ components: example: my-connector secrets: $ref: '#/components/schemas/secrets_properties_swimlane' + 404_response: + type: object + properties: + error: + type: string + example: Not Found + enum: + - Not Found + message: + type: string + example: Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found + statusCode: + type: integer + example: 404 + enum: + - 404 connector_types: title: Connector types type: string @@ -2110,6 +2182,495 @@ components: - cases - uptime - siem + run_connector_params_documents: + title: Index connector parameters + description: Test an action that indexes a document into Elasticsearch. + type: object + required: + - documents + properties: + documents: + type: array + description: The documents in JSON format for index connectors. + items: + type: object + additionalProperties: true + run_connector_params_level_message: + title: Server log connector parameters + description: Test an action that writes an entry to the Kibana server log. + type: object + required: + - message + properties: + level: + type: string + description: The log level of the message for server log connectors. + enum: + - debug + - error + - fatal + - info + - trace + - warn + default: info + message: + type: string + description: The message for server log connectors. + run_connector_subaction_addevent: + title: The addEvent subaction + type: object + required: + - subAction + description: The `addEvent` subaction for ServiceNow ITOM connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - addEvent + subActionParams: + type: object + description: The set of configuration properties for the action. + properties: + additional_info: + type: string + description: Additional information about the event. + description: + type: string + description: The details about the event. + event_class: + type: string + description: A specific instance of the source. + message_key: + type: string + description: All actions sharing this key are associated with the same ServiceNow alert. The default value is `:`. + metric_name: + type: string + description: The name of the metric. + node: + type: string + description: The host that the event was triggered for. + resource: + type: string + description: The name of the resource. + severity: + type: string + description: The severity of the event. + source: + type: string + description: The name of the event source type. + time_of_event: + type: string + description: The time of the event. + type: + type: string + description: The type of event. + run_connector_subaction_closealert: + title: The closeAlert subaction + type: object + required: + - subAction + - subActionParams + description: The `closeAlert` subaction for Opsgenie connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - closeAlert + subActionParams: + type: object + required: + - alias + properties: + alias: + type: string + description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert. + note: + type: string + description: Additional information for the alert. + source: + type: string + description: The display name for the source of the alert. + user: + type: string + description: The display name for the owner. + run_connector_subaction_createalert: + title: The createAlert subaction + type: object + required: + - subAction + - subActionParams + description: The `createAlert` subaction for Opsgenie connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - createAlert + subActionParams: + type: object + required: + - message + properties: + actions: + type: array + description: The custom actions available to the alert. + items: + type: string + alias: + type: string + description: The unique identifier used for alert deduplication in Opsgenie. + description: + type: string + description: A description that provides detailed information about the alert. + details: + type: object + description: The custom properties of the alert. + additionalProperties: true + example: + key1: value1 + key2: value2 + entity: + type: string + description: The domain of the alert. For example, the application or server name. + message: + type: string + description: The alert message. + note: + type: string + description: Additional information for the alert. + priority: + type: string + description: The priority level for the alert. + enum: + - P1 + - P2 + - P3 + - P4 + - P5 + responders: + type: array + description: | + The entities to receive notifications about the alert. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required. + items: + type: object + properties: + id: + type: string + description: The identifier for the entity. + name: + type: string + description: The name of the entity. + type: + type: string + description: The type of responders, in this case `escalation`. + enum: + - escalation + - schedule + - team + - user + username: + type: string + description: A valid email address for the user. + source: + type: string + description: The display name for the source of the alert. + tags: + type: array + description: The tags for the alert. + items: + type: string + user: + type: string + description: The display name for the owner. + visibleTo: + type: array + description: The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required. + items: + type: object + required: + - type + properties: + id: + type: string + description: The identifier for the entity. + name: + type: string + description: The name of the entity. + type: + type: string + description: Valid values are `team` and `user`. + enum: + - team + - user + username: + type: string + description: The user name. This property is required only when the `type` is `user`. + run_connector_subaction_fieldsbyissuetype: + title: The fieldsByIssueType subaction + type: object + required: + - subAction + - subActionParams + description: The `fieldsByIssueType` subaction for Jira connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - fieldsByIssueType + subActionParams: + type: object + required: + - id + properties: + id: + type: string + description: The Jira issue type identifier. + example: 10024 + run_connector_subaction_getchoices: + title: The getChoices subaction + type: object + required: + - subAction + - subActionParams + description: The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - getChoices + subActionParams: + type: object + description: The set of configuration properties for the action. + required: + - fields + properties: + fields: + type: array + description: An array of fields. + items: + type: string + run_connector_subaction_getfields: + title: The getFields subaction + type: object + required: + - subAction + description: The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - getFields + run_connector_subaction_getincident: + title: The getIncident subaction + type: object + description: The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors. + required: + - subAction + - subActionParams + properties: + subAction: + type: string + description: The action to test. + enum: + - getIncident + subActionParams: + type: object + required: + - externalId + properties: + externalId: + type: string + description: The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. + example: 71778 + run_connector_subaction_issue: + title: The issue subaction + type: object + required: + - subAction + description: The `issue` subaction for Jira connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - issue + subActionParams: + type: object + required: + - id + properties: + id: + type: string + description: The Jira issue identifier. + example: 71778 + run_connector_subaction_issues: + title: The issues subaction + type: object + required: + - subAction + - subActionParams + description: The `issues` subaction for Jira connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - issues + subActionParams: + type: object + required: + - title + properties: + title: + type: string + description: The title of the Jira issue. + run_connector_subaction_issuetypes: + title: The issueTypes subaction + type: object + required: + - subAction + description: The `issueTypes` subaction for Jira connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - issueTypes + run_connector_subaction_pushtoservice: + title: The pushToService subaction + type: object + required: + - subAction + - subActionParams + description: The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors. + properties: + subAction: + type: string + description: The action to test. + enum: + - pushToService + subActionParams: + type: object + description: The set of configuration properties for the action. + properties: + comments: + type: array + description: Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane. + items: + type: object + properties: + comment: + type: string + description: A comment related to the incident. For example, describe how to troubleshoot the issue. + commentId: + type: integer + description: A unique identifier for the comment. + incident: + type: object + description: Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident. + properties: + alertId: + type: string + description: The alert identifier for Swimlane connectors. + caseId: + type: string + description: The case identifier for the incident for Swimlane connectors. + caseName: + type: string + description: The case name for the incident for Swimlane connectors. + category: + type: string + description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. + correlation_display: + type: string + description: A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors. + correlation_id: + type: string + description: | + The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. + description: + type: string + description: The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors. + dest_ip: + description: | + A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + externalId: + type: string + description: | + The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created. + impact: + type: string + description: The impact of the incident for ServiceNow ITSM connectors. + issueType: + type: integer + description: The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`. + labels: + type: array + items: + type: string + description: | + The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces. + malware_hash: + description: A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + malware_url: + type: string + description: A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + parent: + type: string + description: The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues. + priority: + type: string + description: The priority of the incident in Jira and ServiceNow SecOps connectors. + ruleName: + type: string + description: The rule name for Swimlane connectors. + severity: + type: string + description: The severity of the incident for ServiceNow ITSM and Swimlane connectors. + short_description: + type: string + description: | + A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base. + source_ip: + description: A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + subcategory: + type: string + description: The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. + summary: + type: string + description: A summary of the incident for Jira connectors. + title: + type: string + description: | + A title for the incident for Jira connectors. It is used for searching the contents of the knowledge base. + urgency: + type: string + description: The urgency of the incident for ServiceNow ITSM connectors. examples: create_index_connector_request: summary: Create an index connector. @@ -2199,6 +2760,146 @@ components: supported_feature_ids: - alerting - uptime + run_index_connector_request: + summary: Run an index connector. + value: + params: + documents: + - id: my_doc_id + name: my_doc_name + message: hello, world + run_jira_connector_request: + summary: Run a Jira connector to retrieve the list of issue types. + value: + params: + subAction: issueTypes + run_server_log_connector_request: + summary: Run a server log connector. + value: + params: + level: warn + message: Test warning message. + run_servicenow_itom_connector_request: + summary: Run a ServiceNow ITOM connector to retrieve the list of choices. + value: + params: + subAction: getChoices + subActionParams: + fields: + - severity + - urgency + run_swimlane_connector_request: + summary: Run a Swimlane connector to create an incident. + value: + params: + subAction: pushToService + subActionParams: + comments: + - commentId: 1 + comment: A comment about the incident. + incident: + caseId: '1000' + caseName: Case name + description: Description of the incident. + run_index_connector_response: + summary: Response from running an index connector. + value: + connector_id: fd38c600-96a5-11ed-bb79-353b74189cba + data: + errors: false + items: + - create: + _id: 4JtvwYUBrcyxt2NnfW3y + _index: my-index + _primary_term: 1 + _seq_no: 0 + _shards: + failed: 0 + successful: 1 + total: 2 + _version: 1 + result: created + status: 201 + took: 135 + status: ok + run_jira_connector_response: + summary: Response from retrieving the list of issue types for a Jira connector. + value: + connector_id: b3aad810-edbe-11ec-82d1-11348ecbf4a6 + data: + - id: 10024 + name: Improvement + - id: 10006 + name: Task + - id: 10007 + name: Sub-task + - id: 10025 + name: New Feature + - id: 10023 + name: Bug + - id: 10000 + name: Epic + status: ok + run_server_log_connector_response: + summary: Response from running a server log connector. + value: + connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907 + status: ok + run_servicenow_itom_connector_response: + summary: Response from retrieving the list of choices for a ServiceNow ITOM connector. + value: + connector_id: 9d9be270-2fd2-11ed-b0e0-87533c532698 + data: + - dependent_value: '' + element: severity + label: Critical + value: 1 + - dependent_value: '' + element: severity + label: Major + value: 2 + - dependent_value: '' + element: severity + label: Minor + value: 3 + - dependent_value: '' + element: severity + label: Warning + value: 4 + - dependent_value: '' + element: severity + label: OK + value: 5 + - dependent_value: '' + element: severity + label: Clear + value: 0 + - dependent_value: '' + element: urgency + label: 1 - High + value: 1 + - dependent_value: '' + element: urgency + label: 2 - Medium + value: 2 + - dependent_value: '' + element: urgency + label: 3 - Low + value: 3 + status: ok + run_swimlane_connector_response: + summary: Response from creating a Swimlane incident. + value: + connector_id: a4746470-2f94-11ed-b0e0-87533c532698 + data: + id: aKPmBHWzmdRQtx6Mx + title: TEST-457 + url: https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx + pushedDate: '2022-09-08T16:52:27.866Z' + comments: + - commentId: 1 + pushedDate: '2022-09-08T16:52:27.865Z' + status: ok security: - basicAuth: [] - apiKeyAuth: [] diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_index_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_index_connector_request.yaml new file mode 100644 index 0000000000000..21bb1c9c3f618 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_index_connector_request.yaml @@ -0,0 +1,7 @@ +summary: Run an index connector. +value: + params: + documents: + - id: my_doc_id + name: my_doc_name + message: hello, world \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_index_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_index_connector_response.yaml new file mode 100644 index 0000000000000..0da76e1e1d1b4 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_index_connector_response.yaml @@ -0,0 +1,20 @@ +summary: Response from running an index connector. +value: + connector_id: fd38c600-96a5-11ed-bb79-353b74189cba + data: + errors: false + items: + - create: + _id: 4JtvwYUBrcyxt2NnfW3y + _index: my-index + _primary_term: 1 + _seq_no: 0 + _shards: + failed: 0 + successful: 1 + total: 2 + _version: 1 + result: created + status: 201 + took: 135 + status: ok \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_jira_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_jira_connector_request.yaml new file mode 100644 index 0000000000000..6dce9b9bbc153 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_jira_connector_request.yaml @@ -0,0 +1,4 @@ +summary: Run a Jira connector to retrieve the list of issue types. +value: + params: + subAction: issueTypes \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_jira_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_jira_connector_response.yaml new file mode 100644 index 0000000000000..ef3b1be138c63 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_jira_connector_response.yaml @@ -0,0 +1,17 @@ +summary: Response from retrieving the list of issue types for a Jira connector. +value: + connector_id: b3aad810-edbe-11ec-82d1-11348ecbf4a6 + data: + - id: 10024 + name: Improvement + - id: 10006 + name: Task + - id: 10007 + name: Sub-task + - id: 10025 + name: New Feature + - id: 10023 + name: Bug + - id: 10000 + name: Epic + status: ok \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_server_log_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_server_log_connector_request.yaml new file mode 100644 index 0000000000000..0a5bf4568dba0 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_server_log_connector_request.yaml @@ -0,0 +1,5 @@ +summary: Run a server log connector. +value: + params: + level: warn + message: Test warning message. \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_server_log_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_server_log_connector_response.yaml new file mode 100644 index 0000000000000..604a32b1abd2d --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_server_log_connector_response.yaml @@ -0,0 +1,4 @@ +summary: Response from running a server log connector. +value: + connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907 + status: ok diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_servicenow_itom_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_servicenow_itom_connector_request.yaml new file mode 100644 index 0000000000000..fb811c96fa101 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_servicenow_itom_connector_request.yaml @@ -0,0 +1,8 @@ +summary: Run a ServiceNow ITOM connector to retrieve the list of choices. +value: + params: + subAction: getChoices + subActionParams: + fields: + - severity + - urgency diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_servicenow_itom_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_servicenow_itom_connector_response.yaml new file mode 100644 index 0000000000000..5bec5b810c90d --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_servicenow_itom_connector_response.yaml @@ -0,0 +1,41 @@ +summary: Response from retrieving the list of choices for a ServiceNow ITOM connector. +value: + connector_id: 9d9be270-2fd2-11ed-b0e0-87533c532698 + data: + - dependent_value: "" + element: severity + label: Critical + value: 1 + - dependent_value: "" + element: severity + label: Major + value: 2 + - dependent_value: "" + element: severity + label: Minor + value: 3 + - dependent_value: "" + element: severity + label: Warning + value: 4 + - dependent_value: "" + element: severity + label: OK + value: 5 + - dependent_value: "" + element: severity + label: Clear + value: 0 + - dependent_value: "" + element: urgency + label: 1 - High + value: 1 + - dependent_value: "" + element: urgency + label: 2 - Medium + value: 2 + - dependent_value: "" + element: urgency + label: 3 - Low + value: 3 + status: ok diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_swimlane_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_swimlane_connector_request.yaml new file mode 100644 index 0000000000000..7fc1dd27b2131 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_swimlane_connector_request.yaml @@ -0,0 +1,12 @@ +summary: Run a Swimlane connector to create an incident. +value: + params: + subAction: pushToService + subActionParams: + comments: + - commentId: 1 + comment: A comment about the incident. + incident: + caseId: "1000" + caseName: Case name + description: Description of the incident. \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/examples/run_swimlane_connector_response.yaml b/x-pack/plugins/actions/docs/openapi/components/examples/run_swimlane_connector_response.yaml new file mode 100644 index 0000000000000..8ab131212020d --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/examples/run_swimlane_connector_response.yaml @@ -0,0 +1,12 @@ +summary: Response from creating a Swimlane incident. +value: + connector_id: a4746470-2f94-11ed-b0e0-87533c532698 + data: + id: aKPmBHWzmdRQtx6Mx + title: TEST-457 + url: https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx + pushedDate: 2022-09-08T16:52:27.866Z + comments: + - commentId: 1 + pushedDate: 2022-09-08T16:52:27.865Z + status: ok diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/401_response.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/401_response.yaml new file mode 100644 index 0000000000000..c6044998f8649 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/401_response.yaml @@ -0,0 +1,15 @@ +type: object +title: Unsuccessful rule API response +properties: + error: + type: string + example: Unauthorized + enum: + - Unauthorized + message: + type: string + statusCode: + type: integer + example: 401 + enum: + - 401 \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/404_response.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/404_response.yaml new file mode 100644 index 0000000000000..298c50f418a67 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/404_response.yaml @@ -0,0 +1,15 @@ +type: object +properties: + error: + type: string + example: Not Found + enum: + - Not Found + message: + type: string + example: "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found" + statusCode: + type: integer + example: 404 + enum: + - 404 \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_documents.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_documents.yaml new file mode 100644 index 0000000000000..1874c19d17cc6 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_documents.yaml @@ -0,0 +1,13 @@ +title: Index connector parameters +description: Test an action that indexes a document into Elasticsearch. +type: object +required: + - documents +properties: + documents: + type: array + description: The documents in JSON format for index connectors. + items: + type: object + additionalProperties: true + diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_level_message.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_level_message.yaml new file mode 100644 index 0000000000000..cd8db87b0df82 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_params_level_message.yaml @@ -0,0 +1,20 @@ +title: Server log connector parameters +description: Test an action that writes an entry to the Kibana server log. +type: object +required: + - message +properties: + level: + type: string + description: The log level of the message for server log connectors. + enum: + - debug + - error + - fatal + - info + - trace + - warn + default: info + message: + type: string + description: The message for server log connectors. diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_addevent.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_addevent.yaml new file mode 100644 index 0000000000000..c0ae0d4c424f3 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_addevent.yaml @@ -0,0 +1,49 @@ +title: The addEvent subaction +type: object +required: + - subAction +description: The `addEvent` subaction for ServiceNow ITOM connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - addEvent + subActionParams: + type: object + description: The set of configuration properties for the action. + properties: + additional_info: + type: string + description: Additional information about the event. + description: + type: string + description: The details about the event. + event_class: + type: string + description: A specific instance of the source. + message_key: + type: string + description: All actions sharing this key are associated with the same ServiceNow alert. The default value is `:`. + metric_name: + type: string + description: The name of the metric. + node: + type: string + description: The host that the event was triggered for. + resource: + type: string + description: The name of the resource. + severity: + type: string + description: The severity of the event. + source: + type: string + description: The name of the event source type. + time_of_event: + type: string + description: The time of the event. + type: + type: string + description: The type of event. + \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closealert.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closealert.yaml new file mode 100644 index 0000000000000..43436c1564eb1 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closealert.yaml @@ -0,0 +1,30 @@ +title: The closeAlert subaction +type: object +required: + - subAction + - subActionParams +description: The `closeAlert` subaction for Opsgenie connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - closeAlert + subActionParams: + type: object + required: + - alias + properties: + alias: + type: string + description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert. + note: + type: string + description: Additional information for the alert. + source: + type: string + description: The display name for the source of the alert. + user: + type: string + description: The display name for the owner. + \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_createalert.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_createalert.yaml new file mode 100644 index 0000000000000..e739a9ed6c91d --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_createalert.yaml @@ -0,0 +1,112 @@ +title: The createAlert subaction +type: object +required: + - subAction + - subActionParams +description: The `createAlert` subaction for Opsgenie connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - createAlert + subActionParams: + type: object + required: + - message + properties: + actions: + type: array + description: The custom actions available to the alert. + items: + type: string + alias: + type: string + description: The unique identifier used for alert deduplication in Opsgenie. + description: + type: string + description: A description that provides detailed information about the alert. + details: + type: object + description: The custom properties of the alert. + additionalProperties: true + example: {"key1":"value1","key2":"value2"} + entity: + type: string + description: The domain of the alert. For example, the application or server name. + message: + type: string + description: The alert message. + note: + type: string + description: Additional information for the alert. + priority: + type: string + description: The priority level for the alert. + enum: + - P1 + - P2 + - P3 + - P4 + - P5 + responders: + type: array + description: > + The entities to receive notifications about the alert. + If `type` is `user`, either `id` or `username` is required. + If `type` is `team`, either `id` or `name` is required. + items: + type: object + properties: + id: + type: string + description: The identifier for the entity. + name: + type: string + description: The name of the entity. + type: + type: string + description: The type of responders, in this case `escalation`. + enum: + - escalation + - schedule + - team + - user + username: + type: string + description: A valid email address for the user. + source: + type: string + description: The display name for the source of the alert. + tags: + type: array + description: The tags for the alert. + items: + type: string + user: + type: string + description: The display name for the owner. + visibleTo: + type: array + description: The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required. + items: + type: object + required: + - type + properties: + id: + type: string + description: The identifier for the entity. + name: + type: string + description: The name of the entity. + type: + type: string + description: Valid values are `team` and `user`. + enum: + - team + - user + username: + type: string + description: The user name. This property is required only when the `type` is `user`. + \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_fieldsbyissuetype.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_fieldsbyissuetype.yaml new file mode 100644 index 0000000000000..e8c8869e7d68b --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_fieldsbyissuetype.yaml @@ -0,0 +1,22 @@ +title: The fieldsByIssueType subaction +type: object +required: + - subAction + - subActionParams +description: The `fieldsByIssueType` subaction for Jira connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - fieldsByIssueType + subActionParams: + type: object + required: + - id + properties: + id: + type: string + description: The Jira issue type identifier. + example: 10024 + \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getchoices.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getchoices.yaml new file mode 100644 index 0000000000000..7bcf2aca3fc71 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getchoices.yaml @@ -0,0 +1,23 @@ +title: The getChoices subaction +type: object +required: + - subAction + - subActionParams +description: The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - getChoices + subActionParams: + type: object + description: The set of configuration properties for the action. + required: + - fields + properties: + fields: + type: array + description: An array of fields. + items: + type: string diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getfields.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getfields.yaml new file mode 100644 index 0000000000000..62e80dc53805c --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getfields.yaml @@ -0,0 +1,11 @@ +title: The getFields subaction +type: object +required: + - subAction +description: The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - getFields diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getincident.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getincident.yaml new file mode 100644 index 0000000000000..666c0257f68b8 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_getincident.yaml @@ -0,0 +1,21 @@ +title: The getIncident subaction +type: object +description: The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors. +required: + - subAction + - subActionParams +properties: + subAction: + type: string + description: The action to test. + enum: + - getIncident + subActionParams: + type: object + required: + - externalId + properties: + externalId: + type: string + description: The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. + example: 71778 diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issue.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issue.yaml new file mode 100644 index 0000000000000..56ee923b40063 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issue.yaml @@ -0,0 +1,20 @@ +title: The issue subaction +type: object +required: + - subAction +description: The `issue` subaction for Jira connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - issue + subActionParams: + type: object + required: + - id + properties: + id: + type: string + description: The Jira issue identifier. + example: 71778 \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issues.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issues.yaml new file mode 100644 index 0000000000000..bfd5abc388a24 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issues.yaml @@ -0,0 +1,20 @@ +title: The issues subaction +type: object +required: + - subAction + - subActionParams +description: The `issues` subaction for Jira connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - issues + subActionParams: + type: object + required: + - title + properties: + title: + type: string + description: The title of the Jira issue. \ No newline at end of file diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issuetypes.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issuetypes.yaml new file mode 100644 index 0000000000000..0ea5104ae1890 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_issuetypes.yaml @@ -0,0 +1,11 @@ +title: The issueTypes subaction +type: object +required: + - subAction +description: The `issueTypes` subaction for Jira connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - issueTypes diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_pushtoservice.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_pushtoservice.yaml new file mode 100644 index 0000000000000..7692a35b2f05f --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_pushtoservice.yaml @@ -0,0 +1,133 @@ +title: The pushToService subaction +type: object +required: + - subAction + - subActionParams +description: The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors. +properties: + subAction: + type: string + description: The action to test. + enum: + - pushToService + subActionParams: + type: object + description: The set of configuration properties for the action. + properties: + comments: + type: array + description: Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, or Swimlane. + items: + type: object + properties: + comment: + type: string + description: A comment related to the incident. For example, describe how to troubleshoot the issue. + commentId: + type: integer + description: A unique identifier for the comment. + incident: + type: object + description: Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, or Swimlane incident. + properties: + alertId: + type: string + description: The alert identifier for Swimlane connectors. + caseId: + type: string + description: The case identifier for the incident for Swimlane connectors. + caseName: + type: string + description: The case name for the incident for Swimlane connectors. + category: + type: string + description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. + correlation_display: + type: string + description: A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors. + correlation_id: + type: string + description: > + The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. + NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert. + description: + type: string + description: The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, and Swimlane connectors. + dest_ip: + description: > + A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + externalId: + type: string + description: > + The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. + If present, the incident is updated. Otherwise, a new incident is created. + impact: + type: string + description: The impact of the incident for ServiceNow ITSM connectors. + issueType: + type: integer + description: The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`. + labels: + type: array + items: + type: string + description: > + The labels for the incident for Jira connectors. + NOTE: Labels cannot contain spaces. + malware_hash: + description: A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + malware_url: + type: string + description: A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + parent: + type: string + description: The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues. + priority: + type: string + description: The priority of the incident in Jira and ServiceNow SecOps connectors. + ruleName: + type: string + description: The rule name for Swimlane connectors. + severity: + type: string + description: The severity of the incident for ServiceNow ITSM and Swimlane connectors. + short_description: + type: string + description: > + A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base. + source_ip: + description: A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident. + oneOf: + - type: string + - type: array + items: + type: string + subcategory: + type: string + description: The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. + summary: + type: string + description: A summary of the incident for Jira connectors. + title: + type: string + description: > + A title for the incident for Jira connectors. + It is used for searching the contents of the knowledge base. + urgency: + type: string + description: The urgency of the incident for ServiceNow ITSM connectors. diff --git a/x-pack/plugins/actions/docs/openapi/entrypoint.yaml b/x-pack/plugins/actions/docs/openapi/entrypoint.yaml index 98a50c7304d58..579845aa9f6d8 100644 --- a/x-pack/plugins/actions/docs/openapi/entrypoint.yaml +++ b/x-pack/plugins/actions/docs/openapi/entrypoint.yaml @@ -23,18 +23,17 @@ paths: $ref: paths/s@{spaceid}@api@actions@connectors.yaml '/s/{spaceId}/api/actions/connector_types': $ref: paths/s@{spaceid}@api@actions@connector_types.yaml -# '/s/{spaceId}/api/actions/connector/{connectorId}/_execute': -# $ref: paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml + '/s/{spaceId}/api/actions/connector/{connectorId}/_execute': + $ref: paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml +# Deprecated endpoints: # '/s/{spaceId}/api/actions/action/{actionId}': # $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}.yaml' # '/s/{spaceId}/api/actions': # $ref: 'paths/s@{spaceid}@api@actions.yaml' -# '/s/{spaceId}/api/actions/list_action_types': +# '/s/{spaceId}/api/actions/list_action_types': # $ref: 'paths/s@{spaceid}@api@actions@list_action_types.yaml' # '/s/{spaceId}/api/actions/action': # $ref: 'paths/s@{spaceid}@api@actions@action.yaml' -# '/s/{spaceId}/api/actions/action/{actionId}': -# $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}.yaml' # '/s/{spaceId}/api/actions/action/{actionId}/_execute': # $ref: 'paths/s@{spaceid}@api@actions@action@{actionid}@_execute.yaml' components: diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml index 110f35c650e91..fafabb5ce3065 100644 --- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml +++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector.yaml @@ -6,7 +6,7 @@ post: tags: - connectors parameters: - - $ref: ../components/headers/kbn_xsrf.yaml + - $ref: '../components/headers/kbn_xsrf.yaml' - $ref: '../components/parameters/space_id.yaml' requestBody: required: true @@ -53,16 +53,7 @@ post: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '../components/schemas/401_response.yaml' servers: - url: https://localhost:5601 servers: diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml index c1cb7df5aa0f1..5633dd7b9dcb6 100644 --- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml +++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}.yaml @@ -23,16 +23,7 @@ get: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '../components/schemas/401_response.yaml' '404': description: Object is not found. content: @@ -61,7 +52,7 @@ delete: tags: - connectors parameters: - - $ref: ../components/headers/kbn_xsrf.yaml + - $ref: '../components/headers/kbn_xsrf.yaml' - $ref: '../components/parameters/connector_id.yaml' - $ref: '../components/parameters/space_id.yaml' responses: @@ -72,16 +63,7 @@ delete: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '../components/schemas/401_response.yaml' '404': description: Object is not found. content: @@ -109,7 +91,7 @@ put: tags: - connectors parameters: - - $ref: ../components/headers/kbn_xsrf.yaml + - $ref: '../components/headers/kbn_xsrf.yaml' - $ref: '../components/parameters/connector_id.yaml' - $ref: '../components/parameters/space_id.yaml' requestBody: @@ -167,32 +149,13 @@ put: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '../components/schemas/401_response.yaml' '404': description: Object is not found. content: application/json: schema: - type: object - properties: - error: - type: string - example: Not Found - message: - type: string - example: "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found" - statusCode: - type: integer - example: 404 + $ref: '../components/schemas/404_response.yaml' servers: - url: https://localhost:5601 servers: diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml new file mode 100644 index 0000000000000..713583759a017 --- /dev/null +++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector@{connectorid}@_execute.yaml @@ -0,0 +1,105 @@ +post: + summary: Runs a connector. + operationId: runConnector + description: > + You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. + You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. + If you use an index connector, you must also have `all`, `create`, `index`, or `write` indices privileges. + tags: + - connectors + parameters: + - $ref: '../components/headers/kbn_xsrf.yaml' + - $ref: '../components/parameters/connector_id.yaml' + - $ref: '../components/parameters/space_id.yaml' + requestBody: + required: true + content: + application/json: + schema: + title: Run connector request body properties + description: The properties vary depending on the connector type. + type: object + required: + - params + properties: + params: + oneOf: + - $ref: '../components/schemas/run_connector_params_documents.yaml' + - $ref: '../components/schemas/run_connector_params_level_message.yaml' + - title: Subaction parameters + description: Test an action that involves a subaction. + oneOf: + - $ref: '../components/schemas/run_connector_subaction_addevent.yaml' + - $ref: '../components/schemas/run_connector_subaction_closealert.yaml' + - $ref: '../components/schemas/run_connector_subaction_createalert.yaml' + - $ref: '../components/schemas/run_connector_subaction_fieldsbyissuetype.yaml' + - $ref: '../components/schemas/run_connector_subaction_getchoices.yaml' + - $ref: '../components/schemas/run_connector_subaction_getfields.yaml' + - $ref: '../components/schemas/run_connector_subaction_getincident.yaml' + - $ref: '../components/schemas/run_connector_subaction_issue.yaml' + - $ref: '../components/schemas/run_connector_subaction_issues.yaml' + - $ref: '../components/schemas/run_connector_subaction_issuetypes.yaml' + - $ref: '../components/schemas/run_connector_subaction_pushtoservice.yaml' + discriminator: + propertyName: subAction + examples: + runIndexConnectorRequest: + $ref: '../components/examples/run_index_connector_request.yaml' + runJiraConnectorRequest: + $ref: '../components/examples/run_jira_connector_request.yaml' + runServerLogConnectorRequest: + $ref: '../components/examples/run_server_log_connector_request.yaml' + runServiceNowITOMConnectorRequest: + $ref: '../components/examples/run_servicenow_itom_connector_request.yaml' + runSwimlaneConnectorRequest: + $ref: '../components/examples/run_swimlane_connector_request.yaml' + responses: + '200': + description: Indicates a successful call. + content: + application/json: + schema: + type: object + required: + - connector_id + - status + properties: + connector_id: + type: string + description: The identifier for the connector. + data: + oneOf: + - type: object + description: Information returned from the action. + additionalProperties: true + - type: array + description: An array of information returned from the action. + items: + type: object + status: + type: string + description: The status of the action. + enum: + - error + - ok + examples: + runIndexConnectorResponse: + $ref: '../components/examples/run_index_connector_response.yaml' + runJiraConnectorResponse: + $ref: '../components/examples/run_jira_connector_response.yaml' + runServerLogConnectorResponse: + $ref: '../components/examples/run_server_log_connector_response.yaml' + runServiceNowITOMConnectorResponse: + $ref: '../components/examples/run_servicenow_itom_connector_response.yaml' + runSwimlaneConnectorResponse: + $ref: '../components/examples/run_swimlane_connector_response.yaml' + '401': + description: Authorization information is missing or invalid. + content: + application/json: + schema: + $ref: '../components/schemas/401_response.yaml' + servers: + - url: https://localhost:5601 +servers: + - url: https://localhost:5601 diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml index 001da54c13c14..72dcd25660533 100644 --- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml +++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connector_types.yaml @@ -63,16 +63,7 @@ get: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '../components/schemas/401_response.yaml' servers: - url: https://localhost:5601 servers: diff --git a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml index 2a0a075703f8a..afa2c05abdb62 100644 --- a/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml +++ b/x-pack/plugins/actions/docs/openapi/paths/s@{spaceid}@api@actions@connectors.yaml @@ -60,16 +60,7 @@ get: content: application/json: schema: - type: object - properties: - error: - type: string - example: Unauthorized - message: - type: string - statusCode: - type: integer - example: 401 + $ref: '../components/schemas/401_response.yaml' servers: - url: https://localhost:5601 servers: diff --git a/x-pack/plugins/actions/server/lib/audit_events.ts b/x-pack/plugins/actions/server/lib/audit_events.ts index 5c2cf6fb7cc08..185c11c89c45b 100644 --- a/x-pack/plugins/actions/server/lib/audit_events.ts +++ b/x-pack/plugins/actions/server/lib/audit_events.ts @@ -5,8 +5,9 @@ * 2.0. */ -import type { EcsEventOutcome, EcsEventType } from '@kbn/core/server'; +import type { EcsEvent } from '@kbn/core/server'; import { AuditEvent } from '@kbn/security-plugin/server'; +import { ArrayElement } from '@kbn/utility-types'; export enum ConnectorAuditAction { CREATE = 'connector_create', @@ -32,7 +33,7 @@ const eventVerbs: Record = { connector_get_global_execution_kpi: ['access', 'accessing', 'accessed'], }; -const eventTypes: Record = { +const eventTypes: Record | undefined> = { connector_create: 'creation', connector_get: 'access', connector_update: 'change', @@ -45,7 +46,7 @@ const eventTypes: Record = { export interface ConnectorAuditEventParams { action: ConnectorAuditAction; - outcome?: EcsEventOutcome; + outcome?: EcsEvent['outcome']; savedObject?: NonNullable['saved_object']; error?: Error; } diff --git a/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts b/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts index 223c8c28b55bc..20896e2691f10 100644 --- a/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts +++ b/x-pack/plugins/actions/server/lib/request_oauth_client_credentials_token.test.ts @@ -74,7 +74,6 @@ describe('requestOAuthClientCredentialsToken', () => { "maxSockets": Infinity, "maxTotalSockets": Infinity, "options": Object { - "noDelay": true, "path": null, "rejectUnauthorized": true, }, diff --git a/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts b/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts index af65bcf67d3db..318775762bbbd 100644 --- a/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts +++ b/x-pack/plugins/actions/server/lib/request_oauth_jwt_token.test.ts @@ -75,7 +75,6 @@ describe('requestOAuthJWTToken', () => { "maxSockets": Infinity, "maxTotalSockets": Infinity, "options": Object { - "noDelay": true, "path": null, "rejectUnauthorized": true, }, diff --git a/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts b/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts index 9843783aadf8d..cc9ea6a74517a 100644 --- a/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts +++ b/x-pack/plugins/actions/server/lib/request_oauth_token.test.ts @@ -82,7 +82,6 @@ describe('requestOAuthToken', () => { "maxSockets": Infinity, "maxTotalSockets": Infinity, "options": Object { - "noDelay": true, "path": null, "rejectUnauthorized": true, }, diff --git a/x-pack/plugins/alerting/docs/openapi/bundled.json b/x-pack/plugins/alerting/docs/openapi/bundled.json index 53b0ad2e75a73..9d0395f182355 100644 --- a/x-pack/plugins/alerting/docs/openapi/bundled.json +++ b/x-pack/plugins/alerting/docs/openapi/bundled.json @@ -133,6 +133,89 @@ } ] }, + "post": { + "summary": "Creates a rule.", + "operationId": "createRule", + "description": "You must have `all` privileges for the appropriate Kibana features, depending on the `consumer` and `rule_type_id` of the rule you're creating. For example, you must have privileges for the **Management > Stack rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, or **Security** features. If the rule has actions, you must also have `read` privileges for the **Management > Actions and Connectors** feature. NOTE: This API supports only token-based authentication. When you create a rule, it identifies which roles you have at that point in time. Thereafter, when the rule performs queries, it uses those security privileges. If a user with different privileges updates the rule, its behavior might change.\n", + "tags": [ + "alerting" + ], + "parameters": [ + { + "$ref": "#/components/parameters/kbn_xsrf" + }, + { + "$ref": "#/components/parameters/space_id" + }, + { + "in": "path", + "name": "ruleId", + "description": "An UUID v1 or v4 identifier for the rule. If you omit this parameter, an identifier is randomly generated.\n", + "required": true, + "schema": { + "type": "string", + "example": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74" + } + } + ], + "requestBody": { + "required": true, + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/create_rule_request" + }, + "examples": { + "createCaseRequest": { + "$ref": "#/components/examples/create_rule_request" + } + } + } + } + }, + "responses": { + "200": { + "description": "Indicates a successful call.", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/rule_response_properties" + }, + "examples": { + "createRuleResponse": { + "$ref": "#/components/examples/create_rule_response" + } + } + } + } + }, + "401": { + "description": "Authorization information is missing or invalid.", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/401_response" + } + } + } + }, + "404": { + "description": "Object is not found.", + "content": { + "application/json": { + "schema": { + "$ref": "#/components/schemas/404_response" + } + } + } + } + }, + "servers": [ + { + "url": "https://localhost:5601" + } + ] + }, "put": { "summary": "Updates the attributes for a rule.", "operationId": "updateRule", @@ -1201,6 +1284,7 @@ }, "in": "header", "name": "kbn-xsrf", + "description": "Cross-site request forgery protection", "required": true }, "alert_id": { @@ -1538,6 +1622,58 @@ "$ref": "#/components/schemas/throttle" } } + }, + "create_rule_request": { + "title": "Create rule request", + "description": "The create rule API request body varies depending on the type of rule and actions.", + "type": "object", + "required": [ + "consumer", + "name", + "notify_when", + "params", + "rule_type_id", + "schedule" + ], + "properties": { + "actions": { + "$ref": "#/components/schemas/actions" + }, + "consumer": { + "type": "string", + "description": "The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.\n" + }, + "enabled": { + "type": "boolean", + "description": "Indicates whether you want to run the rule on an interval basis after it is created." + }, + "name": { + "type": "string", + "description": "The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.", + "example": "cluster_health_rule" + }, + "notify_when": { + "$ref": "#/components/schemas/notify_when" + }, + "params": { + "type": "object", + "description": "The parameters for the rule.", + "additionalProperties": true + }, + "rule_type_id": { + "type": "string", + "description": "The ID of the rule type that you want to call when the rule is scheduled to run. For example, `.es-query`, `.index-threshold`, `logs.alert.document.count`, `monitoring_alert_cluster_health`, `siem.thresholdRule`, or `xpack.ml.anomaly_detection_alert`.\n" + }, + "schedule": { + "$ref": "#/components/schemas/schedule" + }, + "tags": { + "$ref": "#/components/schemas/tags" + }, + "throttle": { + "$ref": "#/components/schemas/throttle" + } + } } }, "examples": { @@ -1701,6 +1837,105 @@ "next_run": "2022-12-12T22:44:21.653Z" } }, + "create_rule_request": { + "summary": "Create an index threshold rule.", + "value": { + "actions": [ + { + "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2", + "group": "threshold met", + "params": { + "level": "info", + "message": "alert '{{alertName}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}" + } + } + ], + "consumer": "alerts", + "name": "my rule", + "notify_when": "onActionGroupChange", + "params": { + "aggType": "avg", + "termSize": 6, + "thresholdComparator": ">", + "timeWindowSize": 5, + "timeWindowUnit": "m", + "groupBy": "top", + "threshold": [ + 1000 + ], + "index": [ + ".test-index" + ], + "timeField": "@timestamp", + "aggField": "sheet.version", + "termField": "name.keyword" + }, + "rule_type_id": ".index-threshold", + "schedule": { + "interval": "1m" + }, + "tags": [ + "cpu" + ] + } + }, + "create_rule_response": { + "summary": "The create rule API returns a JSON object that contains details about the rule.", + "value": { + "actions": [ + { + "group": "threshold met", + "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2", + "params": { + "level": "info", + "message": "alert {{alertName}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}" + } + } + ], + "api_key_owner": "elastic", + "consumer": "alerts", + "created_at": "2022-06-08T17:20:31.632Z", + "created_by": "elastic", + "enabled": true, + "execution_status": { + "last_execution_date": "2022-06-08T17:20:31.632Z", + "status": "pending" + }, + "id": "41893910-6bca-11eb-9e0d-85d233e3ee35", + "muted_alert_ids": [], + "mute_all": false, + "name": "my rule", + "notify_when": "onActionGroupChange", + "params": { + "aggType": "avg", + "termSize": 6, + "thresholdComparator": ">", + "timeWindowSize": 5, + "timeWindowUnit": "m", + "groupBy": "top", + "threshold": [ + 1000 + ], + "index": [ + ".test-index" + ], + "timeField": "@timestamp", + "aggField": "sheet.version", + "termField": "name.keyword" + }, + "rule_type_id": ".index-threshold", + "schedule": { + "interval": "1m" + }, + "scheduled_task_id": "425b0800-6bca-11eb-9e0d-85d233e3ee35", + "tags": [ + "cpu" + ], + "throttle": null, + "updated_at": "2022-06-08T17:20:31.632Z", + "updated_by": "elastic" + } + }, "find_rules_response": { "summary": "Retrieve information about a rule.", "value": { diff --git a/x-pack/plugins/alerting/docs/openapi/bundled.yaml b/x-pack/plugins/alerting/docs/openapi/bundled.yaml index 95c0f0c266f1f..6515377574aac 100644 --- a/x-pack/plugins/alerting/docs/openapi/bundled.yaml +++ b/x-pack/plugins/alerting/docs/openapi/bundled.yaml @@ -78,6 +78,57 @@ paths: $ref: '#/components/schemas/404_response' servers: - url: https://localhost:5601 + post: + summary: Creates a rule. + operationId: createRule + description: | + You must have `all` privileges for the appropriate Kibana features, depending on the `consumer` and `rule_type_id` of the rule you're creating. For example, you must have privileges for the **Management > Stack rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, or **Security** features. If the rule has actions, you must also have `read` privileges for the **Management > Actions and Connectors** feature. NOTE: This API supports only token-based authentication. When you create a rule, it identifies which roles you have at that point in time. Thereafter, when the rule performs queries, it uses those security privileges. If a user with different privileges updates the rule, its behavior might change. + tags: + - alerting + parameters: + - $ref: '#/components/parameters/kbn_xsrf' + - $ref: '#/components/parameters/space_id' + - in: path + name: ruleId + description: | + An UUID v1 or v4 identifier for the rule. If you omit this parameter, an identifier is randomly generated. + required: true + schema: + type: string + example: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74 + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/create_rule_request' + examples: + createCaseRequest: + $ref: '#/components/examples/create_rule_request' + responses: + '200': + description: Indicates a successful call. + content: + application/json: + schema: + $ref: '#/components/schemas/rule_response_properties' + examples: + createRuleResponse: + $ref: '#/components/examples/create_rule_response' + '401': + description: Authorization information is missing or invalid. + content: + application/json: + schema: + $ref: '#/components/schemas/401_response' + '404': + description: Object is not found. + content: + application/json: + schema: + $ref: '#/components/schemas/404_response' + servers: + - url: https://localhost:5601 put: summary: Updates the attributes for a rule. operationId: updateRule @@ -746,6 +797,7 @@ components: type: string in: header name: kbn-xsrf + description: Cross-site request forgery protection required: true alert_id: in: path @@ -1003,6 +1055,47 @@ components: $ref: '#/components/schemas/tags' throttle: $ref: '#/components/schemas/throttle' + create_rule_request: + title: Create rule request + description: The create rule API request body varies depending on the type of rule and actions. + type: object + required: + - consumer + - name + - notify_when + - params + - rule_type_id + - schedule + properties: + actions: + $ref: '#/components/schemas/actions' + consumer: + type: string + description: | + The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`. + enabled: + type: boolean + description: Indicates whether you want to run the rule on an interval basis after it is created. + name: + type: string + description: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. + example: cluster_health_rule + notify_when: + $ref: '#/components/schemas/notify_when' + params: + type: object + description: The parameters for the rule. + additionalProperties: true + rule_type_id: + type: string + description: | + The ID of the rule type that you want to call when the rule is scheduled to run. For example, `.es-query`, `.index-threshold`, `logs.alert.document.count`, `monitoring_alert_cluster_health`, `siem.thresholdRule`, or `xpack.ml.anomaly_detection_alert`. + schedule: + $ref: '#/components/schemas/schedule' + tags: + $ref: '#/components/schemas/tags' + throttle: + $ref: '#/components/schemas/throttle' examples: get_rule_response: summary: The get rule API returns a JSON object that contains details about the rule. @@ -1140,6 +1233,92 @@ components: warning: null outcome: succeeded next_run: '2022-12-12T22:44:21.653Z' + create_rule_request: + summary: Create an index threshold rule. + value: + actions: + - id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2 + group: threshold met + params: + level: info + message: |- + alert '{{alertName}}' is active for group '{{context.group}}': + + - Value: {{context.value}} + - Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}} + - Timestamp: {{context.date}} + consumer: alerts + name: my rule + notify_when: onActionGroupChange + params: + aggType: avg + termSize: 6 + thresholdComparator: '>' + timeWindowSize: 5 + timeWindowUnit: m + groupBy: top + threshold: + - 1000 + index: + - .test-index + timeField: '@timestamp' + aggField: sheet.version + termField: name.keyword + rule_type_id: .index-threshold + schedule: + interval: 1m + tags: + - cpu + create_rule_response: + summary: The create rule API returns a JSON object that contains details about the rule. + value: + actions: + - group: threshold met + id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2 + params: + level: info + message: |- + alert {{alertName}} is active for group {{context.group} : + + - Value: {{context.value}} + - Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}} + - Timestamp: {{context.date}} + api_key_owner: elastic + consumer: alerts + created_at: '2022-06-08T17:20:31.632Z' + created_by: elastic + enabled: true + execution_status: + last_execution_date: '2022-06-08T17:20:31.632Z' + status: pending + id: 41893910-6bca-11eb-9e0d-85d233e3ee35 + muted_alert_ids: [] + mute_all: false + name: my rule + notify_when: onActionGroupChange + params: + aggType: avg + termSize: 6 + thresholdComparator: '>' + timeWindowSize: 5 + timeWindowUnit: m + groupBy: top + threshold: + - 1000 + index: + - .test-index + timeField: '@timestamp' + aggField: sheet.version + termField: name.keyword + rule_type_id: .index-threshold + schedule: + interval: 1m + scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35 + tags: + - cpu + throttle: null + updated_at: '2022-06-08T17:20:31.632Z' + updated_by: elastic find_rules_response: summary: Retrieve information about a rule. value: diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml new file mode 100644 index 0000000000000..da587ebc22e52 --- /dev/null +++ b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_request.yaml @@ -0,0 +1,30 @@ +summary: Create an index threshold rule. +value: + actions: + - id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2 + group: threshold met + params: + level: info + message: "alert '{{alertName}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}" + consumer: alerts + name: my rule + notify_when: onActionGroupChange + params: + aggType: avg + termSize: 6 + thresholdComparator: ">" + timeWindowSize: 5 + timeWindowUnit: m + groupBy: top + threshold: + - 1000 + index: + - .test-index + timeField: "@timestamp" + aggField: sheet.version + termField: name.keyword + rule_type_id: .index-threshold + schedule: + interval: 1m + tags: + - cpu \ No newline at end of file diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml new file mode 100644 index 0000000000000..1a1b45199ba58 --- /dev/null +++ b/x-pack/plugins/alerting/docs/openapi/components/examples/create_rule_response.yaml @@ -0,0 +1,44 @@ +summary: The create rule API returns a JSON object that contains details about the rule. +value: + actions: + - group: threshold met + id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2 + params: + level: info + message: "alert {{alertName}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}" + api_key_owner: elastic + consumer: alerts + created_at: '2022-06-08T17:20:31.632Z' + created_by: elastic + enabled: true + execution_status: + last_execution_date: '2022-06-08T17:20:31.632Z' + status: pending + id: 41893910-6bca-11eb-9e0d-85d233e3ee35 + muted_alert_ids: [] + mute_all: false + name: my rule + notify_when: onActionGroupChange + params: + aggType: avg + termSize: 6 + thresholdComparator: ">" + timeWindowSize: 5 + timeWindowUnit: m + groupBy: top + threshold: + - 1000 + index: + - ".test-index" + timeField: "@timestamp" + aggField: sheet.version + termField: name.keyword + rule_type_id: .index-threshold + schedule: + interval: 1m + scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35 + tags: + - cpu + throttle: null + updated_at: '2022-06-08T17:20:31.632Z' + updated_by: elastic \ No newline at end of file diff --git a/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml index de593e31724ed..464645358990a 100644 --- a/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml +++ b/x-pack/plugins/alerting/docs/openapi/components/examples/update_rule_request.yaml @@ -10,7 +10,7 @@ value: timeWindowUnit: m thresholdComparator: ">" threshold: [1000] - aggField : sheet.version + aggField: sheet.version termField: name.keyword termSize: 6 schedule: diff --git a/x-pack/plugins/alerting/docs/openapi/components/headers/kbn_xsrf.yaml b/x-pack/plugins/alerting/docs/openapi/components/headers/kbn_xsrf.yaml index 3d8dfae634e68..fe0402a43aa03 100644 --- a/x-pack/plugins/alerting/docs/openapi/components/headers/kbn_xsrf.yaml +++ b/x-pack/plugins/alerting/docs/openapi/components/headers/kbn_xsrf.yaml @@ -2,4 +2,5 @@ schema: type: string in: header name: kbn-xsrf +description: Cross-site request forgery protection required: true diff --git a/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml b/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml new file mode 100644 index 0000000000000..e916f02227ea0 --- /dev/null +++ b/x-pack/plugins/alerting/docs/openapi/components/schemas/create_rule_request.yaml @@ -0,0 +1,45 @@ +title: Create rule request +description: >- + The create rule API request body varies depending on the type of rule and actions. +type: object +required: + - consumer + - name + - notify_when + - params + - rule_type_id + - schedule +properties: + actions: + $ref: 'actions.yaml' + consumer: + type: string + description: > + The name of the application or feature that owns the rule. For example: + `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, + `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`. + enabled: + type: boolean + description: Indicates whether you want to run the rule on an interval basis after it is created. + name: + type: string + description: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule. + example: cluster_health_rule + notify_when: + $ref: 'notify_when.yaml' + params: + type: object + description: The parameters for the rule. + additionalProperties: true + rule_type_id: + type: string + description: > + The ID of the rule type that you want to call when the rule is scheduled to run. + For example, `.es-query`, `.index-threshold`, `logs.alert.document.count`, + `monitoring_alert_cluster_health`, `siem.thresholdRule`, or `xpack.ml.anomaly_detection_alert`. + schedule: + $ref: 'schedule.yaml' + tags: + $ref: 'tags.yaml' + throttle: + $ref: 'throttle.yaml' \ No newline at end of file diff --git a/x-pack/plugins/alerting/docs/openapi/paths/s@{spaceid}@api@alerting@rule@{ruleid}.yaml b/x-pack/plugins/alerting/docs/openapi/paths/s@{spaceid}@api@alerting@rule@{ruleid}.yaml index 91ef40aa0c2e9..01ca92a7d0cd1 100644 --- a/x-pack/plugins/alerting/docs/openapi/paths/s@{spaceid}@api@alerting@rule@{ruleid}.yaml +++ b/x-pack/plugins/alerting/docs/openapi/paths/s@{spaceid}@api@alerting@rule@{ruleid}.yaml @@ -71,6 +71,69 @@ delete: servers: - url: https://localhost:5601 +post: + summary: Creates a rule. + operationId: createRule + description: > + You must have `all` privileges for the appropriate Kibana features, + depending on the `consumer` and `rule_type_id` of the rule you're creating. + For example, you must have privileges for the **Management > Stack rules** + feature, **Analytics > Discover** and **Machine Learning** features, + **Observability** features, or **Security** features. If the rule has + actions, you must also have `read` privileges for the + **Management > Actions and Connectors** feature. NOTE: This API supports + only token-based authentication. When you create a rule, it identifies which + roles you have at that point in time. Thereafter, when the rule performs + queries, it uses those security privileges. If a user with different + privileges updates the rule, its behavior might change. + tags: + - alerting + parameters: + - $ref: ../components/headers/kbn_xsrf.yaml + - $ref: '../components/parameters/space_id.yaml' + - in: path + name: ruleId + description: > + An UUID v1 or v4 identifier for the rule. If you omit this parameter, + an identifier is randomly generated. + required: true + schema: + type: string + example: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74 + requestBody: + required: true + content: + application/json: + schema: + $ref: '../components/schemas/create_rule_request.yaml' + examples: + createCaseRequest: + $ref: '../components/examples/create_rule_request.yaml' + responses: + '200': + description: Indicates a successful call. + content: + application/json: + schema: + $ref: '../components/schemas/rule_response_properties.yaml' + examples: + createRuleResponse: + $ref: '../components/examples/create_rule_response.yaml' + '401': + description: Authorization information is missing or invalid. + content: + application/json: + schema: + $ref: '../components/schemas/401_response.yaml' + '404': + description: Object is not found. + content: + application/json: + schema: + $ref: '../components/schemas/404_response.yaml' + servers: + - url: https://localhost:5601 + put: summary: Updates the attributes for a rule. operationId: updateRule diff --git a/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts b/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts index d6474f0523e25..0cc910a4af2f0 100644 --- a/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts +++ b/x-pack/plugins/alerting/server/routes/lib/rewrite_rule.ts @@ -63,9 +63,11 @@ export const rewriteRule = ({ connector_type_id: actionTypeId, ...(frequency ? { - summary: frequency.summary, - notify_when: frequency.notifyWhen, - throttle: frequency.throttle, + frequency: { + summary: frequency.summary, + notify_when: frequency.notifyWhen, + throttle: frequency.throttle, + }, } : {}), })), diff --git a/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts b/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts index 30b759c895c46..4909a71b89b8c 100644 --- a/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts +++ b/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts @@ -5,8 +5,9 @@ * 2.0. */ -import { EcsEventOutcome, EcsEventType } from '@kbn/core/server'; +import { EcsEvent } from '@kbn/core/server'; import { AuditEvent } from '@kbn/security-plugin/server'; +import { ArrayElement } from '@kbn/utility-types'; export enum RuleAuditAction { CREATE = 'rule_create', @@ -82,7 +83,7 @@ const eventVerbs: Record = { ], }; -const eventTypes: Record = { +const eventTypes: Record> = { rule_create: 'creation', rule_get: 'access', rule_resolve: 'access', @@ -110,7 +111,7 @@ const eventTypes: Record = { export interface RuleAuditEventParams { action: RuleAuditAction; - outcome?: EcsEventOutcome; + outcome?: EcsEvent['outcome']; savedObject?: NonNullable['saved_object']; error?: Error; } diff --git a/x-pack/plugins/alerting/server/rules_client/methods/bulk_disable.ts b/x-pack/plugins/alerting/server/rules_client/methods/bulk_disable.ts index 5a79a38c767fd..06efa425eccef 100644 --- a/x-pack/plugins/alerting/server/rules_client/methods/bulk_disable.ts +++ b/x-pack/plugins/alerting/server/rules_client/methods/bulk_disable.ts @@ -229,7 +229,7 @@ const tryToDisableTasks = async ({ if (resultFromDisablingTasks.errors.length) { logger.error( `Failure to disable schedules for underlying tasks: ${resultFromDisablingTasks.errors - .map((error) => error.task.id) + .map((error) => error.id) .join(', ')}` ); } diff --git a/x-pack/plugins/alerting/server/rules_client/methods/bulk_enable.ts b/x-pack/plugins/alerting/server/rules_client/methods/bulk_enable.ts index 16107ca8a3e9a..4ce189c6caca6 100644 --- a/x-pack/plugins/alerting/server/rules_client/methods/bulk_enable.ts +++ b/x-pack/plugins/alerting/server/rules_client/methods/bulk_enable.ts @@ -253,7 +253,7 @@ export const tryToEnableTasks = async ({ async () => taskManager.bulkEnable(taskIdsToEnable) ); resultFromEnablingTasks?.errors?.forEach((error) => { - taskIdsFailedToBeEnabled.push(error.task.id); + taskIdsFailedToBeEnabled.push(error.id); }); if (resultFromEnablingTasks.tasks.length) { logger.debug( @@ -265,7 +265,7 @@ export const tryToEnableTasks = async ({ if (resultFromEnablingTasks.errors.length) { logger.error( `Failure to enable schedules for underlying tasks: ${resultFromEnablingTasks.errors - .map((error) => error.task.id) + .map((error) => error.id) .join(', ')}` ); } diff --git a/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts index 7d35c1e12c57e..fb5995f8724aa 100644 --- a/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts +++ b/x-pack/plugins/alerting/server/rules_client/tests/bulk_disable.test.ts @@ -352,10 +352,11 @@ describe('bulkDisableRules', () => { }); taskManager.bulkDisable.mockResolvedValue({ - tasks: [{ id: 'id1' }], + tasks: [taskManagerMock.createTask({ id: 'id1' })], errors: [ { - task: { id: 'id2' }, + type: 'task', + id: 'id2', error: { error: '', message: 'UPS', @@ -363,7 +364,7 @@ describe('bulkDisableRules', () => { }, }, ], - } as unknown as BulkUpdateTaskResult); + }); await rulesClient.bulkDisableRules({ filter: 'fake_filter' }); diff --git a/x-pack/plugins/alerting/server/rules_client/tests/bulk_enable.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/bulk_enable.test.ts index dcb8b6e512c3f..eaa302e41ac85 100644 --- a/x-pack/plugins/alerting/server/rules_client/tests/bulk_enable.test.ts +++ b/x-pack/plugins/alerting/server/rules_client/tests/bulk_enable.test.ts @@ -383,24 +383,20 @@ describe('bulkEnableRules', () => { unsecuredSavedObjectsClient.bulkCreate.mockResolvedValue({ saved_objects: [enabledRule1, enabledRule2], }); - taskManager.bulkEnable.mockImplementation( - async () => - ({ - tasks: [{ id: 'id1' }], - errors: [ - { - task: { - id: 'id2', - }, - error: { - error: '', - message: 'UPS', - statusCode: 500, - }, - }, - ], - } as unknown as BulkUpdateTaskResult) - ); + taskManager.bulkEnable.mockImplementation(async () => ({ + tasks: [taskManagerMock.createTask({ id: 'id1' })], + errors: [ + { + type: 'task', + id: 'id2', + error: { + error: '', + message: 'UPS', + statusCode: 500, + }, + }, + ], + })); const result = await rulesClient.bulkEnableRules({ filter: 'fake_filter' }); diff --git a/x-pack/plugins/alerting/server/task_runner/task_runner.ts b/x-pack/plugins/alerting/server/task_runner/task_runner.ts index ae9b8fab80426..aa07922aa7418 100644 --- a/x-pack/plugins/alerting/server/task_runner/task_runner.ts +++ b/x-pack/plugins/alerting/server/task_runner/task_runner.ts @@ -487,6 +487,7 @@ export class TaskRunner< if (apm.currentTransaction) { apm.currentTransaction.name = `Execute Alerting Rule`; apm.currentTransaction.addLabels({ + alerting_rule_space_id: spaceId, alerting_rule_id: ruleId, }); } diff --git a/x-pack/plugins/apm/server/routes/fleet/api_keys/create_apm_api_keys.ts b/x-pack/plugins/apm/server/routes/fleet/api_keys/create_apm_api_keys.ts index 0f78985b419b1..7f69b7525e214 100644 --- a/x-pack/plugins/apm/server/routes/fleet/api_keys/create_apm_api_keys.ts +++ b/x-pack/plugins/apm/server/routes/fleet/api_keys/create_apm_api_keys.ts @@ -6,6 +6,10 @@ */ import { CoreStart, Logger } from '@kbn/core/server'; +import { + APM_AGENT_CONFIGURATION_INDEX, + APM_SOURCE_MAP_INDEX, +} from '../../settings/apm_indices/get_apm_indices'; const apiKeyMetadata = { application: 'apm', @@ -41,7 +45,7 @@ export async function createApmSourceMapApiKey({ apmSystemIndices: { index: [ { - names: ['.apm-source-map'], + names: [APM_SOURCE_MAP_INDEX], privileges: indexLevelPrivileges, allow_restricted_indices: true, }, @@ -82,7 +86,7 @@ export async function createApmAgentConfigApiKey({ apmSystemIndices: { index: [ { - names: ['.apm-agent-configuration'], + names: [APM_AGENT_CONFIGURATION_INDEX], privileges: indexLevelPrivileges, allow_restricted_indices: true, }, diff --git a/x-pack/plugins/apm/server/routes/source_maps/schedule_source_map_migration.ts b/x-pack/plugins/apm/server/routes/source_maps/schedule_source_map_migration.ts index d7323dd7e2eb7..08c8a29ef6712 100644 --- a/x-pack/plugins/apm/server/routes/source_maps/schedule_source_map_migration.ts +++ b/x-pack/plugins/apm/server/routes/source_maps/schedule_source_map_migration.ts @@ -41,8 +41,7 @@ export async function scheduleSourceMapMigration({ taskManager.registerTaskDefinitions({ [TASK_TYPE]: { title: 'Migrate fleet source map artifacts', - description: - 'Migrates fleet source map artifacts to `.apm-source-map` index', + description: `Migrates fleet source map artifacts to "${APM_SOURCE_MAP_INDEX}" index`, timeout: '1h', maxAttempts: 5, maxConcurrency: 1, diff --git a/x-pack/plugins/canvas/scripts/shareable_runtime.js b/x-pack/plugins/canvas/scripts/shareable_runtime.js index f3e1e66c1744a..a0b8421f8da01 100644 --- a/x-pack/plugins/canvas/scripts/shareable_runtime.js +++ b/x-pack/plugins/canvas/scripts/shareable_runtime.js @@ -55,7 +55,6 @@ run( execa.sync( process.execPath, [ - '--openssl-legacy-provider', require.resolve('webpack-dev-server/bin/webpack-dev-server'), '--config', webpackConfig, @@ -89,7 +88,6 @@ run( execa.sync( process.execPath, [ - '--openssl-legacy-provider', require.resolve('webpack/bin/webpack'), '--config', webpackConfig, diff --git a/x-pack/plugins/cases/common/api/connectors/get_connectors.ts b/x-pack/plugins/cases/common/api/connectors/get_connectors.ts index 1025da7439d3b..5c29d585287da 100644 --- a/x-pack/plugins/cases/common/api/connectors/get_connectors.ts +++ b/x-pack/plugins/cases/common/api/connectors/get_connectors.ts @@ -14,13 +14,11 @@ const CaseConnectorPushInfoRt = rt.intersection([ needsToBePushed: rt.boolean, hasBeenPushed: rt.boolean, }), - rt.partial( - rt.type({ - latestUserActionPushDate: rt.string, - oldestUserActionPushDate: rt.string, - externalService: CaseExternalServiceBasicRt, - }).props - ), + rt.partial({ + latestUserActionPushDate: rt.string, + oldestUserActionPushDate: rt.string, + externalService: CaseExternalServiceBasicRt, + }), ]); export const GetCaseConnectorsResponseRt = rt.record( diff --git a/x-pack/plugins/cases/server/authorization/audit_logger.ts b/x-pack/plugins/cases/server/authorization/audit_logger.ts index 88293689446f8..338af379bbcc7 100644 --- a/x-pack/plugins/cases/server/authorization/audit_logger.ts +++ b/x-pack/plugins/cases/server/authorization/audit_logger.ts @@ -5,7 +5,7 @@ * 2.0. */ -import type { EcsEventOutcome } from '@kbn/core/server'; +import type { EcsEvent } from '@kbn/core/server'; import type { AuditEvent, AuditLogger } from '@kbn/security-plugin/server'; import type { OperationDetails } from '.'; import { DATABASE_CATEGORY, ECS_OUTCOMES, isWriteOperation } from '.'; @@ -39,7 +39,7 @@ export class AuthorizationAuditLogger { const ownerText = entity?.owner === undefined ? 'as any owners' : `as owner "${entity.owner}"`; let message: string; - let outcome: EcsEventOutcome; + let outcome: EcsEvent['outcome']; if (error) { message = `Failed attempt to ${operation.verbs.present} ${doc} ${ownerText}`; diff --git a/x-pack/plugins/cases/server/authorization/index.ts b/x-pack/plugins/cases/server/authorization/index.ts index 392974fa56979..75fa465b4813e 100644 --- a/x-pack/plugins/cases/server/authorization/index.ts +++ b/x-pack/plugins/cases/server/authorization/index.ts @@ -5,8 +5,9 @@ * 2.0. */ -import type { EcsEventCategory, EcsEventOutcome, EcsEventType } from '@kbn/core/server'; +import type { EcsEvent } from '@kbn/core/server'; import type { CasesSupportedOperations } from '@kbn/security-plugin/server'; +import type { ArrayElement } from '@kbn/utility-types'; import { CASE_COMMENT_SAVED_OBJECT, CASE_CONFIGURE_SAVED_OBJECT, @@ -44,7 +45,7 @@ const deleteVerbs: Verbs = { past: 'deleted', }; -const EVENT_TYPES: Record = { +const EVENT_TYPES: Record> = { creation: 'creation', deletion: 'deletion', change: 'change', @@ -65,12 +66,12 @@ const ACCESS_USER_ACTION_OPERATION: CasesSupportedOperations = 'getUserActions'; /** * Database constant for ECS category for use for audit logging. */ -export const DATABASE_CATEGORY: EcsEventCategory[] = ['database']; +export const DATABASE_CATEGORY: EcsEvent['category'] = ['database']; /** * ECS Outcomes for audit logging. */ -export const ECS_OUTCOMES: Record = { +export const ECS_OUTCOMES: Record = { failure: 'failure', success: 'success', unknown: 'unknown', diff --git a/x-pack/plugins/cases/server/authorization/types.ts b/x-pack/plugins/cases/server/authorization/types.ts index 57735803e69bf..2332fd51df81c 100644 --- a/x-pack/plugins/cases/server/authorization/types.ts +++ b/x-pack/plugins/cases/server/authorization/types.ts @@ -5,9 +5,10 @@ * 2.0. */ -import type { EcsEventType } from '@kbn/core/server'; +import type { EcsEvent } from '@kbn/core/server'; import type { KueryNode } from '@kbn/es-query'; import type { CasesSupportedOperations } from '@kbn/security-plugin/server'; +import type { ArrayElement } from '@kbn/utility-types'; /** * The tenses for describing the action performed by a API route @@ -73,7 +74,7 @@ export interface OperationDetails { /** * The ECS event type that this operation should be audit logged as (creation, deletion, access, etc) */ - ecsType: EcsEventType; + ecsType: ArrayElement; /** * The name of the operation to authorize against for the privilege check. * These values need to match one of the operation strings defined here: x-pack/plugins/security/server/authorization/privileges/feature_privilege_builder/cases.ts diff --git a/x-pack/plugins/cases/server/services/user_actions/audit_logger.ts b/x-pack/plugins/cases/server/services/user_actions/audit_logger.ts index 82a016d2a0c3e..af3599c11c67b 100644 --- a/x-pack/plugins/cases/server/services/user_actions/audit_logger.ts +++ b/x-pack/plugins/cases/server/services/user_actions/audit_logger.ts @@ -5,12 +5,13 @@ * 2.0. */ -import type { EcsEventType } from '@kbn/ecs'; +import type { EcsEvent } from '@kbn/ecs'; import type { AuditLogger } from '@kbn/security-plugin/server'; +import type { ArrayElement } from '@kbn/utility-types'; import type { UserAction as Action } from '../../../common/api'; import type { EventDetails } from './types'; -const actionsToEcsType: Record = { +const actionsToEcsType: Record> = { add: 'change', delete: 'deletion', create: 'creation', @@ -31,7 +32,7 @@ export class UserActionAuditLogger { event: { action: event.descriptiveAction, category: ['database'], - type: [actionsToEcsType[event.action]], + type: [actionsToEcsType[event.action] as string], outcome: 'success', }, kibana: { diff --git a/x-pack/plugins/cloud_defend/public/components/control_general_view/index.test.tsx b/x-pack/plugins/cloud_defend/public/components/control_general_view/index.test.tsx index 0a0b05d35b32b..1d221f49f866f 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_general_view/index.test.tsx +++ b/x-pack/plugins/cloud_defend/public/components/control_general_view/index.test.tsx @@ -10,7 +10,7 @@ import { render, waitFor } from '@testing-library/react'; import { coreMock } from '@kbn/core/public/mocks'; import userEvent from '@testing-library/user-event'; import { TestProvider } from '../../test/test_provider'; -import { getCloudDefendNewPolicyMock } from '../../test/mocks'; +import { getCloudDefendNewPolicyMock, MOCK_YAML_INVALID_CONFIGURATION } from '../../test/mocks'; import { ControlGeneralView } from '.'; import { getInputFromPolicy } from '../../common/utils'; import { INPUT_CONTROL } from '../../../common/constants'; @@ -106,4 +106,13 @@ describe('', () => { expect(getByTitle('Remove excludeCustomNginxBuild3 from selection in this group')).toBeTruthy(); }); + + it('doesnt blow up if invalid yaml passed in', async () => { + const { queryAllByTestId } = render( + + ); + + expect(queryAllByTestId('cloud-defend-selector')).toHaveLength(0); + expect(queryAllByTestId('cloud-defend-response')).toHaveLength(0); + }); }); diff --git a/x-pack/plugins/cloud_defend/public/components/control_general_view/index.tsx b/x-pack/plugins/cloud_defend/public/components/control_general_view/index.tsx index 9fc8add9640ce..01f2affa09c5d 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_general_view/index.tsx +++ b/x-pack/plugins/cloud_defend/public/components/control_general_view/index.tsx @@ -42,7 +42,7 @@ export const ControlGeneralView = ({ policy, onChange, show }: ViewDeps) => { try { const result = yaml.load(configuration); - if (result) { + if (result && result.hasOwnProperty('selectors') && result.hasOwnProperty('responses')) { return result; } } catch { @@ -77,8 +77,11 @@ export const ControlGeneralView = ({ policy, onChange, show }: ViewDeps) => { const incrementName = useCallback( (name: string): string => { // increment name using ints - const lastChar = parseInt(name.slice(-1), 10); - const newName = isNaN(lastChar) ? name + '1' : name.slice(0, -1) + (lastChar + 1); + const numberSuffix = name.search(/\d+$/); + const newName = + numberSuffix !== -1 + ? name.slice(0, numberSuffix) + (parseInt(name.slice(numberSuffix), 10) + 1) + : name + '1'; const dupe = selectors.find((selector) => selector.name === newName); if (dupe) { diff --git a/x-pack/plugins/cloud_defend/public/components/control_general_view/translations.ts b/x-pack/plugins/cloud_defend/public/components/control_general_view/translations.ts index d97789e8f9e9a..26c77aa6aa74b 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_general_view/translations.ts +++ b/x-pack/plugins/cloud_defend/public/components/control_general_view/translations.ts @@ -76,6 +76,10 @@ export const name = i18n.translate('xpack.cloudDefend.name', { defaultMessage: 'Name', }); +export const errorConditionRequired = i18n.translate('xpack.cloudDefend.errorConditionRequired', { + defaultMessage: 'At least one condition per selector is required.', +}); + export const errorDuplicateName = i18n.translate('xpack.cloudDefend.errorDuplicateName', { defaultMessage: 'This name is already used by another selector.', }); diff --git a/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.test.tsx b/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.test.tsx index 71e33c7005af1..35f1a418725a0 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.test.tsx +++ b/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.test.tsx @@ -118,21 +118,33 @@ describe('', () => { expect(updatedOptions[0]).not.toHaveTextContent('containerImageName'); }); - it('ensures at least one condition is provided, and a value specified', async () => { - const { getByText, getByTestId } = render(); + it('shows an error if no conditions are added', async () => { + const { getByText, getByTestId, rerender } = render(); userEvent.click(getByTestId('cloud-defend-btnremovecondition-operation')); - expect(onChange.mock.calls).toHaveLength(0); // because operation is the only condition, it should not have been removed. + const updatedSelector: ControlSelector = { ...onChange.mock.calls[0][0] }; + + rerender(); + + await waitFor(() => expect(getByText(i18n.errorConditionRequired)).toBeTruthy()); + + expect(onChange.mock.calls[0][0]).toHaveProperty('hasErrors'); + }); + it('shows an error if no values provided for condition', async () => { + const { getByText, getByTestId } = render(); const addConditionBtn = getByTestId('cloud-defend-btnaddselectorcondition'); + + userEvent.click(getByTestId('cloud-defend-btnremovecondition-operation')); userEvent.click(addConditionBtn); await waitFor(() => userEvent.click(getByText('Container image name'))); // add containerImageName - expect(onChange.mock.calls).toHaveLength(1); - expect(onChange.mock.calls[0][0]).toHaveProperty('containerImageName'); - expect(onChange.mock.calls[0][0]).toHaveProperty('hasErrors'); + expect(onChange.mock.calls).toHaveLength(2); + expect(onChange.mock.calls[1][0]).toHaveProperty('containerImageName'); + expect(onChange.mock.calls[1][0]).toHaveProperty('hasErrors'); + expect(getByText(i18n.errorValueRequired)).toBeTruthy(); }); it('prevents conditions from having values that exceed MAX_CONDITION_VALUE_LENGTH_BYTES', async () => { diff --git a/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.tsx b/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.tsx index 509c0e1b3069f..1bcedbe13cc4a 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.tsx +++ b/x-pack/plugins/cloud_defend/public/components/control_general_view_selector/index.tsx @@ -64,6 +64,14 @@ export const ControlGeneralViewSelector = ({ setAddConditionOpen(false); }, []); + const remainingProps = useMemo(() => { + return Object.keys(ControlSelectorCondition).filter( + (condition) => !selector.hasOwnProperty(condition) + ); + }, [selector]); + + const conditionsAdded = Object.keys(ControlSelectorCondition).length - remainingProps.length; + const onRemoveClicked = useCallback(() => { // we prevent the removal of the last selector to avoid an empty state if (selectors.length > 1) { @@ -106,11 +114,11 @@ export const ControlGeneralViewSelector = ({ const updatedSelector = { ...selector }; updatedSelector.name = value; - updatedSelector.hasErrors = Object.keys(errorMap).length > 0; + updatedSelector.hasErrors = Object.keys(errorMap).length > 0 || conditionsAdded === 0; onChange(updatedSelector, index); }, - [errorMap, index, onChange, selector, selectors] + [errorMap, index, conditionsAdded, onChange, selector, selectors] ); const onChangeCondition = useCallback( @@ -140,12 +148,12 @@ export const ControlGeneralViewSelector = ({ delete errorMap[prop]; } - updatedSelector.hasErrors = Object.keys(errorMap).length > 0; + updatedSelector.hasErrors = Object.keys(errorMap).length > 0 || conditionsAdded === 0; setErrorMap({ ...errorMap }); onChange(updatedSelector, index); }, - [errorMap, index, onChange, selector] + [errorMap, index, conditionsAdded, onChange, selector] ); const onAddCondition = useCallback( @@ -163,12 +171,12 @@ export const ControlGeneralViewSelector = ({ delete errorMap[prop]; setErrorMap({ ...errorMap }); - updatedSelector.hasErrors = Object.keys(errorMap).length > 0; + updatedSelector.hasErrors = Object.keys(errorMap).length > 0 || conditionsAdded === 1; onChange(updatedSelector, index); closeAddCondition(); }, - [closeAddCondition, errorMap, index, onChange, selector] + [closeAddCondition, conditionsAdded, errorMap, index, onChange, selector] ); const onAddValueToCondition = useCallback( @@ -184,18 +192,16 @@ export const ControlGeneralViewSelector = ({ ); const errors = useMemo(() => { - return Object.keys(errorMap).reduce((prev, current) => { + const errs = Object.keys(errorMap).reduce((prev, current) => { return prev.concat(errorMap[current]); }, []); - }, [errorMap]); - const remainingProps = useMemo(() => { - return Object.keys(ControlSelectorCondition).filter( - (condition) => !selector.hasOwnProperty(condition) - ); - }, [selector]); + if (conditionsAdded === 0) { + errs.push(i18n.errorConditionRequired); + } - const conditionsAdded = Object.keys(ControlSelectorCondition).length - remainingProps.length; + return errs; + }, [errorMap, conditionsAdded]); return ( onRemoveCondition(prop)} aria-label="Remove condition" diff --git a/x-pack/plugins/cloud_defend/public/components/control_settings/index.tsx b/x-pack/plugins/cloud_defend/public/components/control_settings/index.tsx index 56fc053308218..b673d745c4935 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_settings/index.tsx +++ b/x-pack/plugins/cloud_defend/public/components/control_settings/index.tsx @@ -29,7 +29,7 @@ export const ControlSettings = ({ policy, onChange }: SettingsDeps) => { const isGeneralViewSelected = viewMode === VIEW_MODE_GENERAL; const isYamlViewSelected = viewMode === VIEW_MODE_YAML; - const onChanges = useCallback( + const onGeneralChanges = useCallback( (opts: OnChangeDeps) => { opts.updatedPolicy = policy; onChange(opts); @@ -38,6 +38,17 @@ export const ControlSettings = ({ policy, onChange }: SettingsDeps) => { [onChange, policy] ); + const onYamlChanges = useCallback( + (opts: OnChangeDeps) => { + if (isYamlViewSelected) { + opts.updatedPolicy = policy; + onChange(opts); + setIsValid(opts.isValid); + } + }, + [isYamlViewSelected, onChange, policy] + ); + return ( @@ -63,8 +74,17 @@ export const ControlSettings = ({ policy, onChange }: SettingsDeps) => { - - + {/** general view removed from DOM for performance and to avoid errors when invalid yaml is passed to it**/} + {isGeneralViewSelected && ( + + )} + {/** Yaml view is kept in the dom at all times to prevent some sizing/rendering issues. + Also only listening for changes if yaml view visible to avoid isValid race condition **/} + ); diff --git a/x-pack/plugins/cloud_defend/public/components/control_yaml_view/translations.ts b/x-pack/plugins/cloud_defend/public/components/control_yaml_view/translations.ts index f183a02e1fb3f..30679b5f60edf 100644 --- a/x-pack/plugins/cloud_defend/public/components/control_yaml_view/translations.ts +++ b/x-pack/plugins/cloud_defend/public/components/control_yaml_view/translations.ts @@ -13,6 +13,5 @@ export const errorAlertActionRequired = i18n.translate('xpack.cloudDefend.alertA }); export const controlYamlHelp = i18n.translate('xpack.cloudDefend.controlYamlHelp', { - defaultMessage: - 'Configure BPF/LSM controls by creating selectors, and responses below. To learn more click ', + defaultMessage: 'Configure BPF/LSM controls by creating selectors, and responses below.', }); diff --git a/x-pack/plugins/cloud_defend/public/test/mocks.ts b/x-pack/plugins/cloud_defend/public/test/mocks.ts index 9a9f707cf2354..7dcf8d99d9116 100644 --- a/x-pack/plugins/cloud_defend/public/test/mocks.ts +++ b/x-pack/plugins/cloud_defend/public/test/mocks.ts @@ -38,8 +38,7 @@ responses: `; export const MOCK_YAML_INVALID_CONFIGURATION = ` -selectrs: -reeesponses: +s `; export const getCloudDefendNewPolicyMock = (yaml = MOCK_YAML_CONFIGURATION): NewPackagePolicy => ({ diff --git a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/curations_table.test.tsx b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/curations_table.test.tsx index 3d98b684f8dfc..d86cb8592635a 100644 --- a/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/curations_table.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/app_search/components/curations/components/curations_table.test.tsx @@ -84,8 +84,8 @@ describe('CurationsTable', () => { expect(tableContent).toContain('mountains, valleys'); expect(tableContent).toContain('Last updated'); - expect(tableContent).toContain('Jan 1, 1970 12:00 PM'); - expect(tableContent).toContain('Jan 2, 1970 12:00 PM'); + expect(tableContent).toContain('Jan 1, 1970 12:00 PM'); + expect(tableContent).toContain('Jan 2, 1970 12:00 PM'); }); it('renders queries with curation links and curation suggestion badges', () => { diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx index 6bdb73a074d4b..1c419704aa27d 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/components/tables/engines_table.tsx @@ -9,9 +9,15 @@ import React from 'react'; import { useValues } from 'kea'; -import { CriteriaWithPagination, EuiBasicTable, EuiBasicTableColumn } from '@elastic/eui'; +import { + CriteriaWithPagination, + EuiBasicTable, + EuiBasicTableColumn, + EuiButtonEmpty, +} from '@elastic/eui'; import { i18n } from '@kbn/i18n'; +import { FormattedMessage } from '@kbn/i18n-react'; import { EnterpriseSearchEngine } from '../../../../../../../common/types/engines'; import { MANAGE_BUTTON_LABEL } from '../../../../../shared/constants'; @@ -25,7 +31,6 @@ import { ENGINE_PATH } from '../../../../routes'; import { convertMetaToPagination, Meta } from '../../types'; -// add health status interface EnginesListTableProps { enginesList: EnterpriseSearchEngine[]; isLoading?: boolean; @@ -33,6 +38,7 @@ interface EnginesListTableProps { meta: Meta; onChange: (criteria: CriteriaWithPagination) => void; onDelete: (engine: EnterpriseSearchEngine) => void; + viewEngineIndices: (engineName: string) => void; } export const EnginesListTable: React.FC = ({ enginesList, @@ -40,6 +46,7 @@ export const EnginesListTable: React.FC = ({ meta, onChange, onDelete, + viewEngineIndices, }) => { const { navigateToUrl } = useValues(KibanaLogic); const columns: Array> = [ @@ -74,11 +81,28 @@ export const EnginesListTable: React.FC = ({ render: (dateString: string) => , }, { - field: 'indices.length', - datatype: 'number', + field: 'indices', name: i18n.translate('xpack.enterpriseSearch.content.enginesList.table.column.indices', { defaultMessage: 'Indices', }), + align: 'right', + + render: (indices: string[], engine) => ( + viewEngineIndices(engine.name)} + > + + + ), }, { diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts index 9a512c07b9cb4..d661e10f16c8c 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engine_list_logic.test.ts @@ -127,6 +127,7 @@ describe('EnginesListLogic', () => { }); }); }); + describe('reducers', () => { describe('meta', () => { it('updates when apiSuccess', () => { diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx index e9bded754116c..cf97afc5673ec 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list.tsx @@ -16,6 +16,7 @@ import { i18n } from '@kbn/i18n'; import { FormattedMessage, FormattedNumber } from '@kbn/i18n-react'; import { INPUT_THROTTLE_DELAY_MS } from '../../../shared/constants/timers'; + import { DataPanel } from '../../../shared/data_panel/data_panel'; import { EnterpriseSearchEnginesPageTemplate } from '../layout/engines_page_template'; @@ -24,6 +25,8 @@ import { EmptyEnginesPrompt } from './components/empty_engines_prompt'; import { EnginesListTable } from './components/tables/engines_table'; import { CreateEngineFlyout } from './create_engine_flyout'; import { DeleteEngineModal } from './delete_engine_modal'; +import { EngineListIndicesFlyout } from './engines_list_flyout'; +import { EnginesListFlyoutLogic } from './engines_list_flyout_logic'; import { EnginesListLogic } from './engines_list_logic'; const CreateButton: React.FC = () => { @@ -46,6 +49,7 @@ const CreateButton: React.FC = () => { export const EnginesList: React.FC = () => { const { closeEngineCreate, fetchEngines, onPaginate, openDeleteEngineModal, setSearchQuery } = useActions(EnginesListLogic); + const { openFetchEngineFlyout } = useActions(EnginesListFlyoutLogic); const { isLoading, meta, results, createEngineFlyoutOpen, searchQuery } = useValues(EnginesListLogic); @@ -58,6 +62,8 @@ export const EnginesList: React.FC = () => { return ( <> + + {createEngineFlyoutOpen && } { meta={meta} onChange={onPaginate} onDelete={openDeleteEngineModal} + viewEngineIndices={openFetchEngineFlyout} loading={false} /> diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout.tsx new file mode 100644 index 0000000000000..db1ebaf088a00 --- /dev/null +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout.tsx @@ -0,0 +1,161 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; + +import { useValues, useActions } from 'kea'; + +import { + EuiBasicTable, + EuiBasicTableColumn, + EuiFlyout, + EuiFlyoutBody, + EuiFlyoutHeader, + EuiIcon, + EuiSpacer, + EuiText, + EuiTitle, +} from '@elastic/eui'; + +import { i18n } from '@kbn/i18n'; + +import { FormattedMessage } from '@kbn/i18n-react'; + +import { Status } from '../../../../../common/types/api'; + +import { EnterpriseSearchEngineIndex } from '../../../../../common/types/engines'; + +import { healthColorsMap } from '../../../shared/constants/health_colors'; +import { generateEncodedPath } from '../../../shared/encode_path_params'; +import { EuiLinkTo } from '../../../shared/react_router_helpers'; +import { SEARCH_INDEX_PATH } from '../../routes'; +import { IngestionMethod } from '../../types'; +import { ingestionMethodToText } from '../../utils/indices'; + +import { EngineError } from '../engine/engine_error'; + +import { EnginesListFlyoutLogic } from './engines_list_flyout_logic'; + +export const EngineListIndicesFlyout: React.FC = () => { + const { + fetchEngineData, + fetchEngineName, + isFetchEngineLoading, + isFetchEngineFlyoutVisible, + fetchEngineApiStatus, + fetchEngineApiError, + } = useValues(EnginesListFlyoutLogic); + const { closeFetchIndicesFlyout } = useActions(EnginesListFlyoutLogic); + + if (!fetchEngineData) return null; + const { indices } = fetchEngineData; + const engineFetchError = fetchEngineApiStatus === Status.ERROR ? true : false; + + const columns: Array> = [ + { + field: 'name', + name: i18n.translate( + 'xpack.enterpriseSearch.content.enginesList.indicesFlyout.table.name.columnTitle', + { + defaultMessage: 'Index name', + } + ), + render: (indexName: string) => ( + + {indexName} + + ), + sortable: true, + truncateText: true, + width: '40%', + }, + { + field: 'health', + name: i18n.translate( + 'xpack.enterpriseSearch.content.enginesList.indicesFlyout.table.health.columnTitle', + { + defaultMessage: 'Index health', + } + ), + render: (health: 'red' | 'green' | 'yellow' | 'unavailable') => ( + + +  {health ?? '-'} + + ), + sortable: true, + truncateText: true, + width: '15%', + }, + { + field: 'count', + name: i18n.translate( + 'xpack.enterpriseSearch.content.enginesList.indicesFlyout.table.docsCount.columnTitle', + { + defaultMessage: 'Docs count', + } + ), + sortable: true, + truncateText: true, + width: '15%', + }, + { + field: 'source', + name: i18n.translate( + 'xpack.enterpriseSearch.content.enginesList.indicesFlyout.table.ingestionMethod.columnTitle', + { + defaultMessage: 'Ingestion method', + } + ), + render: (source: IngestionMethod) => ( + {ingestionMethodToText(source)} + ), + truncateText: true, + width: '15%', + }, + ]; + + if (isFetchEngineFlyoutVisible) { + return ( + + + +

    + {i18n.translate('xpack.enterpriseSearch.content.enginesList.indicesFlyout.title', { + defaultMessage: 'View Indices', + })} +

    +     + + + + +     + + + {engineFetchError ? ( + + ) : ( + + )} + +     + ); + } else { + return <>; + } +}; diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout_logic.test.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout_logic.test.ts new file mode 100644 index 0000000000000..a3973565c4306 --- /dev/null +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout_logic.test.ts @@ -0,0 +1,107 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ +import { LogicMounter } from '../../../__mocks__/kea_logic'; + +import { nextTick } from '@kbn/test-jest-helpers'; + +import { Status } from '../../../../../common/types/api'; +import { EnterpriseSearchEngineDetails } from '../../../../../common/types/engines'; + +import { FetchEngineApiLogic } from '../../api/engines/fetch_engine_api_logic'; + +import { EngineListFlyoutValues, EnginesListFlyoutLogic } from './engines_list_flyout_logic'; + +const DEFAULT_VALUES: EngineListFlyoutValues = { + fetchEngineData: undefined, + fetchEngineName: null, + isFetchEngineFlyoutVisible: false, + fetchEngineApiStatus: Status.IDLE, + fetchEngineApiError: undefined, + isFetchEngineLoading: false, +}; +const mockEngineData: EnterpriseSearchEngineDetails = { + created: '1999-12-31T23:59:59Z', + indices: [ + { + count: 10, + health: 'green', + name: 'search-001', + source: 'api', + }, + { + count: 1000, + health: 'yellow', + name: 'search-002', + source: 'crawler', + }, + ], + name: 'my-test-engine', + updated: '1999-12-31T23:59:59Z', +}; + +describe('EngineListFlyoutLogic', () => { + const { mount } = new LogicMounter(EnginesListFlyoutLogic); + const { mount: apiLogicMount } = new LogicMounter(FetchEngineApiLogic); + + beforeEach(() => { + jest.clearAllMocks(); + jest.useRealTimers(); + apiLogicMount(); + mount(); + }); + it('has expected default values', () => { + expect(EnginesListFlyoutLogic.values).toEqual(DEFAULT_VALUES); + }); + + describe('actions', () => { + describe('closeFetchEngineIndicesFlyout', () => { + it('set isFetchEngineFlyoutVisible to false and fetchEngineName to empty string', () => { + EnginesListFlyoutLogic.actions.closeFetchIndicesFlyout(); + expect(EnginesListFlyoutLogic.values).toEqual(DEFAULT_VALUES); + }); + }); + describe('openFetchEngineIndicesFlyout', () => { + it('set isFetchEngineFlyoutVisible to true and sets fetchEngineName to engine name', () => { + EnginesListFlyoutLogic.actions.openFetchEngineFlyout('my-test-engine'); + expect(EnginesListFlyoutLogic.values).toEqual({ + ...DEFAULT_VALUES, + isFetchEngineFlyoutVisible: true, + fetchEngineName: 'my-test-engine', + isFetchEngineLoading: true, + fetchEngineApiStatus: Status.LOADING, + }); + }); + }); + }); + + describe('selectors', () => { + it('receives fetchEngine indices data on success', () => { + expect(EnginesListFlyoutLogic.values).toEqual(DEFAULT_VALUES); + FetchEngineApiLogic.actions.apiSuccess(mockEngineData); + expect(EnginesListFlyoutLogic.values).toEqual({ + ...DEFAULT_VALUES, + fetchEngineApiStatus: Status.SUCCESS, + fetchEngineData: mockEngineData, + }); + }); + }); + describe('listeners', () => { + beforeEach(() => { + FetchEngineApiLogic.actions.apiSuccess(mockEngineData); + }); + it('fetch engines flyout when flyout is visible', async () => { + jest.useFakeTimers({ legacyFakeTimers: true }); + EnginesListFlyoutLogic.actions.openFetchEngineFlyout = jest.fn(); + EnginesListFlyoutLogic.actions.openFetchEngineFlyout('my-test-engine'); + await nextTick(); + expect(EnginesListFlyoutLogic.actions.openFetchEngineFlyout).toHaveBeenCalledTimes(1); + expect(EnginesListFlyoutLogic.actions.openFetchEngineFlyout).toHaveBeenCalledWith( + 'my-test-engine' + ); + }); + }); +}); diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout_logic.ts new file mode 100644 index 0000000000000..8598ecd92ae63 --- /dev/null +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_flyout_logic.ts @@ -0,0 +1,73 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ +import { kea, MakeLogicType } from 'kea'; + +import { Status } from '../../../../../common/types/api'; +import { FetchEngineApiLogic } from '../../api/engines/fetch_engine_api_logic'; +import { EngineViewActions, EngineViewLogic, EngineViewValues } from '../engine/engine_view_logic'; + +export interface EngineListFlyoutValues { + isFetchEngineLoading: EngineViewValues['isLoadingEngine']; + isFetchEngineFlyoutVisible: boolean; + fetchEngineData: EngineViewValues['engineData']; // data from fetchEngineAPI + fetchEngineName: string | null; + fetchEngineApiError?: EngineViewValues['fetchEngineApiError']; + fetchEngineApiStatus: EngineViewValues['fetchEngineApiStatus']; +} +export interface EngineListFlyoutActions { + closeFetchIndicesFlyout(): void; + fetchEngineData: EngineViewActions['fetchEngine'] | null; + openFetchEngineFlyout: (engineName: string) => { engineName: string }; +} + +export const EnginesListFlyoutLogic = kea< + MakeLogicType +>({ + connect: { + actions: [EngineViewLogic, ['fetchEngine as fetchEngine']], + values: [ + EngineViewLogic, + [ + 'engineData as fetchEngineData', + 'fetchEngineApiError as fetchEngineApiError', + 'fetchEngineApiStatus as fetchEngineApiStatus', + ], + ], + }, + actions: { + closeFetchIndicesFlyout: true, + openFetchEngineFlyout: (engineName) => ({ engineName }), + }, + path: ['enterprise_search', 'content', 'engine_list_flyout_logic'], + reducers: ({}) => ({ + fetchEngineName: [ + null, + { + closeFetchIndicesFlyout: () => null, + openFetchEngineFlyout: (_, { engineName }) => engineName, + }, + ], + isFetchEngineFlyoutVisible: [ + false, + { + closeFetchIndicesFlyout: () => false, + openFetchEngineFlyout: () => true, + }, + ], + }), + selectors: ({ selectors }) => ({ + isFetchEngineLoading: [ + () => [selectors.fetchEngineApiStatus], + (status: EngineListFlyoutValues['fetchEngineApiStatus']) => [Status.LOADING].includes(status), + ], + }), + listeners: ({}) => ({ + openFetchEngineFlyout: async (input) => { + FetchEngineApiLogic.actions.makeRequest(input); + }, + }), +}); diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts index 81cf12da12c34..c515ada735d06 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/engines/engines_list_logic.ts @@ -105,6 +105,7 @@ export const EnginesListLogic = kea engine, }, ], + isDeleteModalVisible: [ false, { @@ -112,6 +113,7 @@ export const EnginesListLogic = kea true, }, ], + parameters: [ { meta: DEFAULT_META }, { @@ -137,6 +139,7 @@ export const EnginesListLogic = kea ({ deleteModalEngineName: [() => [selectors.deleteModalEngine], (engine) => engine?.name ?? ''], + isDeleteLoading: [ () => [selectors.deleteStatus], (status: EngineListValues['deleteStatus']) => [Status.LOADING].includes(status), diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.test.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.test.tsx index 9d5205df63534..169e32193036b 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.test.tsx @@ -395,7 +395,7 @@ describe('AddInferencePipelineFlyout', () => { ); const actionButton = wrapper.find(EuiButton); expect(actionButton).toHaveLength(1); - expect(actionButton.prop('children')).toBe('Create'); + expect(actionButton.prop('children')).toBe('Create pipeline'); expect(actionButton.prop('color')).toBe('success'); actionButton.prop('onClick')!({} as any); expect(actions.createPipeline).toHaveBeenCalledTimes(1); diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.tsx index fa397b1b7033a..31668a93433c1 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/add_inference_pipeline_flyout.tsx @@ -89,10 +89,9 @@ export const AddInferencePipelineContent = ({ onClose }: AddInferencePipelineFly const createErrorsHookDep = createErrors.join('|'); useEffect(() => { if (createErrors.length === 0) return; - // TODO - update for flyout - const modalOverflow = document.getElementsByClassName('euiModalBody__overflow'); - if (modalOverflow.length === 0) return; - modalOverflow[0].scrollTop = 0; + const flyoutOverflow = document.getElementsByClassName('euiFlyoutBody__overflow'); + if (flyoutOverflow.length === 0) return; + flyoutOverflow[0].scrollTop = 0; }, [createErrorsHookDep]); if (isLoading) { @@ -278,7 +277,7 @@ export const AddInferencePipelineFooter: React.FC< {i18n.translate( 'xpack.enterpriseSearch.content.indices.transforms.addInferencePipelineModal.footer.create', { - defaultMessage: 'Create', + defaultMessage: 'Create pipeline', } )} diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/configure_pipeline.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/configure_pipeline.tsx index 104562439d325..7847d14c160e1 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/configure_pipeline.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/configure_pipeline.tsx @@ -20,6 +20,7 @@ import { EuiSuperSelect, EuiSuperSelectOption, EuiSpacer, + EuiTitle, EuiText, } from '@elastic/eui'; @@ -123,6 +124,15 @@ export const ConfigurePipeline: React.FC = () => { return ( <> + +

    + {i18n.translate( + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.configure.title', + { defaultMessage: 'Add a new pipeline' } + )} +

    +     +

    {i18n.translate( @@ -275,8 +285,8 @@ export const ConfigurePipeline: React.FC = () => { onChange={(value) => setInferencePipelineConfiguration({ ...configuration, - modelID: value, inferenceConfig: undefined, + modelID: value, }) } options={modelOptions} @@ -287,6 +297,7 @@ export const ConfigurePipeline: React.FC = () => { { isInvalid={emptySourceFields} > { } error={formErrors.destinationField} isInvalid={formErrors.destinationField !== undefined} + fullWidth > { destinationField: e.target.value, }) } + fullWidth /> diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts index 5bddfbc545b53..ea586a6d31360 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/ml_inference_logic.ts @@ -128,6 +128,10 @@ interface MLInferenceProcessorsActions { FetchMlInferencePipelinesResponse >['makeRequest']; mappingsApiError: Actions['apiError']; + mlInferencePipelinesSuccess: Actions< + FetchMlInferencePipelinesArgs, + FetchMlInferencePipelinesResponse + >['apiSuccess']; mlModelsApiError: TrainedModelsApiLogicActions['apiError']; selectExistingPipeline: (pipelineName: string) => { pipelineName: string; @@ -185,7 +189,10 @@ export const MLInferenceLogic = kea< connect: { actions: [ FetchMlInferencePipelinesApiLogic, - ['makeRequest as makeMlInferencePipelinesRequest'], + [ + 'makeRequest as makeMlInferencePipelinesRequest', + 'apiSuccess as mlInferencePipelinesSuccess', + ], MappingsApiLogic, ['makeRequest as makeMappingRequest', 'apiError as mappingsApiError'], TrainedModelsApiLogic, @@ -266,6 +273,18 @@ export const MLInferenceLogic = kea< actions.makeMLModelsRequest(undefined); actions.makeMappingRequest({ indexName }); }, + mlInferencePipelinesSuccess: (data) => { + if ( + (data?.length ?? 0) === 0 && + values.addInferencePipelineModal.configuration.existingPipeline === undefined + ) { + // Default to a new pipeline if there are no existing pipelines to choose + actions.setInferencePipelineConfiguration({ + ...values.addInferencePipelineModal.configuration, + existingPipeline: false, + }); + } + }, }), path: ['enterprise_search', 'content', 'pipelines_add_ml_inference_pipeline'], reducers: { diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/review_pipeline.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/review_pipeline.tsx index b5ff1f103008e..080a277fe3265 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/review_pipeline.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/review_pipeline.tsx @@ -9,7 +9,14 @@ import React from 'react'; import { useValues } from 'kea'; -import { EuiCodeBlock, EuiFlexGroup, EuiFlexItem, EuiSpacer, EuiText } from '@elastic/eui'; +import { + EuiCodeBlock, + EuiFlexGroup, + EuiFlexItem, + EuiSpacer, + EuiTitle, + EuiText, +} from '@elastic/eui'; import { i18n } from '@kbn/i18n'; @@ -20,7 +27,7 @@ export const ReviewPipeline: React.FC = () => { return ( - +

    {i18n.translate( 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.review.title', @@ -29,15 +36,10 @@ export const ReviewPipeline: React.FC = () => { } )}

    -     -     - - - {JSON.stringify(mlInferencePipeline ?? {}, null, 2)} - + + -

    {i18n.translate( @@ -49,6 +51,12 @@ export const ReviewPipeline: React.FC = () => { )}

    + +     + + + {JSON.stringify(mlInferencePipeline ?? {}, null, 2)} + ); diff --git a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/test_pipeline.tsx b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/test_pipeline.tsx index b2a50fbe5cf65..130ca9fe1b81a 100644 --- a/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/test_pipeline.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/enterprise_search_content/components/search_index/pipelines/ml_inference/test_pipeline.tsx @@ -19,6 +19,7 @@ import { EuiFormRow, EuiResizableContainer, EuiSpacer, + EuiTitle, EuiText, useIsWithinMaxBreakpoint, } from '@elastic/eui'; @@ -52,60 +53,108 @@ export const TestPipeline: React.FC = () => { return ( + + +

    + {i18n.translate( + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.title', + { defaultMessage: 'Review pipeline results' } + )} +

    +     + +     + + +

    + + {i18n.translate( + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.optionalCallout', + { defaultMessage: 'This step is optional.' } + )} + +   + {i18n.translate( + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.description', + { + defaultMessage: + 'You can simulate your pipeline results by passing an array of documents.', + } + )} +
    + {`[{"_index":"index","_id":"id","_source":{"${sourceField}":"bar"}}]`} + ), + }} + /> +

    +     + +     + + + { + inputRef.current = ref; + }} + isInvalid={showGetDocumentErrors} + isLoading={isGetDocumentsLoading} + onKeyDown={(e) => { + if (e.key === 'Enter' && inputRef.current?.value.trim().length !== 0) { + makeGetDocumentRequest({ + documentId: inputRef.current?.value.trim() ?? '', + indexName, + }); + } + }} + /> + + + - -

    - {i18n.translate( - 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.title', - { defaultMessage: 'Review pipeline results (optional)' } - )} -

    -     -
    {i18n.translate( - 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle', + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle.documents', { defaultMessage: 'Documents' } )}
    - - +
    + {i18n.translate( + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle.result', + { defaultMessage: 'Result' } )} - inputRef={(ref: HTMLInputElement) => { - inputRef.current = ref; - }} - isInvalid={showGetDocumentErrors} - isLoading={isGetDocumentsLoading} - onKeyDown={(e) => { - if (e.key === 'Enter' && inputRef.current?.value.trim().length !== 0) { - makeGetDocumentRequest({ - documentId: inputRef.current?.value.trim() ?? '', - indexName, - }); - } - }} - /> - +
    +     @@ -146,41 +195,14 @@ export const TestPipeline: React.FC = () => { - - - -

    - {i18n.translate( - 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.description', - { - defaultMessage: - 'You can simulate your pipeline results by passing an array of documents.', - } - )} -
    - {`[{"_index":"index","_id":"id","_source":{"${sourceField}":"bar"}}]`} - ), - }} - /> -

    -     -     - -
    - - {i18n.translate( - 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.runButton', - { defaultMessage: 'Simulate Pipeline' } - )} - -
    -     -     +
    + + {i18n.translate( + 'xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.runButton', + { defaultMessage: 'Simulate Pipeline' } + )} + +
    ); diff --git a/x-pack/plugins/enterprise_search/public/applications/shared/formatted_date_time/index.test.tsx b/x-pack/plugins/enterprise_search/public/applications/shared/formatted_date_time/index.test.tsx index fd76943d3e727..f74125b1528c7 100644 --- a/x-pack/plugins/enterprise_search/public/applications/shared/formatted_date_time/index.test.tsx +++ b/x-pack/plugins/enterprise_search/public/applications/shared/formatted_date_time/index.test.tsx @@ -16,7 +16,7 @@ describe('FormattedDateTime', () => { const date = new Date('1970-01-01T12:00:00'); const wrapper = mountWithIntl(); - expect(wrapper.text()).toEqual('Jan 1, 1970 12:00 PM'); + expect(wrapper.text()).toEqual('Jan 1, 1970 12:00 PM'); }); it('does not render time if hideTime is passed', () => { diff --git a/x-pack/plugins/enterprise_search/server/lib/pipelines/ml_inference/get_ml_inference_pipelines.ts b/x-pack/plugins/enterprise_search/server/lib/pipelines/ml_inference/get_ml_inference_pipelines.ts index 2dfc6951b2224..f4cf3a4968482 100644 --- a/x-pack/plugins/enterprise_search/server/lib/pipelines/ml_inference/get_ml_inference_pipelines.ts +++ b/x-pack/plugins/enterprise_search/server/lib/pipelines/ml_inference/get_ml_inference_pipelines.ts @@ -26,9 +26,15 @@ export const getMlInferencePipelines = async ( // Fetch all ML inference pipelines and trained models that are accessible in the current // Kibana space const [fetchedInferencePipelines, trainedModels] = await Promise.all([ - esClient.ingest.getPipeline({ - id: 'ml-inference-*', - }), + esClient.ingest + .getPipeline({ + id: 'ml-inference-*', + }) + .catch((e) => { + // handle no pipelines 404 error and return empty record + if (e?.meta?.statusCode === 404) return {}; + throw e; + }), trainedModelsProvider.getTrainedModels({}), ]); const accessibleModelIds = Object.values(trainedModels.trained_model_configs).map( diff --git a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/instructions.tsx b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/instructions.tsx index 4e7acd347ed98..a90ff77de9fd4 100644 --- a/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/instructions.tsx +++ b/x-pack/plugins/fleet/public/components/agent_enrollment_flyout/instructions.tsx @@ -42,7 +42,8 @@ export const Instructions = (props: InstructionProps) => { refreshAgentPolicies, } = props; const fleetStatus = useFleetStatus(); - const { isUnhealthy: isFleetServerUnhealthy } = useFleetServerUnhealthy(); + const { isUnhealthy: isFleetServerUnhealthy, isLoading: isLoadingFleetServerHealth } = + useFleetServerUnhealthy(); useEffect(() => { refreshAgentPolicies(); @@ -66,14 +67,17 @@ export const Instructions = (props: InstructionProps) => { const fleetServers = agents?.items || []; - if (isLoadingAgents || isLoadingAgentPolicies) return ; + if (isLoadingAgents || isLoadingAgentPolicies || isLoadingFleetServerHealth) + return ; const hasNoFleetServerHost = fleetStatus.isReady && (fleetServerHosts?.length ?? 0) === 0; const showAgentEnrollment = - fleetStatus.isReady && - (isFleetServerPolicySelected || - (!isFleetServerUnhealthy && fleetServers.length > 0 && (fleetServerHosts?.length ?? 0) > 0)); + isFleetServerPolicySelected || + (fleetStatus.isReady && + !isFleetServerUnhealthy && + fleetServers.length > 0 && + (fleetServerHosts?.length ?? 0) > 0); const showFleetServerEnrollment = !isFleetServerPolicySelected && diff --git a/x-pack/plugins/fleet/server/routes/data_streams/handlers.ts b/x-pack/plugins/fleet/server/routes/data_streams/handlers.ts index e6e497991ca82..bf8e8a22cdbdd 100644 --- a/x-pack/plugins/fleet/server/routes/data_streams/handlers.ts +++ b/x-pack/plugins/fleet/server/routes/data_streams/handlers.ts @@ -16,6 +16,9 @@ import { dataStreamService } from '../../services/data_streams'; import { getDataStreamsQueryMetadata } from './get_data_streams_query_metadata'; +const MANAGED_BY = 'fleet'; +const LEGACY_MANAGED_BY = 'ingest-manager'; + interface ESDataStreamInfo { name: string; timestamp_field: { @@ -54,8 +57,11 @@ export const getListHandler: RequestHandler = async (context, request, response) getPackageSavedObjects(savedObjects.client), ]); + // managed_by property 'ingest-manager' added to allow for legacy data streams to be displayed + // See https://github.com/elastic/elastic-agent/issues/654 + const filteredDataStreamsInfo = dataStreamsInfo.filter( - (ds) => ds?._meta?.managed_by === 'fleet' + (ds) => ds?._meta?.managed_by === MANAGED_BY || ds?._meta?.managed_by === LEGACY_MANAGED_BY ); const dataStreamsInfoByName = keyBy(filteredDataStreamsInfo, 'name'); @@ -116,6 +122,7 @@ export const getListHandler: RequestHandler = async (context, request, response) // Query additional information for each data stream const dataStreamPromises = dataStreamNames.map(async (dataStreamName) => { const dataStream = dataStreams[dataStreamName]; + const dataStreamResponse: DataStream = { index: dataStreamName, dataset: '', diff --git a/x-pack/plugins/infra/public/common/visualizations/lens/utils.ts b/x-pack/plugins/infra/public/common/visualizations/lens/utils.ts index a10edfa77985e..a42e43a71771e 100644 --- a/x-pack/plugins/infra/public/common/visualizations/lens/utils.ts +++ b/x-pack/plugins/infra/public/common/visualizations/lens/utils.ts @@ -46,7 +46,7 @@ export const getBreakdownColumn = ( type: 'alphabetical', fallback: false, }, - orderDirection: 'desc', + orderDirection: 'asc', otherBucket: false, missingBucket: false, parentFormat: { diff --git a/x-pack/plugins/infra/public/hooks/use_lens_attributes.test.ts b/x-pack/plugins/infra/public/hooks/use_lens_attributes.test.ts index 075d883593b01..cb46714276bd9 100644 --- a/x-pack/plugins/infra/public/hooks/use_lens_attributes.test.ts +++ b/x-pack/plugins/infra/public/hooks/use_lens_attributes.test.ts @@ -79,7 +79,7 @@ describe('useHostTable hook', () => { fallback: false, type: 'alphabetical', }, - orderDirection: 'desc', + orderDirection: 'asc', otherBucket: false, parentFormat: { id: 'terms', diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx b/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx new file mode 100644 index 0000000000000..07f73d5c5c360 --- /dev/null +++ b/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/enable_hosts_view_page.tsx @@ -0,0 +1,76 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { ReactNode } from 'react'; +import { EuiPageTemplate, EuiImage, EuiSpacer } from '@elastic/eui'; +import { css } from '@emotion/react'; +import { useEuiBackgroundColor } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { useTrackPageview } from '@kbn/observability-plugin/public'; +import { MetricsPageTemplate } from '../../../page_template'; +import hostsLandingBeta from './hosts_landing_beta.svg'; +import { ExperimentalBadge } from '../experimental_badge'; + +interface Props { + actions?: ReactNode; +} + +export const EnableHostsViewPage = ({ actions }: Props) => { + const backgroundColor = useEuiBackgroundColor('subdued'); + + useTrackPageview({ app: 'infra_metrics', path: 'hosts_feature_enable_landing_page' }); + useTrackPageview({ + app: 'infra_metrics', + path: 'hosts_feature_enable_landing_page', + delay: 15000, + }); + + return ( + + + {i18n.translate('xpack.infra.hostsViewPage.landing.introTitle', { + defaultMessage: 'Introducing: Host Analysis', + })} +

    + } + alignment="center" + icon={} + color="plain" + layout="horizontal" + body={ + <> + + +

    + {i18n.translate('xpack.infra.hostsViewPage.landing.introMessage', { + defaultMessage: `Introducing our new 'Hosts' feature, now available in technical preview! + With this powerful tool, you can easily view and analyse your hosts and identify any + issues so you address them quickly. Get a detailed view of metrics for your hosts, see + which ones are triggering the most alerts and filter the hosts you want to analyse + using any KQL filter and easy breakdowns such as cloud provider and operating system.`, + })} +

    +

    + {i18n.translate('xpack.infra.hostsViewPage.landing.tryTheFeatureMessage', { + defaultMessage: `This is an early version of the feature and we would love your feedback as we continue + to develop and improve it. To access the feature, simply enable below. Don't miss + out on this powerful new addition to our platform - try it out today!`, + })} +

    + + } + css={css` + background-color: ${backgroundColor}; + `} + actions={actions} + /> + + ); +}; diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/hosts_landing_beta.svg b/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/hosts_landing_beta.svg new file mode 100644 index 0000000000000..832b7fd689bce --- /dev/null +++ b/x-pack/plugins/infra/public/pages/metrics/hosts/components/enable_hosts_view_page/hosts_landing_beta.svg @@ -0,0 +1,920 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/components/experimental_badge.tsx b/x-pack/plugins/infra/public/pages/metrics/hosts/components/experimental_badge.tsx index f8c92836b8289..73f30edc2f53e 100644 --- a/x-pack/plugins/infra/public/pages/metrics/hosts/components/experimental_badge.tsx +++ b/x-pack/plugins/infra/public/pages/metrics/hosts/components/experimental_badge.tsx @@ -6,16 +6,16 @@ */ import { EuiBetaBadge } from '@elastic/eui'; -import { css } from '@emotion/react'; +import type { IconType, ToolTipPositions } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; import React from 'react'; -export const ExperimentalBadge = () => ( +interface Props { + iconType?: IconType; + tooltipPosition?: ToolTipPositions; +} +export const ExperimentalBadge = ({ iconType, tooltipPosition }: Props) => ( ( defaultMessage: 'This functionality is in technical preview and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.', })} + iconType={iconType} + tooltipPosition={tooltipPosition} /> ); diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/components/tabs/metrics/metric_chart.tsx b/x-pack/plugins/infra/public/pages/metrics/hosts/components/tabs/metrics/metric_chart.tsx index e1374d1ae97ba..fd83ef7b9f6c8 100644 --- a/x-pack/plugins/infra/public/pages/metrics/hosts/components/tabs/metrics/metric_chart.tsx +++ b/x-pack/plugins/infra/public/pages/metrics/hosts/components/tabs/metrics/metric_chart.tsx @@ -19,6 +19,7 @@ import { useLensAttributes } from '../../../../../../hooks/use_lens_attributes'; import { useMetricsDataViewContext } from '../../../hooks/use_data_view'; import { useUnifiedSearchContext } from '../../../hooks/use_unified_search'; import { HostLensAttributesTypes } from '../../../../../../common/visualizations'; +import { useHostsViewContext } from '../../../hooks/use_hosts_view'; export interface MetricChartProps { title: string; @@ -37,6 +38,7 @@ export const MetricChart = ({ title, type, breakdownSize }: MetricChartProps) => onSubmit, } = useUnifiedSearchContext(); const { metricsDataView } = useMetricsDataViewContext(); + const { baseRequest } = useHostsViewContext(); const { services: { lens }, } = useKibana(); @@ -111,6 +113,7 @@ export const MetricChart = ({ title, type, breakdownSize }: MetricChartProps) => query={unifiedSearchQuery} filters={unifiedSearchFilters} extraActions={extraAction} + lastReloadRequestTime={baseRequest.requestTs} executionContext={{ type: 'infrastructure_observability_hosts_view', name: `Hosts View ${type} Chart`, diff --git a/x-pack/plugins/infra/public/pages/metrics/hosts/hosts_landing_page.tsx b/x-pack/plugins/infra/public/pages/metrics/hosts/hosts_landing_page.tsx new file mode 100644 index 0000000000000..efb170ff174a9 --- /dev/null +++ b/x-pack/plugins/infra/public/pages/metrics/hosts/hosts_landing_page.tsx @@ -0,0 +1,92 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { EuiButton, EuiCallOut } from '@elastic/eui'; +import { useKibana } from '@kbn/kibana-react-plugin/public'; +import { EuiLink } from '@elastic/eui'; +import { FormattedMessage } from '@kbn/i18n-react'; +import { i18n } from '@kbn/i18n'; +import { enableInfrastructureHostsView } from '@kbn/observability-plugin/public'; +import useObservable from 'react-use/lib/useObservable'; +import { Observable } from 'rxjs'; +import { InfraClientStartDeps } from '../../../types'; +import { EnableHostsViewPage } from './components/enable_hosts_view_page/enable_hosts_view_page'; +import { HostsPage } from '.'; + +export const HostsLandingPage = () => { + const { + services: { uiSettings, application }, + } = useKibana(); + const canEditAdvancedSettings = application?.capabilities.advancedSettings.save; + const isHostViewEnabled = useObservable( + uiSettings?.get$(enableInfrastructureHostsView) ?? + new Observable((subs) => subs.next(false)) + ); + + if (isHostViewEnabled) { + return ; + } + + if (canEditAdvancedSettings) { + return ( + { + uiSettings?.set(enableInfrastructureHostsView, true); + }} + > + {i18n.translate('xpack.infra.hostsViewPage.landing.enableHostsView', { + defaultMessage: 'Enable hosts view', + })} + + } + /> + ); + } + + return ( + +

    + {i18n.translate( + 'xpack.infra.hostsViewPage.landing.calloutReachOutToYourKibanaAdministrator', + { + defaultMessage: `Your user role doesn’t have sufficient privileges to enable this feature - please + reach out to your Kibana Administrator and ask them to visit this page to enable this feature.`, + } + )} +

    +

    + + {i18n.translate('xpack.infra.hostsViewPage.landing.learnMore', { + defaultMessage: 'Learn more', + })} + + ), + }} + /> +

    + + } + /> + ); +}; diff --git a/x-pack/plugins/infra/public/pages/metrics/index.tsx b/x-pack/plugins/infra/public/pages/metrics/index.tsx index 691069a978e83..28a1b84e15381 100644 --- a/x-pack/plugins/infra/public/pages/metrics/index.tsx +++ b/x-pack/plugins/infra/public/pages/metrics/index.tsx @@ -29,7 +29,7 @@ import { MetricsExplorerPage } from './metrics_explorer'; import { SnapshotPage } from './inventory_view'; import { MetricDetail } from './metric_detail'; import { MetricsSettingsPage } from './settings'; -import { HostsPage } from './hosts'; +import { HostsLandingPage } from './hosts/hosts_landing_page'; import { SourceLoadingPage } from '../../components/source_loading_page'; import { WaffleOptionsProvider } from './inventory_view/hooks/use_waffle_options'; import { WaffleTimeProvider } from './inventory_view/hooks/use_waffle_time'; @@ -120,7 +120,7 @@ export const InfrastructurePage = ({ match }: RouteComponentProps) => { )} /> - + diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx new file mode 100644 index 0000000000000..9fad879ecad96 --- /dev/null +++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/hosts_view_intro_panel.tsx @@ -0,0 +1,53 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { EuiFlexGroup, EuiFlexItem, EuiBetaBadge, EuiLink } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { useLinkProps } from '@kbn/observability-plugin/public'; +import { css } from '@emotion/react'; +import { ExperimentalBadge } from '../../hosts/components/experimental_badge'; + +export const HostViewIntroPanel = () => { + const link = useLinkProps({ + app: 'metrics', + pathname: '/hosts', + }); + + return ( + + + + + + + + + + {i18n.translate('xpack.infra.layout.hostsLandingPageLink', { + defaultMessage: 'Introducing a new Hosts analysis experience', + })} + + + + ); +}; diff --git a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx index 1bd8ea1d4f7d9..4bcf2c192d436 100644 --- a/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx +++ b/x-pack/plugins/infra/public/pages/metrics/inventory_view/components/layout.tsx @@ -31,6 +31,7 @@ import { createLegend } from '../lib/create_legend'; import { useWaffleViewState } from '../hooks/use_waffle_view_state'; import { BottomDrawer } from './bottom_drawer'; import { LegendControls } from './waffle/legend_controls'; +import { HostViewIntroPanel } from './hosts_view_intro_panel'; interface Props { shouldLoadDefault: boolean; @@ -178,6 +179,7 @@ export const Layout = React.memo( + {({ measureRef, bounds: { height = 0 } }) => ( <> diff --git a/x-pack/plugins/infra/public/plugin.ts b/x-pack/plugins/infra/public/plugin.ts index 1ba4b3aca880f..97c1903657dda 100644 --- a/x-pack/plugins/infra/public/plugin.ts +++ b/x-pack/plugins/infra/public/plugin.ts @@ -92,8 +92,8 @@ export class Plugin implements InfraClientPluginClass { const infraEntries = [ { label: 'Inventory', app: 'metrics', path: '/inventory' }, { label: 'Metrics Explorer', app: 'metrics', path: '/explorer' }, + { label: 'Hosts', isBeta: true, app: 'metrics', path: '/hosts' }, ]; - const hostInfraEntry = { label: 'Hosts', app: 'metrics', path: '/hosts' }; pluginsSetup.observability.navigation.registerSections( startDep$AndHostViewFlag$.pipe( map( @@ -103,7 +103,6 @@ export class Plugin implements InfraClientPluginClass { application: { capabilities }, }, ], - isInfrastructureHostsViewEnabled, ]) => [ ...(capabilities.logs.show ? [ @@ -123,9 +122,7 @@ export class Plugin implements InfraClientPluginClass { { label: 'Infrastructure', sortKey: 300, - entries: isInfrastructureHostsViewEnabled - ? [hostInfraEntry, ...infraEntries] - : infraEntries, + entries: infraEntries, }, ] : []), @@ -197,6 +194,13 @@ export class Plugin implements InfraClientPluginClass { }), path: '/inventory', }, + { + id: 'metrics-hosts', + title: i18n.translate('xpack.infra.homePage.metricsHostsTabTitle', { + defaultMessage: 'Hosts', + }), + path: '/hosts', + }, { id: 'metrics-explorer', title: i18n.translate('xpack.infra.homePage.metricsExplorerTabTitle', { @@ -212,13 +216,6 @@ export class Plugin implements InfraClientPluginClass { path: '/settings', }, ]; - const hostInfraDeepLink = { - id: 'metrics-hosts', - title: i18n.translate('xpack.infra.homePage.metricsHostsTabTitle', { - defaultMessage: 'Hosts', - }), - path: '/hosts', - }; core.application.register({ id: 'metrics', title: i18n.translate('xpack.infra.metrics.pluginTitle', { @@ -229,9 +226,7 @@ export class Plugin implements InfraClientPluginClass { appRoute: '/app/metrics', category: DEFAULT_APP_CATEGORIES.observability, updater$: this.appUpdater$, - deepLinks: core.uiSettings.get(enableInfrastructureHostsView) - ? [hostInfraDeepLink, ...infraDeepLinks] - : infraDeepLinks, + deepLinks: infraDeepLinks, mount: async (params: AppMountParameters) => { // mount callback should not use setup dependencies, get start dependencies instead const [coreStart, pluginsStart, pluginStart] = await core.getStartServices(); @@ -242,14 +237,9 @@ export class Plugin implements InfraClientPluginClass { }); startDep$AndHostViewFlag$.subscribe( - ([_startServices, isInfrastructureHostsViewEnabled]: [ - [CoreStart, InfraClientStartDeps, InfraClientStartExports], - boolean - ]) => { + ([_startServices]: [[CoreStart, InfraClientStartDeps, InfraClientStartExports], boolean]) => { this.appUpdater$.next(() => ({ - deepLinks: isInfrastructureHostsViewEnabled - ? [hostInfraDeepLink, ...infraDeepLinks] - : infraDeepLinks, + deepLinks: infraDeepLinks, })); } ); diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/append.test.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/append.test.tsx index 8c3785f1ff403..95dafec27b6aa 100644 --- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/append.test.tsx +++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/append.test.tsx @@ -105,6 +105,7 @@ describe('Processor: Append', () => { find('appendValueField.input').simulate('change', [{ label: 'Some_Value' }]); component.update(); }); + form.toggleEuiSwitch('allowDuplicatesSwitch.input'); form.toggleEuiSwitch('ignoreFailureSwitch.input'); // Save the field with new changes @@ -115,6 +116,44 @@ describe('Processor: Append', () => { field: 'field_1', ignore_failure: true, value: ['Some_Value'], + allow_duplicates: false, + }); + }); + + test('should allow to set media_type when value is a template snippet', async () => { + const { + actions: { saveNewProcessor }, + form, + find, + component, + exists, + } = testBed; + + // Add "field" value (required) + form.setInputValue('fieldNameField.input', 'sample_field'); + + // Shouldn't be able to set media_type if value is not a template string + await act(async () => { + find('appendValueField.input').simulate('change', [{ label: 'value_1' }]); + }); + component.update(); + expect(exists('mediaTypeSelectorField')).toBe(false); + + // Set value to a template snippet and media_type to a non-default value + await act(async () => { + find('appendValueField.input').simulate('change', [{ label: '{{{value_2}}}' }]); + }); + component.update(); + form.setSelectValue('mediaTypeSelectorField', 'text/plain'); + + // Save the field with new changes + await saveNewProcessor(); + + const processors = getProcessorValue(onUpdate, APPEND_TYPE); + expect(processors[0][APPEND_TYPE]).toEqual({ + field: 'sample_field', + value: ['{{{value_2}}}'], + media_type: 'text/plain', }); }); }); diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx index f66d601e8caae..9501598c53db2 100644 --- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx +++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/__jest__/processors/processor.helpers.tsx @@ -130,6 +130,7 @@ type TestSubject = | 'addProcessorButton' | 'addProcessorForm.submitButton' | 'appendValueField.input' + | 'allowDuplicatesSwitch.input' | 'formatsValueField.input' | 'timezoneField.input' | 'outputFormatField.input' diff --git a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/append.tsx b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/append.tsx index fde39e7462009..74d57eebc07fa 100644 --- a/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/append.tsx +++ b/x-pack/plugins/ingest_pipelines/public/application/components/pipeline_editor/components/processor_form/processors/append.tsx @@ -8,14 +8,19 @@ import React, { FunctionComponent } from 'react'; import { i18n } from '@kbn/i18n'; +import { FormattedMessage } from '@kbn/i18n-react'; +import { hasTemplateSnippet } from '../../../utils'; import { FIELD_TYPES, fieldValidators, UseField, ComboBoxField, + ToggleField, + SelectField, + useFormData, } from '../../../../../../shared_imports'; -import { FieldsConfig, to } from './shared'; +import { FieldsConfig, from, to } from './shared'; import { FieldNameField } from './common_fields/field_name_field'; const { emptyField } = fieldValidators; @@ -41,9 +46,42 @@ const fieldsConfig: FieldsConfig = { }, ], }, + allow_duplicates: { + type: FIELD_TYPES.TOGGLE, + defaultValue: true, + deserializer: to.booleanOrUndef, + serializer: from.undefinedIfValue(true), + label: i18n.translate( + 'xpack.ingestPipelines.pipelineEditor.appendForm.allowDuplicatesFieldLabel', + { + defaultMessage: 'Allow duplicates', + } + ), + helpText: i18n.translate( + 'xpack.ingestPipelines.pipelineEditor.appendForm.allowDuplicatesFieldHelpText', + { + defaultMessage: 'Allow appending values already present in the field.', + } + ), + }, + media_type: { + type: FIELD_TYPES.SELECT, + defaultValue: 'application/json', + serializer: from.undefinedIfValue('application/json'), + label: i18n.translate('xpack.ingestPipelines.pipelineEditor.appendForm.mediaTypeFieldLabel', { + defaultMessage: 'Media type', + }), + helpText: ( + + ), + }, }; export const Append: FunctionComponent = () => { + const [{ fields }] = useFormData({ watch: ['fields.value'] }); return ( <> { component={ComboBoxField} path="fields.value" /> + + + + {hasTemplateSnippet(fields?.value) && ( + + )} ); }; diff --git a/x-pack/plugins/lens/public/datasources/form_based/datapanel.tsx b/x-pack/plugins/lens/public/datasources/form_based/datapanel.tsx index 374eb430dae9c..6f515b6793c3b 100644 --- a/x-pack/plugins/lens/public/datasources/form_based/datapanel.tsx +++ b/x-pack/plugins/lens/public/datasources/form_based/datapanel.tsx @@ -245,26 +245,16 @@ export const InnerFormBasedDataPanel = function InnerFormBasedDataPanel({ [layerFields] ); - const onOverrideFieldGroupDetails = useCallback( - (groupName) => { - if (groupName === FieldsGroupNames.AvailableFields) { - const isUsingSampling = core.uiSettings.get('lens:useFieldExistenceSampling'); - - return { - helpText: isUsingSampling - ? i18n.translate('xpack.lens.indexPattern.allFieldsSamplingLabelHelp', { - defaultMessage: - 'Available fields contain the data in the first 500 documents that match your filters. To view all fields, expand Empty fields. You are unable to create visualizations with full text, geographic, flattened, and object fields.', - }) - : i18n.translate('xpack.lens.indexPattern.allFieldsLabelHelp', { - defaultMessage: - 'Drag and drop available fields to the workspace and create visualizations. To change the available fields, select a different data view, edit your queries, or use a different time range. Some field types cannot be visualized in Lens, including full text and geographic fields.', - }), - }; - } - }, - [core.uiSettings] - ); + const onOverrideFieldGroupDetails = useCallback((groupName) => { + if (groupName === FieldsGroupNames.AvailableFields) { + return { + helpText: i18n.translate('xpack.lens.indexPattern.allFieldsLabelHelp', { + defaultMessage: + 'Drag and drop available fields to the workspace and create visualizations. To change the available fields, select a different data view, edit your queries, or use a different time range. Some field types cannot be visualized in Lens, including full text and geographic fields.', + }), + }; + } + }, []); const { fieldListFiltersProps, fieldListGroupedProps } = useGroupedFields({ dataViewId: currentIndexPatternId, diff --git a/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_editor.tsx b/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_editor.tsx index f93ee60bae9e6..c51d909ba6766 100644 --- a/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_editor.tsx +++ b/x-pack/plugins/lens/public/datasources/form_based/dimension_panel/dimension_editor.tsx @@ -397,7 +397,7 @@ export function DimensionEditor(props: DimensionEditorProps) { ); } else if (!compatibleWithCurrentField) { label = ( - + {label} @@ -652,7 +652,7 @@ export function DimensionEditor(props: DimensionEditorProps) { <> + {i18n.translate('xpack.lens.indexPattern.functionsLabel', { defaultMessage: 'Functions', @@ -665,10 +665,8 @@ export function DimensionEditor(props: DimensionEditorProps) { isOpen={isHelpOpen} display="inlineBlock" panelPaddingSize="none" - className="dscFieldTypesHelp__popover" - panelClassName="dscFieldTypesHelp__panel" closePopover={closeHelp} - initialFocus="#dscFieldTypesHelpBasicTableId" + initialFocus="#functionsHelpBasicTableId" > {i18n.translate('xpack.lens.indexPattern.quickFunctions.popoverTitle', { @@ -682,7 +680,7 @@ export function DimensionEditor(props: DimensionEditorProps) { paddingSize="s" > ().services; const exploreInDiscover = useMemo(() => { @@ -330,18 +329,12 @@ function FieldItemPopoverContents( overrideMissingContent={(params) => { if (params.reason === 'no-data') { // TODO: should we replace this with a default message "Analysis is not available for this field?" - const isUsingSampling = core.uiSettings.get('lens:useFieldExistenceSampling'); return ( - {isUsingSampling - ? i18n.translate('xpack.lens.indexPattern.fieldStatsSamplingNoData', { - defaultMessage: - 'Lens is unable to create visualizations with this field because it does not contain data in the first 500 documents that match your filters. To create a visualization, drag and drop a different field.', - }) - : i18n.translate('xpack.lens.indexPattern.fieldStatsNoData', { - defaultMessage: - 'Lens is unable to create visualizations with this field because it does not contain data. To create a visualization, drag and drop a different field.', - })} + {i18n.translate('xpack.lens.indexPattern.fieldStatsNoData', { + defaultMessage: + 'Lens is unable to create visualizations with this field because it does not contain data. To create a visualization, drag and drop a different field.', + })} ); } diff --git a/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx b/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx index 1ce6832f78109..44574bb2cd4ce 100644 --- a/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx +++ b/x-pack/plugins/lens/public/datasources/form_based/form_based.tsx @@ -66,7 +66,6 @@ import { getFiltersInLayer, getShardFailuresWarningMessages, getVisualDefaultsForLayer, - getDeprecatedSamplingWarningMessage, isColumnInvalid, cloneLayer, } from './utils'; @@ -872,7 +871,6 @@ export function getFormBasedDatasource({ return message; }), - ...getDeprecatedSamplingWarningMessage(core), ]; return [...layerErrorMessages, ...dimensionErrorMessages, ...warningMessages]; diff --git a/x-pack/plugins/lens/public/datasources/form_based/utils.tsx b/x-pack/plugins/lens/public/datasources/form_based/utils.tsx index e8d98516ec8a1..8ad43734aedf1 100644 --- a/x-pack/plugins/lens/public/datasources/form_based/utils.tsx +++ b/x-pack/plugins/lens/public/datasources/form_based/utils.tsx @@ -8,10 +8,10 @@ import React from 'react'; import { i18n } from '@kbn/i18n'; import { FormattedMessage } from '@kbn/i18n-react'; -import type { CoreStart, DocLinksStart, ThemeServiceStart } from '@kbn/core/public'; +import type { DocLinksStart, ThemeServiceStart } from '@kbn/core/public'; import type { DatatableUtilitiesService } from '@kbn/data-plugin/common'; import { TimeRange } from '@kbn/es-query'; -import { EuiCallOut, EuiLink, EuiSpacer, EuiText } from '@elastic/eui'; +import { EuiLink, EuiSpacer, EuiText } from '@elastic/eui'; import type { DatatableColumn } from '@kbn/expressions-plugin/common'; import { groupBy, escape, uniq } from 'lodash'; @@ -393,52 +393,6 @@ export function getPrecisionErrorWarningMessages( return warningMessages; } -export function getDeprecatedSamplingWarningMessage(core: CoreStart): UserMessage[] { - const useFieldExistenceSamplingKey = 'lens:useFieldExistenceSampling'; - const isUsingSampling = core.uiSettings.get(useFieldExistenceSamplingKey); - - return isUsingSampling - ? [ - { - severity: 'warning', - fixableInEditor: false, - displayLocations: [{ id: 'banner' }], - shortMessage: '', - longMessage: ( - { - core.application.navigateToApp('management', { - path: `/kibana/settings?query=${useFieldExistenceSamplingKey}`, - }); - }} - > - - - ), - }} - /> - } - /> - ), - }, - ] - : []; -} - export function getVisualDefaultsForLayer(layer: FormBasedLayer) { return Object.keys(layer.columns).reduce>>( (memo, columnId) => { diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts index 9eb65730d6644..607031e6e70d8 100644 --- a/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts +++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/job_creator/job_creator.ts @@ -8,6 +8,7 @@ import { BehaviorSubject } from 'rxjs'; import { cloneDeep } from 'lodash'; import { ES_FIELD_TYPES } from '@kbn/field-types'; +import type { Query } from '@kbn/es-query'; import type { DataView } from '@kbn/data-views-plugin/public'; import { addExcludeFrozenToQuery } from '@kbn/ml-query-utils'; import { SavedSearchSavedObject } from '../../../../../../common/types/kibana'; @@ -18,6 +19,7 @@ import { aggregations, mlOnlyAggregations, } from '../../../../../../common/constants/aggregation_types'; +import { getQueryFromSavedSearchObject } from '../../../../util/index_utils'; import { Job, Datafeed, @@ -105,9 +107,14 @@ export class JobCreator { return this._type; } + public get savedSearch(): SavedSearchSavedObject | null { + return this._savedSearch; + } + public get dataView(): DataView { return this._indexPattern; } + public get dataViewId(): string | undefined { return this._indexPattern.id; } @@ -148,6 +155,10 @@ export class JobCreator { this._fields.length = 0; } + public get savedSearchQuery(): { query: Query; filter: any[] } | null { + return this._savedSearch ? getQueryFromSavedSearchObject(this._savedSearch) : null; + } + public get detectors(): Detector[] { return this._detectors; } diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts b/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts index d0fdd1e6a5562..349d18dc04567 100644 --- a/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts +++ b/x-pack/plugins/ml/public/application/jobs/new_job/common/map_loader/map_loader.ts @@ -10,6 +10,7 @@ import { isEqual } from 'lodash'; import type { DataView } from '@kbn/data-views-plugin/common'; import { ES_GEO_FIELD_TYPE, LayerDescriptor } from '@kbn/maps-plugin/common'; import type { MapsStartApi } from '@kbn/maps-plugin/public'; +import type { Query } from '@kbn/es-query'; import { ChartLoader } from '../chart_loader'; import { Field, SplitField } from '../../../../../../common/types/fields'; const eq = (newArgs: any[], lastArgs: any[]) => isEqual(newArgs, lastArgs); @@ -29,18 +30,23 @@ export class MapLoader extends ChartLoader { geoField: Field, splitField: SplitField, fieldValues: string[], - filters?: any[] + filters?: any[], + savedSearchQuery?: Query ) { const layerList: LayerDescriptor[] = []; if (this._dataView.id !== undefined && geoField) { + const { query } = savedSearchQuery ?? {}; + const queryString = + fieldValues.length && splitField + ? `${splitField.name}:${fieldValues[0]} ${query ? `and ${query}` : ''}` + : `${query ? query : ''}`; + const params: any = { indexPatternId: this._dataView.id, geoFieldName: geoField.name, geoFieldType: geoField.type as unknown as ES_GEO_FIELD_TYPE, filters: filters ?? [], - ...(fieldValues.length && splitField - ? { query: { query: `${splitField.name}:${fieldValues[0]}`, language: 'kuery' } } - : {}), + query: { query: queryString, language: 'kuery' }, }; const searchLayerDescriptor = this._getMapData ? await this._getMapData(params) : null; diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx index 11a1d203bff98..fc37459569ed9 100644 --- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx +++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection.tsx @@ -71,12 +71,15 @@ export const GeoDetector: FC = ({ setIsValid }) => { useEffect(() => { async function getMapLayersForGeoJob() { if (jobCreator.geoField) { - const filters = data.query.filterManager.getFilters() ?? []; + const { filter, query } = jobCreator.savedSearchQuery ?? {}; + const filters = [...data.query.filterManager.getFilters(), ...(filter ?? [])]; + const layers = await mapLoader.getMapLayersForGeoJob( jobCreator.geoField, jobCreator.splitField, fieldValues, - filters + filters, + query ); setLayerList(layers); } diff --git a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx index f8ad3171af577..7e342bbbfe468 100644 --- a/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx +++ b/x-pack/plugins/ml/public/application/jobs/new_job/pages/components/pick_fields_step/components/geo_view/metric_selection_summary.tsx @@ -55,12 +55,15 @@ export const GeoDetectorsSummary: FC = () => { useEffect(() => { async function getMapLayersForGeoJob() { if (geoField) { - const filters = data.query.filterManager.getFilters() ?? []; + const { filter, query } = jobCreator.savedSearchQuery ?? {}; + const filters = [...data.query.filterManager.getFilters(), ...(filter ?? [])]; + const layers = await mapLoader.getMapLayersForGeoJob( geoField, splitField, fieldValues, - filters + filters, + query ); setLayerList(layers); } diff --git a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/datafeed_auth_high_count_logon_events_for_a_source_ip.json b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/datafeed_auth_high_count_logon_events_for_a_source_ip.json index 35638932adb3e..5080426607f8d 100644 --- a/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/datafeed_auth_high_count_logon_events_for_a_source_ip.json +++ b/x-pack/plugins/ml/server/models/data_recognizer/modules/security_auth/ml/datafeed_auth_high_count_logon_events_for_a_source_ip.json @@ -5,16 +5,24 @@ ], "max_empty_searches": 10, "query": { - "bool": { - "filter": [{"exists": {"field": "source.ip"}}], - "must": [ - {"bool": { - "should": [ - {"term": {"event.category": "authentication"}}, - {"term": {"event.outcome": "success"}} - ] - }} - ] + "bool": { + "filter": [ + { + "exists": { + "field": "source.ip" + } + }, + { + "term": { + "event.category": "authentication" + } + }, + { + "term": { + "event.outcome": "success" + } } + ] + } } -} \ No newline at end of file +} diff --git a/x-pack/plugins/monitoring/dev_docs/how_to/work_with_packages.md b/x-pack/plugins/monitoring/dev_docs/how_to/work_with_packages.md new file mode 100644 index 0000000000000..f1c5eff8d07b8 --- /dev/null +++ b/x-pack/plugins/monitoring/dev_docs/how_to/work_with_packages.md @@ -0,0 +1,179 @@ +# Stack Monitoring integration packages + +The Stack Monitoring packages provide a similar experience as their beats modules counterpart, both for metrics and logs ingestion. Feature wise these two collection modes are used to provide the Stack Monitoring UI the data it needs to power each product views. There is a however a difference in how the data is stored: while standalone beats modules will store all their data in a single data stream, for example `.monitoring-elasticsearch-8-mb`, the integrations will create one data stream for each metricset or filestream, for example `metrics-elasticsearch.stack-monitoring.node-default` for the node metricset. This means the integrations mappings are more specialized because they're split to only define the relevant properties for each metricset but the merged version of an integration data streams should be equivalent to its metricbeat mapping. + +## Links +- [Usage dashboard (internal)](https://ela.st/sm-packages-dashboard) + +## Working with packages + +Make sure you've read the following documents to get up to speed: + +**Workflow:** +- [Ecosystem definitions](https://github.com/elastic/integrations/blob/main/docs/definitions.md) +- [elastic-package getting started](https://github.com/elastic/elastic-package#getting-started) +- [Package testing and validation](https://github.com/elastic/integrations/blob/main/docs/testing_and_validation.md) +- [Developer workflow](https://github.com/elastic/integrations/blob/main/docs/developer_workflow_design_build_test_integration.md) + +**Related repos:** +- [Integrations](https://github.com/elastic/integrations) +- [Package registry](https://github.com/elastic/package-registry/) +- [Package storage](https://github.com/elastic/package-storage/) +- [Package spec](https://github.com/elastic/package-spec) + +### Integration internals + +#### Metrics +For metrics collection, the integrations act as a wrapper around the corresponding metricbeat modules. For example, when the `elasticsearch` integration is configured to collect the `cluster_stats` metrics from a given host, the elastic agent will spawn a metricbeat process with the appropriate configuration. + +Here's the state of the running processes (configuration have been shortened for clarity): + +```mermaid + +flowchart TB +subgraph elastic-agent + ESinteg["elasticsearch integration"] + subgraph policy.yml + Agentpolicy["
    inputs:\n  - id: elasticsearch/metrics-elasticsearch\n    type: elasticsearch/metrics\n    streams:\n      - id: elasticsearch/metrics-elasticsearch.stack_monitoring.cluster_stats\n    metricsets:\n      - cluster_stats\n    hosts:\n      - http://foo:9200\n    ...
    "] + style Agentpolicy text-align:left + end +end + +subgraph metricbeat + ESmodule["elasticsearch module"] + subgraph metricbeat.yml + MBconfig["
    metricbeat.modules:\n  - module: elasticsearch\n    metricsets:\n      - cluster_stats\n    hosts:\n      - http://foo:9200\n    ...
    "] + style MBconfig text-align:left + end +end + +elastic-agent-.->|spawn|metricbeat +ESmodule-.->|config|metricbeat.yml +ESinteg-.->|config|policy.yml +``` + +#### Logs +Similarly, logs collection will spawn a filebeat process. The corresponding filebeat module, if it exists, is not used in this scenario and instead the configuration/ingest pipelines are duplicated in the integration. + +### Defining service dependencies + +A package can define the services it needs to monitor for development and automated testing purposes, for example the mysql package needs a running database to fetch and validate metrics or logs. While we could use the elasticsearch and kibana services started by `elastic-package stack up` we don't want the stack packages to be special cases and just like mysql, the packages should be responsible of defining their dependencies. + +This can be done by creating a `docker-compose` file under the package `_dev/deploy` directory, then running `elastic-package service up -v` in the package folder. An example is the [elasticsearch package](https://github.com/elastic/integrations/tree/main/packages/elasticsearch/_dev/deploy/docker) that starts a service which generates every types of logs with the help of a script executing queries. + +### Collecting logs + +To collect logs elastic-agent needs access to the raw files. Let's see how that works taking `elasticsearch` package as an example. +The setup requires an elastic-package stack and the development elasticsearch started with elastic-package service. While services will generate logs out of the box (eg server, gc logs), some need to be triggered (eg slowlogs). To generate all log types for our tests we also start a script that sends requests to elasticsearch in order to trigger those. + +```mermaid + +flowchart LR +subgraph local host + LOCALlogs["~/.elastic-package/tmp/service_logs ( ${SERVICE_LOGS_DIR} )"] +end + +subgraph "elastic package service (generate logs)" + + subgraph elasticsearch + SEelasticsearchlogs["/usr/share/elasticsearch/logs"] + end + + subgraph logs_generator + SElogsscript["script.sh[3]"] + end +end + +subgraph "elastic package stack (ingest logs)" + subgraph elastic-agent + STagentlogs["/tmp/service_logs"] + end +end + + +LOCALlogs-.->|"mount[1]"|STagentlogs +LOCALlogs-.->|"mount[2]"|SEelasticsearchlogs +SElogsscript-.->|http requests to trigger logs|elasticsearch +``` +[1] https://github.com/elastic/elastic-package/blob/main/internal/profile/_static/docker-compose-stack.yml#L133-L135 + +[2] https://github.com/elastic/integrations/blob/main/packages/elasticsearch/_dev/deploy/docker/docker-compose.yml#L39 +This is a simplified version as there is some gymnastics involved to work around permissions, but the workflow remains the same + +[3] https://github.com/elastic/integrations/blob/main/packages/elasticsearch/_dev/deploy/docker/scripts/generate-logs.sh + +A log file written in the elasticsearch container will be available to the local `~/.elastic-package/tmp/service_logs` directory and thus available to the elastic-agent. Now the integration can be configured to point to the elastic-agent's `/tmp/service_logs`, for example elasticsearch's gc logs will be available under `/tmp/service_logs/gc.log`. + +## Connecting a local Kibana + +You may want to test local Kibana changes against the elastic-package stack, and that's perfectly doable but with some limitations (at the time of writing). + +**Note** that when logging to multiple local Kibana instances you'll have to access them through isolated environments, for example firefox containers, private windows or a different browser. Clearing cookies for the domain also works. There seems to be a conflict with cookies where one is unable to pass the login screen of a local Kibana instance when cookies from another local instance are already cached. The symptom is a redirection to the login screen when entering valid credentials. + +Once an elastic-package stack is started, update `kibana_system` password on the running elasticsearch: + +```bash +curl --insecure -u elastic:changeme -H 'Content-Type: application/json' \ +https://localhost:9200/_security/user/kibana_system/_password -d'{"password": "changeme"}' +``` + +Now configure the local Kibana on a different port so we don't conflict with the one started by elastic-package, and ignore certificate verification: + +```yaml +server.port: 5602 + +elasticsearch.username: kibana_system +elasticsearch.password: changeme +elasticsearch.ignoreVersionMismatch: true +elasticsearch.hosts: ["https://localhost:9200"] +elasticsearch.ssl.verificationMode: none +``` + +then `yarn start`. A local Kibana running at http://localhost:5602 will talk to the elastic-package system, allowing local changes to Kibana to interact with data ingested by integrations. + +Note that the local kibana is not able to interact with the local package-registry when running http, this means we have to do all integration-related interaction on the kibana run by elastic-package (at https://localhost:5601). + +To enable ssl we can point the local kibana configuration to the certificates used by elastic-package (under ~/.elastic-package/profiles/{profile}/certs), then start the process with `NODE_EXTRA_CA_CERTS=~/.elastic-package/profiles/{profile}/certs/ca-cert.pem yarn start`. + +## Testing strategy + +On the package side, we use the testing tools provided by elastic-package for: + +- [static validation of the mappings](https://github.com/elastic/elastic-package/blob/main/docs/howto/static_testing.md) +- [ingest pipeline validation](https://github.com/elastic/elastic-package/blob/main/docs/howto/pipeline_testing.md) +- [validation of live data](https://github.com/elastic/elastic-package/blob/main/docs/howto/system_testing.md) + +See the [elastic-package-test documentation](https://github.com/elastic/elastic-package#elastic-package-test) for more details. + +The system tests spawn a full setup (`elastic-package stack up` + `elastic-package service up`), install the package and attach a policy to a running agent to collect live data. This real-world setup can be leveraged to continuously validate future versions of the stack when they are released. Right now the service dependencies are running on 8.5.0 and the tests validate that this version is supported. The plan is to have an automated job that opens a PR validating that the tests are still successful with the latest released version. + +On the Stack Monitoring side, we have an API integration test suite running against packages; see https://github.com/elastic/kibana/tree/main/x-pack/test/monitoring_api_integration#readme + +## Troubleshooting + +### My elastic-package stack appears to be stuck + +If your stack doesn’t start it might be memory or disk starved. A good indicator is the presence of the following log in the elasticsearch container: + + ```json + {"@timestamp":"2022-06-30T05:55:51.586Z", "log.level": "WARN", "message":"high disk watermark [90%] exceeded on [Vo4wyn23ReWufzMT2R9n3g][5b4a83809124][/usr/share/elasticsearch/data] free: 5.6gb[9.6%], shards will be relocated away from this node; currently relocating away shards totalling [0] bytes; the node is expected to continue to exceed the high disk watermark when these relocations are complete", "ecs.version": "1.2.0","service. name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread. name":"elasticsearch[5b4a83809124][masterService#updateTask][T#1]", "log.logger":"org.elasticsearch.cluster.routing.allocation. DiskThresholdMonitor","elasticsearch.cluster. uuid":"wzlK4-GBTymeP6n_Izf6ZA","elasticsearch.node. id":"Vo4wyn23ReWufzMT2R9n3g","elasticsearch.node.name":"5b4a83809124", "elasticsearch.cluster.name":"elasticsearch"} + ``` + + Try increasing the Docker environments disk threshold or cleaning the stored data. If no such logs appear, inspect every container logs to find the offending component. + +### My package is not showing up in Integrations + +- Ensure the [kibana version](https://github.com/elastic/integrations/blob/7ae8b62ffdee2552d6165f1b287cdd03e1edf1db/packages/elasticsearch/manifest.yml#L16) defined in the manifest supports your local kibana version, +- If the package is a prerelease version and you're running a Kibana with version >= v8.6.0, the package is hidden behind a flag that needs to be activated: + + +### Elastic agent + +By default the agent is monitored which means that dedicated filebeat and metricbeat processes collect logs and metrics from the running agent. This data is then available in the respective Kibana applications under `logs-*` and `metrics-*` patterns. +If you need to look at the raw filebeat/metrics logs they are stored under `/usr/share/elastic-agent/state/data/logs/default` in the container. + +**Additional resources:** +- [v2 diagram](https://github.com/elastic/elastic-agent-shipper/issues/3) +- [Agent onboarding (internal)](https://ela.st/agent-onboarding-doc) +- [Elastic Agent architecture v2 (internal)](https://ela.st/agent-v2-archicture-doc) + diff --git a/x-pack/plugins/monitoring/dev_docs/reference/data_collection_modes.md b/x-pack/plugins/monitoring/dev_docs/reference/data_collection_modes.md index 758eda14f6c21..b34bc550a0a8f 100644 --- a/x-pack/plugins/monitoring/dev_docs/reference/data_collection_modes.md +++ b/x-pack/plugins/monitoring/dev_docs/reference/data_collection_modes.md @@ -145,12 +145,14 @@ Beats also doesn't have filebeat module or recommended configuration, but the lo ### Package-driven collection +See [working with packages](../howto/work_with_packages.md) for details on how to develop and test Stack Monitoring packages. + When using package-driven collection, each component in your Elastic stack is given a corresponding fleet package (also known as "integration"). - [Elasticsearch](https://github.com/elastic/integrations/tree/main/packages/elasticsearch) - [Kibana](https://github.com/elastic/integrations/tree/main/packages/kibana) - [Logstash](https://github.com/elastic/integrations/tree/main/packages/logstash) -- Beats (WIP) +- [Beats](https://github.com/elastic/integrations/tree/main/packages/beat) - Enterprise Search (WIP) An operator will install the package via the monitoring deployment's kibana instance (or possible a separate deployment used for fleet management). @@ -196,4 +198,4 @@ metrics-.->|poll|ClusterStats logs-.->|read|Disk publisher-->|/_bulk|Elasticsearch -``` \ No newline at end of file +``` diff --git a/x-pack/plugins/observability/public/components/app/burn_rate_rule_editor/slo_selector.test.tsx b/x-pack/plugins/observability/public/components/app/burn_rate_rule_editor/slo_selector.test.tsx index 76a7dc5fa0368..67b87c24351e1 100644 --- a/x-pack/plugins/observability/public/components/app/burn_rate_rule_editor/slo_selector.test.tsx +++ b/x-pack/plugins/observability/public/components/app/burn_rate_rule_editor/slo_selector.test.tsx @@ -10,7 +10,7 @@ import userEvent from '@testing-library/user-event'; import { wait } from '@testing-library/user-event/dist/utils'; import React from 'react'; -import { emptySloList } from '../../../data/slo'; +import { emptySloList } from '../../../data/slo/slo'; import { useFetchSloList } from '../../../hooks/slo/use_fetch_slo_list'; import { render } from '../../../utils/test_helper'; import { SloSelector } from './slo_selector'; diff --git a/x-pack/plugins/observability/public/components/shared/page_template/README.md b/x-pack/plugins/observability/public/components/shared/page_template/README.md index acc1d80170636..6b8478578cf1c 100644 --- a/x-pack/plugins/observability/public/components/shared/page_template/README.md +++ b/x-pack/plugins/observability/public/components/shared/page_template/README.md @@ -46,6 +46,8 @@ export interface NavigationEntry { ignoreTrailingSlash?: boolean; // shows NEW badge besides the navigation label, which will automatically disappear when menu item is clicked. isNewFeature?: boolean; + // shows beta badge lab icon if the feature is still beta besides the navigation label + isBeta?: boolean; } ``` diff --git a/x-pack/plugins/observability/public/components/shared/page_template/nav_name_with_beta_badge.tsx b/x-pack/plugins/observability/public/components/shared/page_template/nav_name_with_beta_badge.tsx new file mode 100644 index 0000000000000..c46ccf80f61e7 --- /dev/null +++ b/x-pack/plugins/observability/public/components/shared/page_template/nav_name_with_beta_badge.tsx @@ -0,0 +1,48 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ +import { EuiBetaBadge } from '@elastic/eui'; +import type { IconType } from '@elastic/eui/src/components/icon/icon'; +import { i18n } from '@kbn/i18n'; +import React from 'react'; +import styled from 'styled-components'; + +interface Props { + iconType: IconType; + label: string; +} + +const LabelContainer = styled.span` + max-width: 72%; + float: left; + &:hover, + &:focus-within, + &:focus { + text-decoration: underline; + } +`; + +const StyledBetaBadge = styled(EuiBetaBadge)` + margin-left: 5px; + margin-bottom: -6px; +`; + +export function NavNameWithBetaBadge({ label, iconType }: Props) { + return ( + <> + + {label} + + + + ); +} diff --git a/x-pack/plugins/observability/public/components/shared/page_template/page_template.tsx b/x-pack/plugins/observability/public/components/shared/page_template/page_template.tsx index 47a6649e098cd..79531f6626c2e 100644 --- a/x-pack/plugins/observability/public/components/shared/page_template/page_template.tsx +++ b/x-pack/plugins/observability/public/components/shared/page_template/page_template.tsx @@ -27,6 +27,7 @@ import { ObservabilityAppServices } from '../../../application/types'; import type { NavigationSection } from '../../../services/navigation_registry'; import { ObservabilityTour } from '../tour'; import { NavNameWithBadge, hideBadge } from './nav_name_with_badge'; +import { NavNameWithBetaBadge } from './nav_name_with_beta_badge'; export type WrappedPageTemplateProps = Pick< KibanaPageTemplateProps, @@ -103,6 +104,8 @@ export function ObservabilityPageTemplate({ id: `${sectionIndex}.${entryIndex}`, name: entry.isNewFeature ? ( + ) : entry.isBeta ? ( + ) : ( entry.label ), diff --git a/x-pack/plugins/observability/public/data/slo/historical_summary_data.ts b/x-pack/plugins/observability/public/data/slo/historical_summary_data.ts new file mode 100644 index 0000000000000..36a45ea35e107 --- /dev/null +++ b/x-pack/plugins/observability/public/data/slo/historical_summary_data.ts @@ -0,0 +1,1734 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { FetchHistoricalSummaryResponse } from '@kbn/slo-schema'; + +export const SLO_NO_DATA = 'SLO_NO_DATA'; +export const NO_DATA_TO_HEALTHY_ROLLING_SLO = 'NO_DATA_TO_HEALTHY_ROLLING_SLO'; +export const HEALTHY_ROLLING_SLO = 'HEALTHY_ROLLING_SLO'; +export const HEALTHY_RANDOM_ROLLING_SLO = 'HEALTHY_RANDOM_ROLLING_SLO'; +export const HEALTHY_STEP_DOWN_ROLLING_SLO = 'HEALTHY_STEP_DOWN_ROLLING_SLO'; +export const DEGRADING_FAST_ROLLING_SLO = 'DEGRADING_FAST_ROLLING_SLO'; + +export const historicalSummaryData: FetchHistoricalSummaryResponse = { + [SLO_NO_DATA]: [], + [NO_DATA_TO_HEALTHY_ROLLING_SLO]: [ + { + date: '2022-12-20T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-21T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-22T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-23T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-24T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-25T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-26T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-27T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-28T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: -1, + status: 'NO_DATA', + }, + { + date: '2022-12-29T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, + sliValue: 0.995, + status: 'HEALTHY', + }, + { + date: '2022-12-30T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-31T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.3, + remaining: 0.7, + isEstimated: false, + }, + sliValue: 0.985, + status: 'HEALTHY', + }, + { + date: '2023-01-01T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.4, + remaining: 0.6, + isEstimated: false, + }, + sliValue: 0.98, + status: 'HEALTHY', + }, + { + date: '2023-01-02T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.5, + remaining: 0.5, + isEstimated: false, + }, + sliValue: 0.975, + status: 'HEALTHY', + }, + { + date: '2023-01-03T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.6, + remaining: 0.4, + isEstimated: false, + }, + sliValue: 0.97, + status: 'HEALTHY', + }, + { + date: '2023-01-04T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.7, + remaining: 0.3, + isEstimated: false, + }, + sliValue: 0.965, + status: 'HEALTHY', + }, + { + date: '2023-01-05T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.8, + remaining: 0.2, + isEstimated: false, + }, + sliValue: 0.96, + status: 'HEALTHY', + }, + { + date: '2023-01-06T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.9, + remaining: 0.1, + isEstimated: false, + }, + sliValue: 0.955, + status: 'HEALTHY', + }, + { + date: '2023-01-07T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1, + remaining: 0, + isEstimated: false, + }, + sliValue: 0.95, + status: 'HEALTHY', + }, + { + date: '2023-01-08T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.1, + remaining: -0.1, + isEstimated: false, + }, + sliValue: 0.945, + status: 'VIOLATED', + }, + { + date: '2023-01-09T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.2, + remaining: -0.2, + isEstimated: false, + }, + sliValue: 0.94, + status: 'VIOLATED', + }, + { + date: '2023-01-10T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.3, + remaining: -0.3, + isEstimated: false, + }, + sliValue: 0.935, + status: 'VIOLATED', + }, + { + date: '2023-01-11T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.4, + remaining: -0.4, + isEstimated: false, + }, + sliValue: 0.93, + status: 'VIOLATED', + }, + { + date: '2023-01-12T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.5, + remaining: -0.5, + isEstimated: false, + }, + sliValue: 0.925, + status: 'VIOLATED', + }, + { + date: '2023-01-13T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.6, + remaining: -0.6, + isEstimated: false, + }, + sliValue: 0.92, + status: 'VIOLATED', + }, + { + date: '2023-01-14T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.7, + remaining: -0.7, + isEstimated: false, + }, + sliValue: 0.915, + status: 'VIOLATED', + }, + { + date: '2023-01-15T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.8, + remaining: -0.8, + isEstimated: false, + }, + sliValue: 0.91, + status: 'VIOLATED', + }, + { + date: '2023-01-16T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.9, + remaining: -0.9, + isEstimated: false, + }, + sliValue: 0.905, + status: 'VIOLATED', + }, + { + date: '2023-01-17T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 2, + remaining: -1, + isEstimated: false, + }, + sliValue: 0.9, + status: 'VIOLATED', + }, + { + date: '2023-01-18T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 2.1, + remaining: -1.1, + isEstimated: false, + }, + sliValue: 0.895, + status: 'VIOLATED', + }, + { + date: '2023-01-19T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 2.2, + remaining: -1.2, + isEstimated: false, + }, + sliValue: 0.89, + status: 'VIOLATED', + }, + ], + [HEALTHY_ROLLING_SLO]: [ + { + date: '2022-12-20T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-21T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-22T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-23T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-24T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-25T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-26T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-27T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-28T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-29T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-30T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-31T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-01T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-02T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-03T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-04T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-05T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-06T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-07T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-08T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-09T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-10T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-11T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-12T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-13T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-14T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-15T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-16T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-17T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-18T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2023-01-19T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + ], + [HEALTHY_RANDOM_ROLLING_SLO]: [ + { + date: '2022-12-20T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.792412, + remaining: 0.207588, + isEstimated: false, + }, + sliValue: 0.960379, + status: 'HEALTHY', + }, + { + date: '2022-12-21T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.956593, + remaining: 0.043407, + isEstimated: false, + }, + sliValue: 0.95217, + status: 'HEALTHY', + }, + { + date: '2022-12-22T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.579858, + remaining: 0.420142, + isEstimated: false, + }, + sliValue: 0.971007, + status: 'HEALTHY', + }, + { + date: '2022-12-23T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.248975, + remaining: 0.751025, + isEstimated: false, + }, + sliValue: 0.987551, + status: 'HEALTHY', + }, + { + date: '2022-12-24T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.569716, + remaining: 0.430284, + isEstimated: false, + }, + sliValue: 0.971514, + status: 'HEALTHY', + }, + { + date: '2022-12-25T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.271077, + remaining: 0.728923, + isEstimated: false, + }, + sliValue: 0.986446, + status: 'HEALTHY', + }, + { + date: '2022-12-26T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.199903, + remaining: 0.800097, + isEstimated: false, + }, + sliValue: 0.990005, + status: 'HEALTHY', + }, + { + date: '2022-12-27T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.879368, + remaining: 0.120632, + isEstimated: false, + }, + sliValue: 0.956032, + status: 'HEALTHY', + }, + { + date: '2022-12-28T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.408721, + remaining: 0.591279, + isEstimated: false, + }, + sliValue: 0.979564, + status: 'HEALTHY', + }, + { + date: '2022-12-29T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.684045, + remaining: 0.315955, + isEstimated: false, + }, + sliValue: 0.965798, + status: 'HEALTHY', + }, + { + date: '2022-12-30T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.014247, + remaining: 0.985753, + isEstimated: false, + }, + sliValue: 0.999288, + status: 'HEALTHY', + }, + { + date: '2022-12-31T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.528067, + remaining: 0.471933, + isEstimated: false, + }, + sliValue: 0.973597, + status: 'HEALTHY', + }, + { + date: '2023-01-01T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.168269, + remaining: 0.831731, + isEstimated: false, + }, + sliValue: 0.991587, + status: 'HEALTHY', + }, + { + date: '2023-01-02T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.562795, + remaining: 0.437205, + isEstimated: false, + }, + sliValue: 0.97186, + status: 'HEALTHY', + }, + { + date: '2023-01-03T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.226658, + remaining: 0.773342, + isEstimated: false, + }, + sliValue: 0.988667, + status: 'HEALTHY', + }, + { + date: '2023-01-04T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.723373, + remaining: 0.276627, + isEstimated: false, + }, + sliValue: 0.963831, + status: 'HEALTHY', + }, + { + date: '2023-01-05T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.296797, + remaining: 0.703203, + isEstimated: false, + }, + sliValue: 0.98516, + status: 'HEALTHY', + }, + { + date: '2023-01-06T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.90246, + remaining: 0.09754, + isEstimated: false, + }, + sliValue: 0.954877, + status: 'HEALTHY', + }, + { + date: '2023-01-07T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.561973, + remaining: 0.438027, + isEstimated: false, + }, + sliValue: 0.971901, + status: 'HEALTHY', + }, + { + date: '2023-01-08T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.370939, + remaining: 0.629061, + isEstimated: false, + }, + sliValue: 0.981453, + status: 'HEALTHY', + }, + { + date: '2023-01-09T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.636337, + remaining: 0.363663, + isEstimated: false, + }, + sliValue: 0.968183, + status: 'HEALTHY', + }, + { + date: '2023-01-10T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.99534, + remaining: 0.00466, + isEstimated: false, + }, + sliValue: 0.950233, + status: 'HEALTHY', + }, + { + date: '2023-01-11T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.493501, + remaining: 0.506499, + isEstimated: false, + }, + sliValue: 0.975325, + status: 'HEALTHY', + }, + { + date: '2023-01-12T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.666628, + remaining: 0.333372, + isEstimated: false, + }, + sliValue: 0.966669, + status: 'HEALTHY', + }, + { + date: '2023-01-13T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.708286, + remaining: 0.291714, + isEstimated: false, + }, + sliValue: 0.964586, + status: 'HEALTHY', + }, + { + date: '2023-01-14T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.361611, + remaining: 0.638389, + isEstimated: false, + }, + sliValue: 0.981919, + status: 'HEALTHY', + }, + { + date: '2023-01-15T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.883103, + remaining: 0.116897, + isEstimated: false, + }, + sliValue: 0.955845, + status: 'HEALTHY', + }, + { + date: '2023-01-16T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.104661, + remaining: 0.895339, + isEstimated: false, + }, + sliValue: 0.994767, + status: 'HEALTHY', + }, + { + date: '2023-01-17T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.008557, + remaining: 0.991443, + isEstimated: false, + }, + sliValue: 0.999572, + status: 'HEALTHY', + }, + { + date: '2023-01-18T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.450975, + remaining: 0.549025, + isEstimated: false, + }, + sliValue: 0.977451, + status: 'HEALTHY', + }, + { + date: '2023-01-19T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.145818, + remaining: 0.854182, + isEstimated: false, + }, + sliValue: 0.992709, + status: 'HEALTHY', + }, + ], + [HEALTHY_STEP_DOWN_ROLLING_SLO]: [ + { + date: '2022-12-20T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: 1, + status: 'HEALTHY', + }, + { + date: '2022-12-21T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: 1, + status: 'HEALTHY', + }, + { + date: '2022-12-22T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0, + remaining: 1, + isEstimated: false, + }, + sliValue: 1, + status: 'HEALTHY', + }, + { + date: '2022-12-23T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, + sliValue: 0.995, + status: 'HEALTHY', + }, + { + date: '2022-12-24T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, + sliValue: 0.995, + status: 'HEALTHY', + }, + { + date: '2022-12-25T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, + sliValue: 0.995, + status: 'HEALTHY', + }, + { + date: '2022-12-26T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, + sliValue: 0.995, + status: 'HEALTHY', + }, + { + date: '2022-12-27T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-28T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-29T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-30T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.2, + remaining: 0.8, + isEstimated: false, + }, + sliValue: 0.99, + status: 'HEALTHY', + }, + { + date: '2022-12-31T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.3, + remaining: 0.7, + isEstimated: false, + }, + sliValue: 0.985, + status: 'HEALTHY', + }, + { + date: '2023-01-01T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.3, + remaining: 0.7, + isEstimated: false, + }, + sliValue: 0.985, + status: 'HEALTHY', + }, + { + date: '2023-01-02T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.3, + remaining: 0.7, + isEstimated: false, + }, + sliValue: 0.985, + status: 'HEALTHY', + }, + { + date: '2023-01-03T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.3, + remaining: 0.7, + isEstimated: false, + }, + sliValue: 0.985, + status: 'HEALTHY', + }, + { + date: '2023-01-04T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.4, + remaining: 0.6, + isEstimated: false, + }, + sliValue: 0.98, + status: 'HEALTHY', + }, + { + date: '2023-01-05T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.4, + remaining: 0.6, + isEstimated: false, + }, + sliValue: 0.98, + status: 'HEALTHY', + }, + { + date: '2023-01-06T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.4, + remaining: 0.6, + isEstimated: false, + }, + sliValue: 0.98, + status: 'HEALTHY', + }, + { + date: '2023-01-07T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.4, + remaining: 0.6, + isEstimated: false, + }, + sliValue: 0.98, + status: 'HEALTHY', + }, + { + date: '2023-01-08T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.5, + remaining: 0.5, + isEstimated: false, + }, + sliValue: 0.975, + status: 'HEALTHY', + }, + { + date: '2023-01-09T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.5, + remaining: 0.5, + isEstimated: false, + }, + sliValue: 0.975, + status: 'HEALTHY', + }, + { + date: '2023-01-10T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.5, + remaining: 0.5, + isEstimated: false, + }, + sliValue: 0.975, + status: 'HEALTHY', + }, + { + date: '2023-01-11T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.5, + remaining: 0.5, + isEstimated: false, + }, + sliValue: 0.975, + status: 'HEALTHY', + }, + { + date: '2023-01-12T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.6, + remaining: 0.4, + isEstimated: false, + }, + sliValue: 0.97, + status: 'HEALTHY', + }, + { + date: '2023-01-13T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.6, + remaining: 0.4, + isEstimated: false, + }, + sliValue: 0.97, + status: 'HEALTHY', + }, + { + date: '2023-01-14T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.6, + remaining: 0.4, + isEstimated: false, + }, + sliValue: 0.97, + status: 'HEALTHY', + }, + { + date: '2023-01-15T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.6, + remaining: 0.4, + isEstimated: false, + }, + sliValue: 0.97, + status: 'HEALTHY', + }, + { + date: '2023-01-16T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.7, + remaining: 0.3, + isEstimated: false, + }, + sliValue: 0.965, + status: 'HEALTHY', + }, + { + date: '2023-01-17T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.7, + remaining: 0.3, + isEstimated: false, + }, + sliValue: 0.965, + status: 'HEALTHY', + }, + { + date: '2023-01-18T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.7, + remaining: 0.3, + isEstimated: false, + }, + sliValue: 0.965, + status: 'HEALTHY', + }, + { + date: '2023-01-19T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.7, + remaining: 0.3, + isEstimated: false, + }, + sliValue: 0.965, + status: 'HEALTHY', + }, + ], + [DEGRADING_FAST_ROLLING_SLO]: [ + { + date: '2022-12-20T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.06, + remaining: 0.94, + isEstimated: false, + }, + sliValue: 0.997, + status: 'HEALTHY', + }, + { + date: '2022-12-21T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.12, + remaining: 0.88, + isEstimated: false, + }, + sliValue: 0.994, + status: 'HEALTHY', + }, + { + date: '2022-12-22T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.18, + remaining: 0.82, + isEstimated: false, + }, + sliValue: 0.991, + status: 'HEALTHY', + }, + { + date: '2022-12-23T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.24, + remaining: 0.76, + isEstimated: false, + }, + sliValue: 0.988, + status: 'HEALTHY', + }, + { + date: '2022-12-24T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.3, + remaining: 0.7, + isEstimated: false, + }, + sliValue: 0.985, + status: 'HEALTHY', + }, + { + date: '2022-12-25T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.36, + remaining: 0.64, + isEstimated: false, + }, + sliValue: 0.982, + status: 'HEALTHY', + }, + { + date: '2022-12-26T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.42, + remaining: 0.58, + isEstimated: false, + }, + sliValue: 0.979, + status: 'HEALTHY', + }, + { + date: '2022-12-27T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.48, + remaining: 0.52, + isEstimated: false, + }, + sliValue: 0.976, + status: 'HEALTHY', + }, + { + date: '2022-12-28T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.54, + remaining: 0.46, + isEstimated: false, + }, + sliValue: 0.973, + status: 'HEALTHY', + }, + { + date: '2022-12-29T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.6, + remaining: 0.4, + isEstimated: false, + }, + sliValue: 0.97, + status: 'HEALTHY', + }, + { + date: '2022-12-30T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.66, + remaining: 0.34, + isEstimated: false, + }, + sliValue: 0.967, + status: 'HEALTHY', + }, + { + date: '2022-12-31T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.72, + remaining: 0.28, + isEstimated: false, + }, + sliValue: 0.964, + status: 'HEALTHY', + }, + { + date: '2023-01-01T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.78, + remaining: 0.22, + isEstimated: false, + }, + sliValue: 0.961, + status: 'HEALTHY', + }, + { + date: '2023-01-02T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.84, + remaining: 0.16, + isEstimated: false, + }, + sliValue: 0.958, + status: 'HEALTHY', + }, + { + date: '2023-01-03T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.9, + remaining: 0.1, + isEstimated: false, + }, + sliValue: 0.955, + status: 'HEALTHY', + }, + { + date: '2023-01-04T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 0.96, + remaining: 0.04, + isEstimated: false, + }, + sliValue: 0.952, + status: 'HEALTHY', + }, + { + date: '2023-01-05T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.02, + remaining: -0.02, + isEstimated: false, + }, + sliValue: 0.949, + status: 'VIOLATED', + }, + { + date: '2023-01-06T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.08, + remaining: -0.08, + isEstimated: false, + }, + sliValue: 0.946, + status: 'VIOLATED', + }, + { + date: '2023-01-07T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.14, + remaining: -0.14, + isEstimated: false, + }, + sliValue: 0.943, + status: 'VIOLATED', + }, + { + date: '2023-01-08T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.2, + remaining: -0.2, + isEstimated: false, + }, + sliValue: 0.94, + status: 'VIOLATED', + }, + { + date: '2023-01-09T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.26, + remaining: -0.26, + isEstimated: false, + }, + sliValue: 0.937, + status: 'VIOLATED', + }, + { + date: '2023-01-10T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.32, + remaining: -0.32, + isEstimated: false, + }, + sliValue: 0.934, + status: 'VIOLATED', + }, + { + date: '2023-01-11T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.38, + remaining: -0.38, + isEstimated: false, + }, + sliValue: 0.931, + status: 'VIOLATED', + }, + { + date: '2023-01-12T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.44, + remaining: -0.44, + isEstimated: false, + }, + sliValue: 0.928, + status: 'VIOLATED', + }, + { + date: '2023-01-13T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.5, + remaining: -0.5, + isEstimated: false, + }, + sliValue: 0.925, + status: 'VIOLATED', + }, + { + date: '2023-01-14T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.56, + remaining: -0.56, + isEstimated: false, + }, + sliValue: 0.922, + status: 'VIOLATED', + }, + { + date: '2023-01-15T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.62, + remaining: -0.62, + isEstimated: false, + }, + sliValue: 0.919, + status: 'VIOLATED', + }, + { + date: '2023-01-16T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.68, + remaining: -0.68, + isEstimated: false, + }, + sliValue: 0.916, + status: 'VIOLATED', + }, + { + date: '2023-01-17T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.74, + remaining: -0.74, + isEstimated: false, + }, + sliValue: 0.913, + status: 'VIOLATED', + }, + { + date: '2023-01-18T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.8, + remaining: -0.8, + isEstimated: false, + }, + sliValue: 0.91, + status: 'VIOLATED', + }, + { + date: '2023-01-19T00:00:00.000Z', + errorBudget: { + initial: 0.05, + consumed: 1.86, + remaining: -0.86, + isEstimated: false, + }, + sliValue: 0.907, + status: 'VIOLATED', + }, + ], +}; diff --git a/x-pack/plugins/observability/public/data/slo.ts b/x-pack/plugins/observability/public/data/slo/slo.ts similarity index 69% rename from x-pack/plugins/observability/public/data/slo.ts rename to x-pack/plugins/observability/public/data/slo/slo.ts index 806c5f07231b2..ab9071d7b6ddc 100644 --- a/x-pack/plugins/observability/public/data/slo.ts +++ b/x-pack/plugins/observability/public/data/slo/slo.ts @@ -5,6 +5,8 @@ * 2.0. */ +import { cloneDeep } from 'lodash'; +import { v1 as uuidv1 } from 'uuid'; import { FindSLOResponse, SLOWithSummaryResponse } from '@kbn/slo-schema'; export const emptySloList: FindSLOResponse = { @@ -17,10 +19,10 @@ export const emptySloList: FindSLOResponse = { const now = '2022-12-29T10:11:12.000Z'; const baseSlo: Omit = { - name: 'irrelevant', - description: 'irrelevant', + name: 'super important level service', + description: 'some description useful', indicator: { - type: 'sli.kql.custom' as const, + type: 'sli.kql.custom', params: { index: 'some-index', filter: 'baz: foo and bar > 2', @@ -127,6 +129,12 @@ export const anSLO: SLOWithSummaryResponse = { export const aForecastedSLO: SLOWithSummaryResponse = { ...baseSlo, + timeWindow: { + duration: '1M', + calendar: { + startTime: '2022-01-01T00:00:00.000Z', + }, + }, id: '2f17deb0-725a-11ed-ab7c-4bb641cfc57e', summary: { status: 'HEALTHY', @@ -139,3 +147,39 @@ export const aForecastedSLO: SLOWithSummaryResponse = { }, }, }; + +export function createSLO(params: Partial = {}): SLOWithSummaryResponse { + return cloneDeep({ ...baseSlo, id: uuidv1(), ...params }); +} + +export const anApmAvailabilityIndicator: SLOWithSummaryResponse['indicator'] = { + type: 'sli.apm.transactionErrorRate', + params: { + environment: 'development', + service: 'o11y-app', + transactionType: 'request', + transactionName: 'GET /flaky', + goodStatusCodes: ['2xx', '3xx', '4xx'], + }, +}; + +export const anApmLatencyIndicator: SLOWithSummaryResponse['indicator'] = { + type: 'sli.apm.transactionDuration', + params: { + environment: 'development', + service: 'o11y-app', + transactionType: 'request', + transactionName: 'GET /slow', + 'threshold.us': 5000000, + }, +}; + +export const aCustomKqlIndicator: SLOWithSummaryResponse['indicator'] = { + type: 'sli.kql.custom', + params: { + index: 'some_logs*', + good: 'latency < 300', + total: 'latency > 0', + filter: 'labels.eventId: event-0', + }, +}; diff --git a/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_historical_summary.ts b/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_historical_summary.ts new file mode 100644 index 0000000000000..aa9e0302119fb --- /dev/null +++ b/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_historical_summary.ts @@ -0,0 +1,25 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { HistoricalSummaryResponse } from '@kbn/slo-schema'; +import { + HEALTHY_ROLLING_SLO, + historicalSummaryData, +} from '../../../data/slo/historical_summary_data'; +import { UseFetchHistoricalSummaryResponse, Params } from '../use_fetch_historical_summary'; + +export const useFetchHistoricalSummary = ({ + sloIds = [], +}: Params): UseFetchHistoricalSummaryResponse => { + const data: Record = {}; + sloIds.forEach((sloId) => (data[sloId] = historicalSummaryData[HEALTHY_ROLLING_SLO])); + return { + loading: false, + error: false, + data, + }; +}; diff --git a/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts b/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts index 2227b470a39c0..eabaf41013c1e 100644 --- a/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts +++ b/x-pack/plugins/observability/public/hooks/slo/__storybook_mocks__/use_fetch_slo_list.ts @@ -5,10 +5,10 @@ * 2.0. */ -import { sloList } from '../../../data/slo'; +import { sloList } from '../../../data/slo/slo'; import { UseFetchSloListResponse } from '../use_fetch_slo_list'; -export const useFetchSloList = (name?: string): UseFetchSloListResponse => { +export const useFetchSloList = (): UseFetchSloListResponse => { return { loading: false, error: false, diff --git a/x-pack/plugins/observability/public/hooks/slo/use_fetch_historical_summary.ts b/x-pack/plugins/observability/public/hooks/slo/use_fetch_historical_summary.ts new file mode 100644 index 0000000000000..7bd5385bc8f4c --- /dev/null +++ b/x-pack/plugins/observability/public/hooks/slo/use_fetch_historical_summary.ts @@ -0,0 +1,71 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useCallback, useEffect, useMemo, useState } from 'react'; +import { HttpSetup } from '@kbn/core/public'; +import { FetchHistoricalSummaryResponse } from '@kbn/slo-schema'; + +import { useDataFetcher } from '../use_data_fetcher'; + +const EMPTY_RESPONSE: FetchHistoricalSummaryResponse = {}; + +export interface UseFetchHistoricalSummaryResponse { + data: FetchHistoricalSummaryResponse; + loading: boolean; + error: boolean; +} + +export interface Params { + sloIds: string[]; +} + +export function useFetchHistoricalSummary({ + sloIds = [], +}: Params): UseFetchHistoricalSummaryResponse { + const [historicalSummary, setHistoricalSummary] = useState(EMPTY_RESPONSE); + + const params: Params = useMemo(() => ({ sloIds }), [sloIds]); + const shouldExecuteApiCall = useCallback( + (apiCallParams: Params) => apiCallParams.sloIds.length > 0, + [] + ); + + const { data, loading, error } = useDataFetcher({ + paramsForApiCall: params, + initialDataState: historicalSummary, + executeApiCall: fetchHistoricalSummary, + shouldExecuteApiCall, + }); + + useEffect(() => { + setHistoricalSummary(data); + }, [data]); + + return { data: historicalSummary, loading, error }; +} + +const fetchHistoricalSummary = async ( + params: Params, + abortController: AbortController, + http: HttpSetup +): Promise => { + try { + const response = await http.post( + '/internal/observability/slos/_historical_summary', + { + body: JSON.stringify({ sloIds: params.sloIds }), + signal: abortController.signal, + } + ); + + return response; + } catch (error) { + // ignore error for retrieving slos + } + + return EMPTY_RESPONSE; +}; diff --git a/x-pack/plugins/observability/public/pages/slo_details/components/slo_details.stories.tsx b/x-pack/plugins/observability/public/pages/slo_details/components/slo_details.stories.tsx index 6727f3ca1fd3e..63b12f829f13b 100644 --- a/x-pack/plugins/observability/public/pages/slo_details/components/slo_details.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slo_details/components/slo_details.stories.tsx @@ -8,7 +8,7 @@ import React from 'react'; import { ComponentStory } from '@storybook/react'; -import { anSLO } from '../../../data/slo'; +import { anSLO } from '../../../data/slo/slo'; import { SloDetails as Component, Props } from './slo_details'; export default { diff --git a/x-pack/plugins/observability/public/pages/slo_details/index.test.tsx b/x-pack/plugins/observability/public/pages/slo_details/index.test.tsx index 4859ee228ede8..c2e461a38c4ea 100644 --- a/x-pack/plugins/observability/public/pages/slo_details/index.test.tsx +++ b/x-pack/plugins/observability/public/pages/slo_details/index.test.tsx @@ -14,7 +14,7 @@ import { useLicense } from '../../hooks/use_license'; import { useFetchSloDetails } from '../../hooks/slo/use_fetch_slo_details'; import { render } from '../../utils/test_helper'; import { SloDetailsPage } from '.'; -import { anSLO } from '../../data/slo'; +import { anSLO } from '../../data/slo/slo'; import type { ConfigSchema } from '../../plugin'; import type { Subset } from '../../typings'; import { paths } from '../../config'; diff --git a/x-pack/plugins/observability/public/pages/slo_edit/index.test.tsx b/x-pack/plugins/observability/public/pages/slo_edit/index.test.tsx index 0175f4e5677a9..ee0b1c25dfc97 100644 --- a/x-pack/plugins/observability/public/pages/slo_edit/index.test.tsx +++ b/x-pack/plugins/observability/public/pages/slo_edit/index.test.tsx @@ -21,7 +21,7 @@ import { kibanaStartMock } from '../../utils/kibana_react.mock'; import { ConfigSchema } from '../../plugin'; import { Subset } from '../../typings'; import { SLO_EDIT_FORM_DEFAULT_VALUES } from './constants'; -import { anSLO } from '../../data/slo'; +import { anSLO } from '../../data/slo/slo'; import { paths } from '../../config'; import { SloEditPage } from '.'; @@ -368,7 +368,7 @@ describe('SLO Edit Page', () => { "2f17deb0-725a-11ed-ab7c-4bb641cfc57e", Object { "budgetingMethod": "occurrences", - "description": "irrelevant", + "description": "some description useful", "indicator": Object { "params": Object { "filter": "baz: foo and bar > 2", @@ -378,7 +378,7 @@ describe('SLO Edit Page', () => { }, "type": "sli.kql.custom", }, - "name": "irrelevant", + "name": "super important level service", "objective": Object { "target": 0.98, }, diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_badges.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_badges.stories.tsx similarity index 77% rename from x-pack/plugins/observability/public/pages/slos/components/slo_badges.stories.tsx rename to x-pack/plugins/observability/public/pages/slos/components/badges/slo_badges.stories.tsx index 2a5f5b1d61068..3079b7d3b6709 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_badges.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_badges.stories.tsx @@ -8,13 +8,13 @@ import React from 'react'; import { ComponentStory } from '@storybook/react'; -import { aForecastedSLO } from '../../../data/slo'; -import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator'; +import { aForecastedSLO } from '../../../../data/slo/slo'; +import { KibanaReactStorybookDecorator } from '../../../../utils/kibana_react.storybook_decorator'; import { SloBadges as Component, Props } from './slo_badges'; export default { component: Component, - title: 'app/SLO/ListPage/SloBadges', + title: 'app/SLO/ListPage/Badges/SloBadges', decorators: [KibanaReactStorybookDecorator], }; diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_badges.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_badges.tsx similarity index 75% rename from x-pack/plugins/observability/public/pages/slos/components/slo_badges.tsx rename to x-pack/plugins/observability/public/pages/slos/components/badges/slo_badges.tsx index b6781fba56644..32cdeb785270e 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_badges.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_badges.tsx @@ -10,7 +10,8 @@ import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui'; import { SLOWithSummaryResponse } from '@kbn/slo-schema'; import { SloStatusBadge } from './slo_status_badge'; -import { SloForecastedBadge } from './slo_forecasted_badge'; +import { SloIndicatorTypeBadge } from './slo_indicator_type_badge'; +import { SloTimeWindowBadge } from './slo_time_window_badge'; export interface Props { slo: SLOWithSummaryResponse; @@ -18,12 +19,13 @@ export interface Props { export function SloBadges({ slo }: Props) { return ( - + + - + - + ); diff --git a/x-pack/plugins/observability/public/pages/slos/components/badges/slo_indicator_type_badge.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_indicator_type_badge.stories.tsx new file mode 100644 index 0000000000000..efdd85ef06878 --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_indicator_type_badge.stories.tsx @@ -0,0 +1,35 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { ComponentStory } from '@storybook/react'; + +import { KibanaReactStorybookDecorator } from '../../../../utils/kibana_react.storybook_decorator'; +import { SloIndicatorTypeBadge as Component, Props } from './slo_indicator_type_badge'; +import { + aCustomKqlIndicator, + anApmAvailabilityIndicator, + anApmLatencyIndicator, + createSLO, +} from '../../../../data/slo/slo'; + +export default { + component: Component, + title: 'app/SLO/ListPage/Badges/SloIndicatorTypeBadge', + decorators: [KibanaReactStorybookDecorator], +}; + +const Template: ComponentStory = (props: Props) => ; + +export const WithCustomKql = Template.bind({}); +WithCustomKql.args = { slo: createSLO({ indicator: aCustomKqlIndicator }) }; + +export const WithApmAvailability = Template.bind({}); +WithApmAvailability.args = { slo: createSLO({ indicator: anApmAvailabilityIndicator }) }; + +export const WithApmLatency = Template.bind({}); +WithApmLatency.args = { slo: createSLO({ indicator: anApmLatencyIndicator }) }; diff --git a/x-pack/plugins/observability/public/pages/slos/components/badges/slo_indicator_type_badge.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_indicator_type_badge.tsx new file mode 100644 index 0000000000000..0dde7681b840a --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_indicator_type_badge.tsx @@ -0,0 +1,45 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { EuiBadge } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { SLOWithSummaryResponse } from '@kbn/slo-schema'; +import { assertNever } from '@kbn/std'; +import { euiLightVars } from '@kbn/ui-theme'; +export interface Props { + slo: SLOWithSummaryResponse; +} + +export function SloIndicatorTypeBadge({ slo }: Props) { + return ( +
    + + {toIndicatorLabel(slo.indicator.type)} + +
    + ); +} + +function toIndicatorLabel(indicatorType: SLOWithSummaryResponse['indicator']['type']) { + switch (indicatorType) { + case 'sli.kql.custom': + return i18n.translate('xpack.observability.slos.slo.indicator.customKql', { + defaultMessage: 'KQL', + }); + case 'sli.apm.transactionDuration': + return i18n.translate('xpack.observability.slos.slo.indicator.apmLatency', { + defaultMessage: 'Latency', + }); + case 'sli.apm.transactionErrorRate': + return i18n.translate('xpack.observability.slos.slo.indicator.apmAvailability', { + defaultMessage: 'Availability', + }); + default: + assertNever(indicatorType); + } +} diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_status_badge.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_status_badge.stories.tsx similarity index 78% rename from x-pack/plugins/observability/public/pages/slos/components/slo_status_badge.stories.tsx rename to x-pack/plugins/observability/public/pages/slos/components/badges/slo_status_badge.stories.tsx index 7a41fe152b959..c5a62f51bee0e 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_status_badge.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_status_badge.stories.tsx @@ -8,13 +8,13 @@ import React from 'react'; import { ComponentStory } from '@storybook/react'; -import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator'; +import { KibanaReactStorybookDecorator } from '../../../../utils/kibana_react.storybook_decorator'; import { SloStatusBadge as Component, SloStatusProps } from './slo_status_badge'; -import { anSLO } from '../../../data/slo'; +import { anSLO } from '../../../../data/slo/slo'; export default { component: Component, - title: 'app/SLO/ListPage/SloStatusBadge', + title: 'app/SLO/ListPage/Badges/SloStatusBadge', decorators: [KibanaReactStorybookDecorator], }; diff --git a/x-pack/plugins/observability/public/pages/slos/components/badges/slo_status_badge.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_status_badge.tsx new file mode 100644 index 0000000000000..a1c89ca857b18 --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_status_badge.tsx @@ -0,0 +1,69 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { EuiBadge, EuiFlexItem } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { euiLightVars } from '@kbn/ui-theme'; +import { SLOWithSummaryResponse } from '@kbn/slo-schema'; + +export interface SloStatusProps { + slo: SLOWithSummaryResponse; +} + +export function SloStatusBadge({ slo }: SloStatusProps) { + return ( + <> + +
    + {slo.summary.status === 'NO_DATA' && ( + + {i18n.translate('xpack.observability.slos.slo.state.noData', { + defaultMessage: 'No data', + })} + + )} + + {slo.summary.status === 'HEALTHY' && ( + + {i18n.translate('xpack.observability.slos.slo.state.healthy', { + defaultMessage: 'Healthy', + })} + + )} + + {slo.summary.status === 'DEGRADING' && ( + + {i18n.translate('xpack.observability.slos.slo.state.degrading', { + defaultMessage: 'Degrading', + })} + + )} + + {slo.summary.status === 'VIOLATED' && ( + + {i18n.translate('xpack.observability.slos.slo.state.violated', { + defaultMessage: 'Violated', + })} + + )} +
    +     + {slo.summary.errorBudget.isEstimated && ( + +
    + + {i18n.translate('xpack.observability.slos.slo.state.forecasted', { + defaultMessage: 'Forecasted', + })} + +
    +     + )} + + ); +} diff --git a/x-pack/plugins/observability/public/pages/slos/components/badges/slo_time_window_badge.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_time_window_badge.stories.tsx new file mode 100644 index 0000000000000..9b0ac40e56d2b --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_time_window_badge.stories.tsx @@ -0,0 +1,55 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { ComponentStory } from '@storybook/react'; + +import { KibanaReactStorybookDecorator } from '../../../../utils/kibana_react.storybook_decorator'; +import { SloTimeWindowBadge as Component, Props } from './slo_time_window_badge'; +import { createSLO } from '../../../../data/slo/slo'; + +export default { + component: Component, + title: 'app/SLO/ListPage/Badges/SloTimeWindowBadge', + decorators: [KibanaReactStorybookDecorator], +}; + +const Template: ComponentStory = (props: Props) => ; + +export const With7DaysRolling = Template.bind({}); +With7DaysRolling.args = { slo: createSLO({ timeWindow: { duration: '7d', isRolling: true } }) }; + +export const With30DaysRolling = Template.bind({}); +With30DaysRolling.args = { slo: createSLO({ timeWindow: { duration: '30d', isRolling: true } }) }; + +export const WithMonthlyCalendarStartingToday = Template.bind({}); +WithMonthlyCalendarStartingToday.args = { + slo: createSLO({ + timeWindow: { duration: '1M', calendar: { startTime: new Date().toISOString() } }, + }), +}; + +export const WithMonthlyCalendar = Template.bind({}); +WithMonthlyCalendar.args = { + slo: createSLO({ + timeWindow: { duration: '1M', calendar: { startTime: '2022-01-01T00:00:00.000Z' } }, + }), +}; + +export const WithBiWeeklyCalendar = Template.bind({}); +WithBiWeeklyCalendar.args = { + slo: createSLO({ + timeWindow: { duration: '2w', calendar: { startTime: '2023-01-01T00:00:00.000Z' } }, + }), +}; + +export const WithQuarterlyCalendar = Template.bind({}); +WithQuarterlyCalendar.args = { + slo: createSLO({ + timeWindow: { duration: '1Q', calendar: { startTime: '2022-01-01T00:00:00.000Z' } }, + }), +}; diff --git a/x-pack/plugins/observability/public/pages/slos/components/badges/slo_time_window_badge.tsx b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_time_window_badge.tsx new file mode 100644 index 0000000000000..22f5e6499503e --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/badges/slo_time_window_badge.tsx @@ -0,0 +1,108 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import moment from 'moment'; +import React from 'react'; +import { EuiBadge } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { euiLightVars } from '@kbn/ui-theme'; +import { SLOWithSummaryResponse } from '@kbn/slo-schema'; + +export interface Props { + slo: SLOWithSummaryResponse; +} + +export function SloTimeWindowBadge({ slo }: Props) { + const duration = Number(slo.timeWindow.duration.slice(0, -1)); + const unit = slo.timeWindow.duration.slice(-1); + if ('isRolling' in slo.timeWindow) { + const label = toDurationLabel(duration, unit); + return ( +
    + + {label} + +
    + ); + } + + const unitMoment = toMomentUnitOfTime(unit); + const now = moment.utc(); + const startTime = moment.utc(slo.timeWindow.calendar.startTime); + const differenceInUnit = now.diff(startTime, unitMoment); + + const periodStart = startTime + .clone() + .add(Math.floor(differenceInUnit / duration) * duration, unitMoment); + const periodEnd = periodStart.clone().add(duration, unitMoment); + + const totalDurationInDays = periodEnd.diff(periodStart, 'days'); + const elapsedDurationInDays = now.diff(periodStart, 'days') + 1; + + return ( +
    + + {i18n.translate('xpack.observability.slos.slo.timeWindow.calendar', { + defaultMessage: '{elapsed}/{total} days', + values: { + elapsed: Math.min(elapsedDurationInDays, totalDurationInDays), + total: totalDurationInDays, + }, + })} + +
    + ); +} + +function toDurationLabel(duration: number, durationUnit: string) { + switch (durationUnit) { + case 'd': + return i18n.translate('xpack.observability.slos.slo.timeWindow.days', { + defaultMessage: '{duration} days', + values: { duration }, + }); + case 'w': + return i18n.translate('xpack.observability.slos.slo.timeWindow.weeks', { + defaultMessage: '{duration} weeks', + values: { duration }, + }); + case 'M': + return i18n.translate('xpack.observability.slos.slo.timeWindow.months', { + defaultMessage: '{duration} months', + values: { duration }, + }); + case 'Q': + return i18n.translate('xpack.observability.slos.slo.timeWindow.quarterss', { + defaultMessage: '{duration} quarters', + values: { duration }, + }); + case 'Y': + return i18n.translate('xpack.observability.slos.slo.timeWindow.years', { + defaultMessage: '{duration} years', + values: { duration }, + }); + } +} + +const toMomentUnitOfTime = (unit: string): moment.unitOfTime.Diff | undefined => { + switch (unit) { + case 'd': + return 'days'; + case 'w': + return 'weeks'; + case 'M': + return 'months'; + case 'Q': + return 'quarters'; + case 'Y': + return 'years'; + } +}; diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_delete_confirmation_modal.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_delete_confirmation_modal.stories.tsx index 82e7952144de8..df9f919f838fe 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_delete_confirmation_modal.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_delete_confirmation_modal.stories.tsx @@ -13,7 +13,7 @@ import { SloDeleteConfirmationModal as Component, SloDeleteConfirmationModalProps, } from './slo_delete_confirmation_modal'; -import { anSLO } from '../../../data/slo'; +import { anSLO } from '../../../data/slo/slo'; export default { component: Component, diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_forecasted_badge.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_forecasted_badge.tsx deleted file mode 100644 index 4741660d6e7ad..0000000000000 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_forecasted_badge.tsx +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import React from 'react'; -import { EuiBadge } from '@elastic/eui'; -import { i18n } from '@kbn/i18n'; -import { euiLightVars } from '@kbn/ui-theme'; -import { SLOWithSummaryResponse } from '@kbn/slo-schema'; - -export interface Props { - slo: SLOWithSummaryResponse; -} - -export function SloForecastedBadge({ slo }: Props) { - if (!slo.summary.errorBudget.isEstimated) { - return null; - } - - return ( -
    - - {i18n.translate('xpack.observability.slos.slo.state.forecasted', { - defaultMessage: 'Forecasted', - })} - -
    - ); -} diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx index e2ac314a29911..e91d42fb5b438 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list.tsx @@ -30,7 +30,7 @@ export function SloList() { const { loading, error, - sloList: { results: slos = [], total, perPage }, + sloList: { results: sloList = [], total, perPage }, } = useFetchSloList({ page: activePage + 1, name: query, @@ -88,7 +88,7 @@ export function SloList() { - {slos.length ? ( + {sloList.length ? ( diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.stories.tsx index 19c6f1b922887..2cf37d6eea30d 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.stories.tsx @@ -8,7 +8,11 @@ import React from 'react'; import { ComponentStory } from '@storybook/react'; -import { anSLO } from '../../../data/slo'; +import { + HEALTHY_ROLLING_SLO, + historicalSummaryData, +} from '../../../data/slo/historical_summary_data'; +import { anSLO } from '../../../data/slo/slo'; import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator'; import { SloListItem as Component, SloListItemProps } from './slo_list_item'; @@ -24,6 +28,7 @@ const Template: ComponentStory = (props: SloListItemProps) => const defaultProps = { slo: anSLO, + historicalSummary: historicalSummaryData[HEALTHY_ROLLING_SLO], }; export const SloListItem = Template.bind({}); diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.tsx index 787c077e2456b..0ea2f14a97352 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list_item.tsx @@ -12,26 +12,34 @@ import { EuiContextMenuPanel, EuiFlexGroup, EuiFlexItem, - EuiLink, EuiPanel, EuiPopover, + EuiText, } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; -import { SLOWithSummaryResponse } from '@kbn/slo-schema'; +import { HistoricalSummaryResponse, SLOWithSummaryResponse } from '@kbn/slo-schema'; import { useKibana } from '../../../utils/kibana_react'; -import { SloSummaryStats } from './slo_summary_stats'; +import { SloSummary } from './slo_summary'; import { SloDeleteConfirmationModal } from './slo_delete_confirmation_modal'; -import { SloBadges } from './slo_badges'; +import { SloBadges } from './badges/slo_badges'; import { paths } from '../../../config'; export interface SloListItemProps { slo: SLOWithSummaryResponse; + historicalSummary?: HistoricalSummaryResponse[]; + historicalSummaryLoading: boolean; onDeleted: () => void; onDeleting: () => void; } -export function SloListItem({ slo, onDeleted, onDeleting }: SloListItemProps) { +export function SloListItem({ + slo, + historicalSummary = [], + historicalSummaryLoading, + onDeleted, + onDeleting, +}: SloListItemProps) { const { application: { navigateToUrl }, http: { basePath }, @@ -55,10 +63,6 @@ export function SloListItem({ slo, onDeleted, onDeleting }: SloListItemProps) { setIsActionsPopoverOpen(false); }; - const handleNavigate = () => { - navigateToUrl(basePath.prepend(paths.observability.sloDetails(slo.id))); - }; - const handleDeleteCancel = () => { setDeleteConfirmationModalOpen(false); setIsDeleting(false); @@ -83,14 +87,18 @@ export function SloListItem({ slo, onDeleted, onDeleting }: SloListItemProps) { - {slo.name} + {slo.name} - + diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.stories.tsx index c4346e57e0dd9..59465a2a07005 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.stories.tsx @@ -9,8 +9,8 @@ import React from 'react'; import { ComponentStory } from '@storybook/react'; import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator'; -import { SloListItems as Component, SloListItemsProps } from './slo_list_items'; -import { aForecastedSLO, anSLO } from '../../../data/slo'; +import { SloListItems as Component, Props } from './slo_list_items'; +import { aForecastedSLO, anSLO } from '../../../data/slo/slo'; export default { component: Component, @@ -18,12 +18,10 @@ export default { decorators: [KibanaReactStorybookDecorator], }; -const Template: ComponentStory = (props: SloListItemsProps) => ( - -); +const Template: ComponentStory = (props: Props) => ; -const defaultProps: SloListItemsProps = { - slos: [anSLO, anSLO, aForecastedSLO], +const defaultProps: Props = { + sloList: [anSLO, anSLO, aForecastedSLO], loading: false, error: false, onDeleted: () => {}, diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.tsx index 85a2efc16e00b..71ba38092e6f7 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_list_items.tsx @@ -4,34 +4,52 @@ * 2.0; you may not use this file except in compliance with the Elastic License * 2.0. */ -import React from 'react'; +import React, { useState, useEffect } from 'react'; import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui'; import { SLOWithSummaryResponse } from '@kbn/slo-schema'; +import { useFetchHistoricalSummary } from '../../../hooks/slo/use_fetch_historical_summary'; import { SloListItem } from './slo_list_item'; import { SloListEmpty } from './slo_list_empty'; import { SloListError } from './slo_list_error'; -export interface SloListItemsProps { - slos: SLOWithSummaryResponse[]; +export interface Props { + sloList: SLOWithSummaryResponse[]; loading: boolean; error: boolean; onDeleted: () => void; onDeleting: () => void; } -export function SloListItems({ slos, loading, error, onDeleted, onDeleting }: SloListItemsProps) { +export function SloListItems({ sloList, loading, error, onDeleted, onDeleting }: Props) { + const [sloIds, setSloIds] = useState([]); + useEffect(() => { + setSloIds(sloList.map((slo) => slo.id)); + }, [sloList]); + + const { loading: historicalSummaryLoading, data: historicalSummaryBySlo } = + useFetchHistoricalSummary({ sloIds }); + + if (!loading && !error && sloList.length === 0) { + return ; + } + if (!loading && error) { + return ; + } + return ( - {slos.length - ? slos.map((slo) => ( - - - - )) - : null} - {!loading && slos.length === 0 && !error ? : null} - {!loading && slos.length === 0 && error ? : null} + {sloList.map((slo) => ( + + + + ))} ); } diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_sparkline.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_sparkline.stories.tsx new file mode 100644 index 0000000000000..d934901a34370 --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_sparkline.stories.tsx @@ -0,0 +1,123 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React from 'react'; +import { ComponentStory } from '@storybook/react'; + +import { HistoricalSummaryResponse } from '@kbn/slo-schema'; +import { + HEALTHY_ROLLING_SLO, + HEALTHY_RANDOM_ROLLING_SLO, + HEALTHY_STEP_DOWN_ROLLING_SLO, + historicalSummaryData, + DEGRADING_FAST_ROLLING_SLO, + NO_DATA_TO_HEALTHY_ROLLING_SLO, +} from '../../../data/slo/historical_summary_data'; +import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator'; +import { SloSparkline as Component, Props } from './slo_sparkline'; + +export default { + component: Component, + title: 'app/SLO/ListPage/SloSparkline', + decorators: [KibanaReactStorybookDecorator], +}; + +const Template: ComponentStory = (props: Props) => ; + +export const AreaWithHealthyFlatData = Template.bind({}); +AreaWithHealthyFlatData.args = { + chart: 'area', + state: 'success', + id: 'history', + data: toBudgetBurnDown(historicalSummaryData[HEALTHY_ROLLING_SLO]), +}; + +export const AreaWithHealthyRandomData = Template.bind({}); +AreaWithHealthyRandomData.args = { + chart: 'area', + state: 'success', + id: 'history', + data: toBudgetBurnDown(historicalSummaryData[HEALTHY_RANDOM_ROLLING_SLO]), +}; + +export const AreaWithHealthyStepDownData = Template.bind({}); +AreaWithHealthyStepDownData.args = { + chart: 'area', + state: 'success', + id: 'history', + data: toBudgetBurnDown(historicalSummaryData[HEALTHY_STEP_DOWN_ROLLING_SLO]), +}; + +export const AreaWithDegradingLinearData = Template.bind({}); +AreaWithDegradingLinearData.args = { + chart: 'area', + state: 'error', + id: 'history', + data: toBudgetBurnDown(historicalSummaryData[DEGRADING_FAST_ROLLING_SLO]), +}; + +export const AreaWithNoDataToDegradingLinearData = Template.bind({}); +AreaWithNoDataToDegradingLinearData.args = { + chart: 'area', + state: 'error', + id: 'history', + data: toBudgetBurnDown(historicalSummaryData[NO_DATA_TO_HEALTHY_ROLLING_SLO]), +}; + +export const LineWithHealthyFlatData = Template.bind({}); +LineWithHealthyFlatData.args = { + chart: 'line', + state: 'success', + id: 'history', + data: toSliHistory(historicalSummaryData[HEALTHY_ROLLING_SLO]), +}; + +export const LineWithHealthyRandomData = Template.bind({}); +LineWithHealthyRandomData.args = { + chart: 'line', + state: 'success', + id: 'history', + data: toSliHistory(historicalSummaryData[HEALTHY_RANDOM_ROLLING_SLO]), +}; + +export const LineWithHealthyStepDownData = Template.bind({}); +LineWithHealthyStepDownData.args = { + chart: 'line', + state: 'success', + id: 'history', + data: toSliHistory(historicalSummaryData[HEALTHY_STEP_DOWN_ROLLING_SLO]), +}; + +export const LineWithDegradingLinearData = Template.bind({}); +LineWithDegradingLinearData.args = { + chart: 'line', + state: 'error', + id: 'history', + data: toSliHistory(historicalSummaryData[DEGRADING_FAST_ROLLING_SLO]), +}; + +export const LineWithNoDataToDegradingLinearData = Template.bind({}); +LineWithNoDataToDegradingLinearData.args = { + chart: 'line', + state: 'error', + id: 'history', + data: toSliHistory(historicalSummaryData[NO_DATA_TO_HEALTHY_ROLLING_SLO]), +}; + +function toBudgetBurnDown(data: HistoricalSummaryResponse[]) { + return data.map((datum) => ({ + key: new Date(datum.date).getTime(), + value: datum.status === 'NO_DATA' ? undefined : datum.errorBudget.remaining, + })); +} + +function toSliHistory(data: HistoricalSummaryResponse[]) { + return data.map((datum) => ({ + key: new Date(datum.date).getTime(), + value: datum.status === 'NO_DATA' ? undefined : datum.sliValue, + })); +} diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_sparkline.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_sparkline.tsx new file mode 100644 index 0000000000000..d44d8289b5d66 --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_sparkline.tsx @@ -0,0 +1,69 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { AreaSeries, Chart, Fit, LineSeries, ScaleType, Settings } from '@elastic/charts'; +import React from 'react'; +import { EuiLoadingChart, useEuiTheme } from '@elastic/eui'; +import { EUI_SPARKLINE_THEME_PARTIAL } from '@elastic/eui/dist/eui_charts_theme'; +import { useKibana } from '../../../utils/kibana_react'; + +interface Data { + key: number; + value: number | undefined; +} +type ChartType = 'area' | 'line'; +type State = 'success' | 'error'; + +export interface Props { + id: string; + data: Data[]; + chart: ChartType; + state: State; + loading: boolean; +} + +export function SloSparkline({ chart, data, id, loading, state }: Props) { + const charts = useKibana().services.charts; + const theme = charts.theme.useChartsTheme(); + const baseTheme = charts.theme.useChartsBaseTheme(); + + const { euiTheme } = useEuiTheme(); + + const color = state === 'error' ? euiTheme.colors.danger : euiTheme.colors.success; + const ChartComponent = chart === 'area' ? AreaSeries : LineSeries; + + if (loading) { + return ; + } + + return ( + + + + + ); +} diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_status_badge.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_status_badge.tsx deleted file mode 100644 index c541adfa28f6a..0000000000000 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_status_badge.tsx +++ /dev/null @@ -1,54 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import React from 'react'; -import { EuiBadge } from '@elastic/eui'; -import { i18n } from '@kbn/i18n'; -import { euiLightVars } from '@kbn/ui-theme'; -import { SLOWithSummaryResponse } from '@kbn/slo-schema'; - -export interface SloStatusProps { - slo: SLOWithSummaryResponse; -} - -export function SloStatusBadge({ slo }: SloStatusProps) { - return ( -
    - {slo.summary.status === 'NO_DATA' && ( - - {i18n.translate('xpack.observability.slos.slo.state.noData', { - defaultMessage: 'No data', - })} - - )} - - {slo.summary.status === 'HEALTHY' && ( - - {i18n.translate('xpack.observability.slos.slo.state.healthy', { - defaultMessage: 'Healthy', - })} - - )} - - {slo.summary.status === 'DEGRADING' && ( - - {i18n.translate('xpack.observability.slos.slo.state.degrading', { - defaultMessage: 'Degrading', - })} - - )} - - {slo.summary.status === 'VIOLATED' && ( - - {i18n.translate('xpack.observability.slos.slo.state.violated', { - defaultMessage: 'Violated', - })} - - )} -
    - ); -} diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_forecasted_badge.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_summary.stories.tsx similarity index 51% rename from x-pack/plugins/observability/public/pages/slos/components/slo_forecasted_badge.stories.tsx rename to x-pack/plugins/observability/public/pages/slos/components/slo_summary.stories.tsx index 376dc5ef3d8c2..8c7a9f7cab909 100644 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_forecasted_badge.stories.tsx +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_summary.stories.tsx @@ -9,20 +9,29 @@ import React from 'react'; import { ComponentStory } from '@storybook/react'; import { KibanaReactStorybookDecorator } from '../../../utils/kibana_react.storybook_decorator'; -import { SloForecastedBadge as Component, Props } from './slo_forecasted_badge'; -import { aForecastedSLO } from '../../../data/slo'; +import { + HEALTHY_ROLLING_SLO, + historicalSummaryData, +} from '../../../data/slo/historical_summary_data'; +import { createSLO } from '../../../data/slo/slo'; +import { SloSummary as Component, Props } from './slo_summary'; export default { component: Component, - title: 'app/SLO/ListPage/SloForecastedBadge', + title: 'app/SLO/ListPage/SloSummary', decorators: [KibanaReactStorybookDecorator], }; const Template: ComponentStory = (props: Props) => ; const defaultProps = { - slo: aForecastedSLO, + slo: createSLO(), + historicalSummary: historicalSummaryData[HEALTHY_ROLLING_SLO], + historicalSummaryLoading: false, }; -export const SloForecastedBadge = Template.bind({}); -SloForecastedBadge.args = defaultProps; +export const WithHistoricalData = Template.bind({}); +WithHistoricalData.args = { ...defaultProps }; + +export const WithLoadingData = Template.bind({}); +WithLoadingData.args = { ...defaultProps, historicalSummaryLoading: true }; diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_summary.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_summary.tsx new file mode 100644 index 0000000000000..e9d90c76ae6a8 --- /dev/null +++ b/x-pack/plugins/observability/public/pages/slos/components/slo_summary.tsx @@ -0,0 +1,93 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ +import React from 'react'; +import { EuiFlexGroup, EuiFlexItem, EuiStat } from '@elastic/eui'; +import { i18n } from '@kbn/i18n'; +import { HistoricalSummaryResponse, SLOWithSummaryResponse } from '@kbn/slo-schema'; + +import { NOT_AVAILABLE_LABEL } from '../../../../common/i18n'; +import { asPercentWithTwoDecimals } from '../../../../common/utils/formatters'; +import { SloSparkline } from './slo_sparkline'; + +export interface Props { + slo: SLOWithSummaryResponse; + historicalSummary?: HistoricalSummaryResponse[]; + historicalSummaryLoading: boolean; +} + +export function SloSummary({ slo, historicalSummary = [], historicalSummaryLoading }: Props) { + const isSloFailed = slo.summary.status === 'VIOLATED' || slo.summary.status === 'DEGRADING'; + const titleColor = isSloFailed ? 'danger' : ''; + + const historicalSliData = historicalSummary.map((data) => ({ + key: new Date(data.date).getTime(), + value: data.status === 'NO_DATA' ? undefined : data.sliValue, + })); + const errorBudgetBurnDownData = historicalSummary.map((data) => ({ + key: new Date(data.date).getTime(), + value: data.status === 'NO_DATA' ? undefined : data.errorBudget.remaining, + })); + + return ( + + + + + + + + + + + + + + + + + + + + + + + + ); +} diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_summary_stats.stories.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_summary_stats.stories.tsx deleted file mode 100644 index ca7e3727e02b2..0000000000000 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_summary_stats.stories.tsx +++ /dev/null @@ -1,29 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import React from 'react'; -import { ComponentStory } from '@storybook/react'; - -import { anSLO } from '../../../data/slo'; -import { SloSummaryStats as Component, SloSummaryStatsProps } from './slo_summary_stats'; - -export default { - component: Component, - title: 'app/SLO/ListPage/SloSummaryStats', - argTypes: {}, -}; - -const Template: ComponentStory = (props: SloSummaryStatsProps) => ( - -); - -const defaultProps = { - slo: anSLO, -}; - -export const SloSummaryStats = Template.bind({}); -SloSummaryStats.args = defaultProps; diff --git a/x-pack/plugins/observability/public/pages/slos/components/slo_summary_stats.tsx b/x-pack/plugins/observability/public/pages/slos/components/slo_summary_stats.tsx deleted file mode 100644 index 23f372702c405..0000000000000 --- a/x-pack/plugins/observability/public/pages/slos/components/slo_summary_stats.tsx +++ /dev/null @@ -1,83 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ -import React from 'react'; -import { EuiFlexGroup, EuiFlexItem, EuiStat } from '@elastic/eui'; -import { i18n } from '@kbn/i18n'; -import { SLOWithSummaryResponse } from '@kbn/slo-schema'; - -import { NOT_AVAILABLE_LABEL } from '../../../../common/i18n'; -import { asPercentWithTwoDecimals } from '../../../../common/utils/formatters'; -import { getSloDifference } from '../helpers/get_slo_difference'; - -export interface SloSummaryStatsProps { - slo: SLOWithSummaryResponse; -} - -export function SloSummaryStats({ slo }: SloSummaryStatsProps) { - const titleColor = slo.summary.status === 'VIOLATED' ? 'danger' : ''; - const { label } = getSloDifference(slo); - - return ( - - - - - - - - - - - - - - - - - - - - - - - ); -} diff --git a/x-pack/plugins/observability/public/pages/slos/helpers/get_slo_difference.ts b/x-pack/plugins/observability/public/pages/slos/helpers/get_slo_difference.ts deleted file mode 100644 index 1e00ff326c11b..0000000000000 --- a/x-pack/plugins/observability/public/pages/slos/helpers/get_slo_difference.ts +++ /dev/null @@ -1,25 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ -import { SLOWithSummaryResponse } from '@kbn/slo-schema'; - -import { NOT_AVAILABLE_LABEL } from '../../../../common/i18n'; -import { asPercent } from '../../../../common/utils/formatters'; - -export function getSloDifference(slo: SLOWithSummaryResponse) { - if (slo.summary.status === 'NO_DATA') { - return { - value: Number.NaN, - label: NOT_AVAILABLE_LABEL, - }; - } - const difference = slo.summary.sliValue - slo.objective.target; - - return { - value: difference, - label: `${difference > 0 ? '+' : ''}${asPercent(difference, 1)}`, - }; -} diff --git a/x-pack/plugins/observability/public/pages/slos/index.test.tsx b/x-pack/plugins/observability/public/pages/slos/index.test.tsx index 4808eed9af5d2..fc2bf1602063e 100644 --- a/x-pack/plugins/observability/public/pages/slos/index.test.tsx +++ b/x-pack/plugins/observability/public/pages/slos/index.test.tsx @@ -11,11 +11,14 @@ import { screen } from '@testing-library/react'; import { render } from '../../utils/test_helper'; import { useKibana } from '../../utils/kibana_react'; import { useFetchSloList } from '../../hooks/slo/use_fetch_slo_list'; +import { useFetchHistoricalSummary } from '../../hooks/slo/use_fetch_historical_summary'; import { useLicense } from '../../hooks/use_license'; import { SlosPage } from '.'; -import { emptySloList, sloList } from '../../data/slo'; +import { emptySloList, sloList } from '../../data/slo/slo'; import type { ConfigSchema } from '../../plugin'; import type { Subset } from '../../typings'; +import { chartPluginMock } from '@kbn/charts-plugin/public/mocks'; +import { historicalSummaryData } from '../../data/slo/historical_summary_data'; jest.mock('react-router-dom', () => ({ ...jest.requireActual('react-router-dom'), @@ -26,10 +29,12 @@ jest.mock('../../utils/kibana_react'); jest.mock('../../hooks/use_breadcrumbs'); jest.mock('../../hooks/use_license'); jest.mock('../../hooks/slo/use_fetch_slo_list'); +jest.mock('../../hooks/slo/use_fetch_historical_summary'); const useKibanaMock = useKibana as jest.Mock; const useLicenseMock = useLicense as jest.Mock; const useFetchSloListMock = useFetchSloList as jest.Mock; +const useFetchHistoricalSummaryMock = useFetchHistoricalSummary as jest.Mock; const mockNavigate = jest.fn(); @@ -37,6 +42,7 @@ const mockKibana = () => { useKibanaMock.mockReturnValue({ services: { application: { navigateToUrl: mockNavigate }, + charts: chartPluginMock.createSetupContract(), http: { basePath: { prepend: jest.fn(), @@ -105,6 +111,10 @@ describe('SLOs Page', () => { it('renders the SLOs page when the API has finished loading and there are results', async () => { useFetchSloListMock.mockReturnValue({ loading: false, sloList }); useLicenseMock.mockReturnValue({ hasAtLeast: () => true }); + useFetchHistoricalSummaryMock.mockReturnValue({ + loading: false, + data: historicalSummaryData, + }); render(, config); diff --git a/x-pack/plugins/observability/public/services/navigation_registry.ts b/x-pack/plugins/observability/public/services/navigation_registry.ts index 706a8850c1788..4a40cae093280 100644 --- a/x-pack/plugins/observability/public/services/navigation_registry.ts +++ b/x-pack/plugins/observability/public/services/navigation_registry.ts @@ -32,6 +32,8 @@ export interface NavigationEntry { onClick?: (event: React.MouseEvent) => void; // shows NEW badge besides the navigation label, which will automatically disappear when menu item is clicked. isNewFeature?: boolean; + // shows beta badge lab icon if the feature is still beta besides the navigation label + isBeta?: boolean; // override default path matching logic to determine if nav entry is selected matchPath?: (path: string) => boolean; } diff --git a/x-pack/plugins/observability/public/utils/kibana_react.storybook_decorator.tsx b/x-pack/plugins/observability/public/utils/kibana_react.storybook_decorator.tsx index aa1cfbd6bea3c..a0f6c1f7a3192 100644 --- a/x-pack/plugins/observability/public/utils/kibana_react.storybook_decorator.tsx +++ b/x-pack/plugins/observability/public/utils/kibana_react.storybook_decorator.tsx @@ -11,6 +11,12 @@ export function KibanaReactStorybookDecorator(Story: ComponentType) { return ( {}, + useChartsBaseTheme: () => {}, + }, + }, application: { navigateToUrl: () => {} }, http: { basePath: { prepend: (_: string) => '' } }, docLinks: { links: { query: {} } }, diff --git a/x-pack/plugins/observability/server/domain/models/common.ts b/x-pack/plugins/observability/server/domain/models/common.ts index 08b81a44c71ed..3e734146e8994 100644 --- a/x-pack/plugins/observability/server/domain/models/common.ts +++ b/x-pack/plugins/observability/server/domain/models/common.ts @@ -6,9 +6,16 @@ */ import * as t from 'io-ts'; -import { dateRangeSchema, statusSchema } from '@kbn/slo-schema'; +import { + dateRangeSchema, + historicalSummarySchema, + statusSchema, + summarySchema, +} from '@kbn/slo-schema'; type Status = t.TypeOf; type DateRange = t.TypeOf; +type HistoricalSummary = t.TypeOf; +type Summary = t.TypeOf; -export type { DateRange, Status }; +export type { DateRange, HistoricalSummary, Status, Summary }; diff --git a/x-pack/plugins/observability/server/domain/models/indicators.ts b/x-pack/plugins/observability/server/domain/models/indicators.ts index 88c0e2dd8e5ae..6df394b031ce5 100644 --- a/x-pack/plugins/observability/server/domain/models/indicators.ts +++ b/x-pack/plugins/observability/server/domain/models/indicators.ts @@ -9,7 +9,6 @@ import * as t from 'io-ts'; import { apmTransactionDurationIndicatorSchema, apmTransactionErrorRateIndicatorSchema, - historicalSummarySchema, indicatorDataSchema, indicatorSchema, indicatorTypesSchema, @@ -22,7 +21,6 @@ type KQLCustomIndicator = t.TypeOf; type Indicator = t.TypeOf; type IndicatorTypes = t.TypeOf; type IndicatorData = t.TypeOf; -type HistoricalSummary = t.TypeOf; export type { Indicator, @@ -31,5 +29,4 @@ export type { APMTransactionDurationIndicator, KQLCustomIndicator, IndicatorData, - HistoricalSummary, }; diff --git a/x-pack/plugins/observability/server/domain/models/slo.ts b/x-pack/plugins/observability/server/domain/models/slo.ts index 777b78fbcd5b2..4c6cd6dd12a72 100644 --- a/x-pack/plugins/observability/server/domain/models/slo.ts +++ b/x-pack/plugins/observability/server/domain/models/slo.ts @@ -11,7 +11,6 @@ import { sloSchema, sloWithSummarySchema } from '@kbn/slo-schema'; type SLO = t.TypeOf; type SLOId = t.TypeOf; type SLOWithSummary = t.TypeOf; - type StoredSLO = t.OutputOf; export type { SLO, SLOWithSummary, SLOId, StoredSLO }; diff --git a/x-pack/plugins/observability/server/domain/services/date_range.test.ts b/x-pack/plugins/observability/server/domain/services/date_range.test.ts index 3b4328cbd08a3..83af1dc5d1d2b 100644 --- a/x-pack/plugins/observability/server/domain/services/date_range.test.ts +++ b/x-pack/plugins/observability/server/domain/services/date_range.test.ts @@ -6,14 +6,15 @@ */ import { TimeWindow } from '../models/time_window'; -import { Duration, DurationUnit } from '../models'; +import { Duration } from '../models'; import { toDateRange } from './date_range'; - -const THIRTY_DAYS = new Duration(30, DurationUnit.Day); -const WEEKLY = new Duration(1, DurationUnit.Week); -const BIWEEKLY = new Duration(2, DurationUnit.Week); -const MONTHLY = new Duration(1, DurationUnit.Month); -const QUARTERLY = new Duration(1, DurationUnit.Quarter); +import { + oneMonth, + oneQuarter, + oneWeek, + thirtyDays, + twoWeeks, +} from '../../services/slo/fixtures/duration'; const NOW = new Date('2022-08-11T08:31:00.000Z'); @@ -23,7 +24,7 @@ describe('toDateRange', () => { const futureDate = new Date(); futureDate.setFullYear(futureDate.getFullYear() + 1); - const timeWindow = aCalendarTimeWindow(WEEKLY, futureDate); + const timeWindow = aCalendarTimeWindow(oneWeek(), futureDate); expect(() => toDateRange(timeWindow, NOW)).toThrow( 'Cannot compute date range with future starting time' ); @@ -31,7 +32,7 @@ describe('toDateRange', () => { describe("with 'weekly' duration", () => { it('computes the date range when starting the same day', () => { - const timeWindow = aCalendarTimeWindow(WEEKLY, new Date('2022-08-11T08:30:00.000Z')); + const timeWindow = aCalendarTimeWindow(oneWeek(), new Date('2022-08-11T08:30:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-08-11T08:30:00.000Z'), to: new Date('2022-08-18T08:30:00.000Z'), @@ -39,7 +40,7 @@ describe('toDateRange', () => { }); it('computes the date range when starting a month ago', () => { - const timeWindow = aCalendarTimeWindow(WEEKLY, new Date('2022-07-05T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(oneWeek(), new Date('2022-07-05T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-08-09T08:00:00.000Z'), to: new Date('2022-08-16T08:00:00.000Z'), @@ -49,7 +50,7 @@ describe('toDateRange', () => { describe("with 'bi-weekly' duration", () => { it('computes the date range when starting the same day', () => { - const timeWindow = aCalendarTimeWindow(BIWEEKLY, new Date('2022-08-11T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(twoWeeks(), new Date('2022-08-11T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-08-11T08:00:00.000Z'), to: new Date('2022-08-25T08:00:00.000Z'), @@ -57,17 +58,17 @@ describe('toDateRange', () => { }); it('computes the date range when starting a month ago', () => { - const timeWindow = aCalendarTimeWindow(BIWEEKLY, new Date('2022-07-05T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(twoWeeks(), new Date('2022-07-05T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ - from: new Date('2022-08-09T08:00:00.000Z'), - to: new Date('2022-08-23T08:00:00.000Z'), + from: new Date('2022-08-02T08:00:00.000Z'), + to: new Date('2022-08-16T08:00:00.000Z'), }); }); }); describe("with 'monthly' duration", () => { it('computes the date range when starting the same month', () => { - const timeWindow = aCalendarTimeWindow(MONTHLY, new Date('2022-08-01T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(oneMonth(), new Date('2022-08-01T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-08-01T08:00:00.000Z'), to: new Date('2022-09-01T08:00:00.000Z'), @@ -75,7 +76,7 @@ describe('toDateRange', () => { }); it('computes the date range when starting a month ago', () => { - const timeWindow = aCalendarTimeWindow(MONTHLY, new Date('2022-07-01T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(oneMonth(), new Date('2022-07-01T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-08-01T08:00:00.000Z'), to: new Date('2022-09-01T08:00:00.000Z'), @@ -85,7 +86,7 @@ describe('toDateRange', () => { describe("with 'quarterly' duration", () => { it('computes the date range when starting the same quarter', () => { - const timeWindow = aCalendarTimeWindow(QUARTERLY, new Date('2022-07-01T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(oneQuarter(), new Date('2022-07-01T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-07-01T08:00:00.000Z'), to: new Date('2022-10-01T08:00:00.000Z'), @@ -93,7 +94,7 @@ describe('toDateRange', () => { }); it('computes the date range when starting a quarter ago', () => { - const timeWindow = aCalendarTimeWindow(QUARTERLY, new Date('2022-03-01T08:00:00.000Z')); + const timeWindow = aCalendarTimeWindow(oneQuarter(), new Date('2022-03-01T08:00:00.000Z')); expect(toDateRange(timeWindow, NOW)).toEqual({ from: new Date('2022-06-01T08:00:00.000Z'), to: new Date('2022-09-01T08:00:00.000Z'), @@ -104,28 +105,28 @@ describe('toDateRange', () => { describe('for rolling time window', () => { it("computes the date range using a '30days' rolling window", () => { - expect(toDateRange(aRollingTimeWindow(THIRTY_DAYS), NOW)).toEqual({ + expect(toDateRange(aRollingTimeWindow(thirtyDays()), NOW)).toEqual({ from: new Date('2022-07-12T08:31:00.000Z'), to: new Date('2022-08-11T08:31:00.000Z'), }); }); it("computes the date range using a 'weekly' rolling window", () => { - expect(toDateRange(aRollingTimeWindow(WEEKLY), NOW)).toEqual({ + expect(toDateRange(aRollingTimeWindow(oneWeek()), NOW)).toEqual({ from: new Date('2022-08-04T08:31:00.000Z'), to: new Date('2022-08-11T08:31:00.000Z'), }); }); it("computes the date range using a 'monthly' rolling window", () => { - expect(toDateRange(aRollingTimeWindow(MONTHLY), NOW)).toEqual({ + expect(toDateRange(aRollingTimeWindow(oneMonth()), NOW)).toEqual({ from: new Date('2022-07-11T08:31:00.000Z'), to: new Date('2022-08-11T08:31:00.000Z'), }); }); it("computes the date range using a 'quarterly' rolling window", () => { - expect(toDateRange(aRollingTimeWindow(QUARTERLY), NOW)).toEqual({ + expect(toDateRange(aRollingTimeWindow(oneQuarter()), NOW)).toEqual({ from: new Date('2022-05-11T08:31:00.000Z'), to: new Date('2022-08-11T08:31:00.000Z'), }); diff --git a/x-pack/plugins/observability/server/domain/services/date_range.ts b/x-pack/plugins/observability/server/domain/services/date_range.ts index 246ca4ac4ad18..49dd87d1e0669 100644 --- a/x-pack/plugins/observability/server/domain/services/date_range.ts +++ b/x-pack/plugins/observability/server/domain/services/date_range.ts @@ -23,7 +23,12 @@ export const toDateRange = (timeWindow: TimeWindow, currentDate: Date = new Date throw new Error('Cannot compute date range with future starting time'); } - const from = startTime.clone().add(differenceInUnit, unit); + const from = startTime + .clone() + .add( + Math.floor(differenceInUnit / timeWindow.duration.value) * timeWindow.duration.value, + unit + ); const to = from.clone().add(timeWindow.duration.value, unit); return { from: from.toDate(), to: to.toDate() }; diff --git a/x-pack/plugins/observability/server/lib/rules/slo_burn_rate/executor.ts b/x-pack/plugins/observability/server/lib/rules/slo_burn_rate/executor.ts index 96732747bdce7..679537a7f7260 100644 --- a/x-pack/plugins/observability/server/lib/rules/slo_burn_rate/executor.ts +++ b/x-pack/plugins/observability/server/lib/rules/slo_burn_rate/executor.ts @@ -58,7 +58,7 @@ export const getRuleExecutor = (): LifecycleRuleExecutor< } = services; const sloRepository = new KibanaSavedObjectsSLORepository(soClient); - const sliClient = new DefaultSLIClient(esClient.asCurrentUser); + const summaryClient = new DefaultSLIClient(esClient.asCurrentUser); const slo = await sloRepository.findById(params.sloId); const longWindowDuration = new Duration( @@ -70,7 +70,7 @@ export const getRuleExecutor = (): LifecycleRuleExecutor< toDurationUnit(params.shortWindow.unit) ); - const sliData = await sliClient.fetchSLIDataFrom(slo, [ + const sliData = await summaryClient.fetchSLIDataFrom(slo, [ { name: LONG_WINDOW, duration: longWindowDuration.add(slo.settings.syncDelay) }, { name: SHORT_WINDOW, duration: shortWindowDuration.add(slo.settings.syncDelay) }, ]); diff --git a/x-pack/plugins/observability/server/routes/slo/route.ts b/x-pack/plugins/observability/server/routes/slo/route.ts index 50716135e653d..90fa8b82fbca2 100644 --- a/x-pack/plugins/observability/server/routes/slo/route.ts +++ b/x-pack/plugins/observability/server/routes/slo/route.ts @@ -17,7 +17,7 @@ import { import { CreateSLO, DefaultResourceInstaller, - DefaultSLIClient, + DefaultSummaryClient, DefaultTransformManager, DeleteSLO, FindSLO, @@ -133,8 +133,8 @@ const getSLORoute = createObservabilityServerRoute({ const soClient = (await context.core).savedObjects.client; const esClient = (await context.core).elasticsearch.client.asCurrentUser; const repository = new KibanaSavedObjectsSLORepository(soClient); - const sliClient = new DefaultSLIClient(esClient); - const getSLO = new GetSLO(repository, sliClient); + const summaryClient = new DefaultSummaryClient(esClient); + const getSLO = new GetSLO(repository, summaryClient); const response = await getSLO.execute(params.path.id); @@ -156,8 +156,8 @@ const findSLORoute = createObservabilityServerRoute({ const soClient = (await context.core).savedObjects.client; const esClient = (await context.core).elasticsearch.client.asCurrentUser; const repository = new KibanaSavedObjectsSLORepository(soClient); - const sliClient = new DefaultSLIClient(esClient); - const findSLO = new FindSLO(repository, sliClient); + const summaryClient = new DefaultSummaryClient(esClient); + const findSLO = new FindSLO(repository, summaryClient); const response = await findSLO.execute(params?.query ?? {}); diff --git a/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_client.test.ts.snap b/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_client.test.ts.snap new file mode 100644 index 0000000000000..e7b4a068d7ae0 --- /dev/null +++ b/x-pack/plugins/observability/server/services/slo/__snapshots__/summary_client.test.ts.snap @@ -0,0 +1,40 @@ +// Jest Snapshot v1, https://goo.gl/fbAQLP + +exports[`SummaryClient fetchSummary with calendar aligned and timeslices SLO returns the summary 1`] = ` +Object { + "errorBudget": Object { + "consumed": 0.198413, + "initial": 0.05, + "isEstimated": false, + "remaining": 0.801587, + }, + "sliValue": 0.9, + "status": "DEGRADING", +} +`; + +exports[`SummaryClient fetchSummary with rolling and occurrences SLO returns the summary 1`] = ` +Object { + "errorBudget": Object { + "consumed": 100, + "initial": 0.001, + "isEstimated": false, + "remaining": 0, + }, + "sliValue": 0.9, + "status": "VIOLATED", +} +`; + +exports[`SummaryClient fetchSummary with rolling and timeslices SLO returns the summary 1`] = ` +Object { + "errorBudget": Object { + "consumed": 2, + "initial": 0.05, + "isEstimated": false, + "remaining": 0, + }, + "sliValue": 0.9, + "status": "VIOLATED", +} +`; diff --git a/x-pack/plugins/observability/server/services/slo/find_slo.test.ts b/x-pack/plugins/observability/server/services/slo/find_slo.test.ts index e4982c36a073b..13477c3fbf3f6 100644 --- a/x-pack/plugins/observability/server/services/slo/find_slo.test.ts +++ b/x-pack/plugins/observability/server/services/slo/find_slo.test.ts @@ -5,30 +5,29 @@ * 2.0. */ -import { IndicatorData, SLO, SLOId } from '../../domain/models'; -import { toDateRange } from '../../domain/services'; +import { SLO, SLOId, Summary } from '../../domain/models'; import { FindSLO } from './find_slo'; import { createSLO, createPaginatedSLO } from './fixtures/slo'; -import { createSLIClientMock, createSLORepositoryMock } from './mocks'; -import { SLIClient } from './sli_client'; +import { createSummaryClientMock, createSLORepositoryMock } from './mocks'; import { SLORepository, SortField, SortDirection } from './slo_repository'; +import { SummaryClient } from './summary_client'; describe('FindSLO', () => { let mockRepository: jest.Mocked; - let mockSLIClient: jest.Mocked; + let mockSummaryClient: jest.Mocked; let findSLO: FindSLO; beforeEach(() => { mockRepository = createSLORepositoryMock(); - mockSLIClient = createSLIClientMock(); - findSLO = new FindSLO(mockRepository, mockSLIClient); + mockSummaryClient = createSummaryClientMock(); + findSLO = new FindSLO(mockRepository, mockSummaryClient); }); describe('happy path', () => { it('returns the results with pagination', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); const result = await findSLO.execute({}); @@ -91,7 +90,7 @@ describe('FindSLO', () => { it('calls the repository with the default criteria and pagination', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({}); @@ -105,7 +104,7 @@ describe('FindSLO', () => { it('calls the repository with the name filter criteria', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ name: 'Availability' }); @@ -119,7 +118,7 @@ describe('FindSLO', () => { it('calls the repository with the indicatorType filter criteria', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ indicatorTypes: ['sli.kql.custom'] }); @@ -133,7 +132,7 @@ describe('FindSLO', () => { it('calls the repository with the pagination', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ name: 'My SLO*', page: '2', perPage: '100' }); @@ -147,7 +146,7 @@ describe('FindSLO', () => { it('uses default pagination values when invalid', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ page: '-1', perPage: '0' }); @@ -161,7 +160,7 @@ describe('FindSLO', () => { it('sorts by name by default when not specified', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ sortBy: undefined }); @@ -175,7 +174,7 @@ describe('FindSLO', () => { it('sorts by indicator type', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ sortBy: 'indicatorType' }); @@ -189,7 +188,7 @@ describe('FindSLO', () => { it('sorts by indicator type in descending order', async () => { const slo = createSLO(); mockRepository.find.mockResolvedValueOnce(createPaginatedSLO(slo)); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce(someIndicatorData(slo)); + mockSummaryClient.fetchSummary.mockResolvedValueOnce(someSummary(slo)); await findSLO.execute({ sortBy: 'indicatorType', sortDirection: 'desc' }); @@ -202,12 +201,17 @@ describe('FindSLO', () => { }); }); -function someIndicatorData(slo: SLO): Record { +function someSummary(slo: SLO): Record { return { [slo.id]: { - good: 9999, - total: 10000, - dateRange: toDateRange(slo.timeWindow), + status: 'HEALTHY', + sliValue: 0.9999, + errorBudget: { + initial: 0.001, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, }, }; } diff --git a/x-pack/plugins/observability/server/services/slo/find_slo.ts b/x-pack/plugins/observability/server/services/slo/find_slo.ts index 06134a2b692d5..dd56977d0cf84 100644 --- a/x-pack/plugins/observability/server/services/slo/find_slo.ts +++ b/x-pack/plugins/observability/server/services/slo/find_slo.ts @@ -6,9 +6,7 @@ */ import { FindSLOParams, FindSLOResponse, findSLOResponseSchema } from '@kbn/slo-schema'; -import { IndicatorData, SLO, SLOId, SLOWithSummary } from '../../domain/models'; -import { computeErrorBudget, computeSLI, computeSummaryStatus } from '../../domain/services'; -import { SLIClient } from './sli_client'; +import { SLO, SLOId, SLOWithSummary, Summary } from '../../domain/models'; import { Criteria, Paginated, @@ -18,12 +16,13 @@ import { SortField, SortDirection, } from './slo_repository'; +import { SummaryClient } from './summary_client'; const DEFAULT_PAGE = 1; const DEFAULT_PER_PAGE = 25; export class FindSLO { - constructor(private repository: SLORepository, private sliClient: SLIClient) {} + constructor(private repository: SLORepository, private summaryClient: SummaryClient) {} public async execute(params: FindSLOParams): Promise { const pagination: Pagination = toPagination(params); @@ -35,40 +34,27 @@ export class FindSLO { sort, pagination ); - const indicatorDataBySlo = await this.sliClient.fetchCurrentSLIData(sloList); - const sloListWithSummary = computeSloWithSummary(sloList, indicatorDataBySlo); + const summaryBySlo = await this.summaryClient.fetchSummary(sloList); - return this.toResponse(sloListWithSummary, resultMeta); - } + const sloListWithSummary = mergeSloWithSummary(sloList, summaryBySlo); - private toResponse( - sloList: SLOWithSummary[], - resultMeta: Omit, 'results'> - ): FindSLOResponse { return findSLOResponseSchema.encode({ page: resultMeta.page, perPage: resultMeta.perPage, total: resultMeta.total, - results: sloList, + results: sloListWithSummary, }); } } -function computeSloWithSummary( +function mergeSloWithSummary( sloList: SLO[], - indicatorDataBySlo: Record + summaryBySlo: Record ): SLOWithSummary[] { - const sloListWithSummary: SLOWithSummary[] = []; - for (const slo of sloList) { - const sliValue = computeSLI(indicatorDataBySlo[slo.id]); - const errorBudget = computeErrorBudget(slo, indicatorDataBySlo[slo.id]); - const status = computeSummaryStatus(slo, sliValue, errorBudget); - sloListWithSummary.push({ - ...slo, - summary: { status, sliValue, errorBudget }, - }); - } - return sloListWithSummary; + return sloList.map((slo) => ({ + ...slo, + summary: summaryBySlo[slo.id], + })); } function toPagination(params: FindSLOParams): Pagination { diff --git a/x-pack/plugins/observability/server/services/slo/fixtures/duration.ts b/x-pack/plugins/observability/server/services/slo/fixtures/duration.ts index facc03bcad9df..a07eab2642e91 100644 --- a/x-pack/plugins/observability/server/services/slo/fixtures/duration.ts +++ b/x-pack/plugins/observability/server/services/slo/fixtures/duration.ts @@ -7,6 +7,10 @@ import { Duration, DurationUnit } from '../../../domain/models'; +export function oneQuarter(): Duration { + return new Duration(1, DurationUnit.Quarter); +} + export function thirtyDays(): Duration { return new Duration(30, DurationUnit.Day); } @@ -23,6 +27,10 @@ export function oneWeek(): Duration { return new Duration(1, DurationUnit.Week); } +export function twoWeeks(): Duration { + return new Duration(2, DurationUnit.Week); +} + export function sixHours(): Duration { return new Duration(6, DurationUnit.Hour); } diff --git a/x-pack/plugins/observability/server/services/slo/get_slo.test.ts b/x-pack/plugins/observability/server/services/slo/get_slo.test.ts index b0752400c2cd7..33416d42a776c 100644 --- a/x-pack/plugins/observability/server/services/slo/get_slo.test.ts +++ b/x-pack/plugins/observability/server/services/slo/get_slo.test.ts @@ -5,33 +5,37 @@ * 2.0. */ -import { toDateRange } from '../../domain/services'; import { createAPMTransactionErrorRateIndicator, createSLO } from './fixtures/slo'; import { GetSLO } from './get_slo'; -import { createSLIClientMock, createSLORepositoryMock } from './mocks'; -import { SLIClient } from './sli_client'; +import { createSummaryClientMock, createSLORepositoryMock } from './mocks'; import { SLORepository } from './slo_repository'; +import { SummaryClient } from './summary_client'; describe('GetSLO', () => { let mockRepository: jest.Mocked; - let mockSLIClient: jest.Mocked; + let mockSummaryClient: jest.Mocked; let getSLO: GetSLO; beforeEach(() => { mockRepository = createSLORepositoryMock(); - mockSLIClient = createSLIClientMock(); - getSLO = new GetSLO(mockRepository, mockSLIClient); + mockSummaryClient = createSummaryClientMock(); + getSLO = new GetSLO(mockRepository, mockSummaryClient); }); describe('happy path', () => { it('retrieves the SLO from the repository', async () => { const slo = createSLO({ indicator: createAPMTransactionErrorRateIndicator() }); mockRepository.findById.mockResolvedValueOnce(slo); - mockSLIClient.fetchCurrentSLIData.mockResolvedValueOnce({ + mockSummaryClient.fetchSummary.mockResolvedValueOnce({ [slo.id]: { - good: 9999, - total: 10000, - dateRange: toDateRange(slo.timeWindow), + status: 'HEALTHY', + sliValue: 0.9999, + errorBudget: { + initial: 0.001, + consumed: 0.1, + remaining: 0.9, + isEstimated: false, + }, }, }); diff --git a/x-pack/plugins/observability/server/services/slo/get_slo.ts b/x-pack/plugins/observability/server/services/slo/get_slo.ts index de49ba4aaca13..96716a15c0a8f 100644 --- a/x-pack/plugins/observability/server/services/slo/get_slo.ts +++ b/x-pack/plugins/observability/server/services/slo/get_slo.ts @@ -6,34 +6,23 @@ */ import { GetSLOResponse, getSLOResponseSchema } from '@kbn/slo-schema'; -import { IndicatorData, SLO, SLOId, SLOWithSummary } from '../../domain/models'; +import { SLO, SLOId, SLOWithSummary, Summary } from '../../domain/models'; import { SLORepository } from './slo_repository'; -import { SLIClient } from './sli_client'; -import { computeSLI, computeErrorBudget, computeSummaryStatus } from '../../domain/services'; +import { SummaryClient } from './summary_client'; export class GetSLO { - constructor(private repository: SLORepository, private sliClient: SLIClient) {} + constructor(private repository: SLORepository, private summaryClient: SummaryClient) {} public async execute(sloId: string): Promise { const slo = await this.repository.findById(sloId); + const summaryBySlo = await this.summaryClient.fetchSummary([slo]); - const indicatorDataBySlo = await this.sliClient.fetchCurrentSLIData([slo]); - const sloWithSummary = computeSloWithSummary(slo, indicatorDataBySlo); + const sloWithSummary = mergeSloWithSummary(slo, summaryBySlo); - return this.toResponse(sloWithSummary); - } - - private toResponse(slo: SLOWithSummary): GetSLOResponse { - return getSLOResponseSchema.encode(slo); + return getSLOResponseSchema.encode(sloWithSummary); } } -function computeSloWithSummary( - slo: SLO, - indicatorDataBySlo: Record -): SLOWithSummary { - const sliValue = computeSLI(indicatorDataBySlo[slo.id]); - const errorBudget = computeErrorBudget(slo, indicatorDataBySlo[slo.id]); - const status = computeSummaryStatus(slo, sliValue, errorBudget); - return { ...slo, summary: { status, sliValue, errorBudget } }; +function mergeSloWithSummary(slo: SLO, summaryBySlo: Record): SLOWithSummary { + return { ...slo, summary: summaryBySlo[slo.id] }; } diff --git a/x-pack/plugins/observability/server/services/slo/index.ts b/x-pack/plugins/observability/server/services/slo/index.ts index a4d186db813f9..9d7097d92fc03 100644 --- a/x-pack/plugins/observability/server/services/slo/index.ts +++ b/x-pack/plugins/observability/server/services/slo/index.ts @@ -16,3 +16,4 @@ export * from './sli_client'; export * from './slo_repository'; export * from './transform_manager'; export * from './update_slo'; +export * from './summary_client'; diff --git a/x-pack/plugins/observability/server/services/slo/mocks/index.ts b/x-pack/plugins/observability/server/services/slo/mocks/index.ts index 5781553f91e05..bb8b66542b1db 100644 --- a/x-pack/plugins/observability/server/services/slo/mocks/index.ts +++ b/x-pack/plugins/observability/server/services/slo/mocks/index.ts @@ -8,6 +8,7 @@ import { ResourceInstaller } from '../resource_installer'; import { SLIClient } from '../sli_client'; import { SLORepository } from '../slo_repository'; +import { SummaryClient } from '../summary_client'; import { TransformManager } from '../transform_manager'; const createResourceInstallerMock = (): jest.Mocked => { @@ -35,9 +36,14 @@ const createSLORepositoryMock = (): jest.Mocked => { }; }; +const createSummaryClientMock = (): jest.Mocked => { + return { + fetchSummary: jest.fn(), + }; +}; + const createSLIClientMock = (): jest.Mocked => { return { - fetchCurrentSLIData: jest.fn(), fetchSLIDataFrom: jest.fn(), }; }; @@ -46,5 +52,6 @@ export { createResourceInstallerMock, createTransformManagerMock, createSLORepositoryMock, + createSummaryClientMock, createSLIClientMock, }; diff --git a/x-pack/plugins/observability/server/services/slo/sli_client.test.ts b/x-pack/plugins/observability/server/services/slo/sli_client.test.ts index d942cea0335d0..a00d0627461c1 100644 --- a/x-pack/plugins/observability/server/services/slo/sli_client.test.ts +++ b/x-pack/plugins/observability/server/services/slo/sli_client.test.ts @@ -8,12 +8,9 @@ import { ElasticsearchClientMock, elasticsearchServiceMock } from '@kbn/core/server/mocks'; import moment from 'moment'; -import { SLO_DESTINATION_INDEX_NAME } from '../../assets/constants'; -import { toDateRange } from '../../domain/services'; import { Duration, DurationUnit } from '../../domain/models'; import { createSLO } from './fixtures/slo'; import { DefaultSLIClient } from './sli_client'; -import { sevenDaysRolling, weeklyCalendarAligned } from './fixtures/time_window'; const commonEsResponse = { took: 100, @@ -29,231 +26,13 @@ const commonEsResponse = { }, }; -const getMsearchResponse = (good: number = 90, total: number = 100) => ({ - ...commonEsResponse, - responses: [ - { - ...commonEsResponse, - aggregations: { - good: { value: good }, - total: { value: total }, - }, - }, - ], -}); - -describe('SLIClient', () => { +describe('SummaryClient', () => { let esClientMock: ElasticsearchClientMock; beforeEach(() => { esClientMock = elasticsearchServiceMock.createElasticsearchClient(); }); - describe('fetchCurrentSLIData', () => { - describe('with occurrences budgeting method', () => { - describe('with a rolling time window', () => { - it('returns the aggregated good and total values', async () => { - const slo = createSLO({ timeWindow: sevenDaysRolling() }); - esClientMock.msearch.mockResolvedValueOnce(getMsearchResponse()); - const sliClient = new DefaultSLIClient(esClientMock); - - const result = await sliClient.fetchCurrentSLIData([slo]); - - const expectedDateRange = toDateRange(slo.timeWindow); - expect(result[slo.id]).toMatchObject({ - good: 90, - total: 100, - }); - expect(result[slo.id].dateRange.from).toBeClose(expectedDateRange.from); - expect(result[slo.id].dateRange.to).toBeClose(expectedDateRange.to); - // @ts-ignore searches not typed properly - expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ - { index: `${SLO_DESTINATION_INDEX_NAME}*` }, - { - size: 0, - query: { - bool: { - filter: [ - { term: { 'slo.id': slo.id } }, - { term: { 'slo.revision': slo.revision } }, - { - range: { - '@timestamp': { gte: expect.anything(), lt: expect.anything() }, - }, - }, - ], - }, - }, - aggs: { - good: { sum: { field: 'slo.numerator' } }, - total: { sum: { field: 'slo.denominator' } }, - }, - }, - ]); - }); - }); - - describe('with a calendar aligned time window', () => { - it('returns the aggregated good and total values', async () => { - const slo = createSLO({ - timeWindow: weeklyCalendarAligned(new Date('2022-09-01T00:00:00.000Z')), - }); - esClientMock.msearch.mockResolvedValueOnce(getMsearchResponse()); - const sliClient = new DefaultSLIClient(esClientMock); - - const result = await sliClient.fetchCurrentSLIData([slo]); - - const expectedDateRange = toDateRange(slo.timeWindow); - expect(result[slo.id]).toMatchObject({ good: 90, total: 100 }); - expect(result[slo.id].dateRange.from).toBeClose(expectedDateRange.from); - expect(result[slo.id].dateRange.to).toBeClose(expectedDateRange.to); - // @ts-ignore searches not typed properly - expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ - { index: `${SLO_DESTINATION_INDEX_NAME}*` }, - { - size: 0, - query: { - bool: { - filter: [ - { term: { 'slo.id': slo.id } }, - { term: { 'slo.revision': slo.revision } }, - { - range: { - '@timestamp': { - gte: expectedDateRange.from.toISOString(), - lt: expectedDateRange.to.toISOString(), - }, - }, - }, - ], - }, - }, - aggs: { - good: { sum: { field: 'slo.numerator' } }, - total: { sum: { field: 'slo.denominator' } }, - }, - }, - ]); - }); - }); - }); - - describe('with timeslices budgeting method', () => { - describe('with a calendar aligned time window', () => { - it('returns the aggregated good and total values', async () => { - const slo = createSLO({ - budgetingMethod: 'timeslices', - objective: { - target: 0.95, - timesliceTarget: 0.9, - timesliceWindow: new Duration(10, DurationUnit.Minute), - }, - timeWindow: weeklyCalendarAligned(new Date('2022-09-01T00:00:00.000Z')), - }); - esClientMock.msearch.mockResolvedValueOnce(getMsearchResponse()); - const sliClient = new DefaultSLIClient(esClientMock); - - const result = await sliClient.fetchCurrentSLIData([slo]); - - const expectedDateRange = toDateRange(slo.timeWindow); - expect(result[slo.id]).toMatchObject({ good: 90, total: 100 }); - expect(result[slo.id].dateRange.from).toBeClose(expectedDateRange.from); - expect(result[slo.id].dateRange.to).toBeClose(expectedDateRange.to); - // @ts-ignore searches not typed properly - expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ - { index: `${SLO_DESTINATION_INDEX_NAME}*` }, - { - size: 0, - query: { - bool: { - filter: [ - { term: { 'slo.id': slo.id } }, - { term: { 'slo.revision': slo.revision } }, - { - range: { - '@timestamp': { - gte: expectedDateRange.from.toISOString(), - lt: expectedDateRange.to.toISOString(), - }, - }, - }, - ], - }, - }, - aggs: { - good: { - sum: { - field: 'slo.isGoodSlice', - }, - }, - total: { - value_count: { - field: 'slo.isGoodSlice', - }, - }, - }, - }, - ]); - }); - }); - - describe('with a rolling time window', () => { - it('returns the aggregated good and total values', async () => { - const slo = createSLO({ - budgetingMethod: 'timeslices', - objective: { - target: 0.95, - timesliceTarget: 0.9, - timesliceWindow: new Duration(10, DurationUnit.Minute), - }, - timeWindow: sevenDaysRolling(), - }); - esClientMock.msearch.mockResolvedValueOnce(getMsearchResponse()); - const sliClient = new DefaultSLIClient(esClientMock); - - const result = await sliClient.fetchCurrentSLIData([slo]); - - const expectedDateRange = toDateRange(slo.timeWindow); - expect(result[slo.id]).toMatchObject({ good: 90, total: 100 }); - expect(result[slo.id].dateRange.from).toBeClose(expectedDateRange.from); - expect(result[slo.id].dateRange.to).toBeClose(expectedDateRange.to); - // @ts-ignore searches not typed properly - expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ - { index: `${SLO_DESTINATION_INDEX_NAME}*` }, - { - size: 0, - query: { - bool: { - filter: [ - { term: { 'slo.id': slo.id } }, - { term: { 'slo.revision': slo.revision } }, - { - range: { - '@timestamp': { gte: expect.anything(), lt: expect.anything() }, - }, - }, - ], - }, - }, - aggs: { - good: { - sum: { - field: 'slo.isGoodSlice', - }, - }, - total: { - value_count: { - field: 'slo.isGoodSlice', - }, - }, - }, - }, - ]); - }); - }); - }); - }); - describe('fetchSLIDataFrom', () => { const LONG_WINDOW = 'long_window'; const SHORT_WINDOW = 'short_window'; @@ -306,9 +85,9 @@ describe('SLIClient', () => { }, }, }); - const sliClient = new DefaultSLIClient(esClientMock); + const summaryClient = new DefaultSLIClient(esClientMock); - const result = await sliClient.fetchSLIDataFrom(slo, lookbackWindows); + const result = await summaryClient.fetchSLIDataFrom(slo, lookbackWindows); expect(esClientMock?.search?.mock?.lastCall?.[0]).toMatchObject({ aggs: { @@ -396,9 +175,9 @@ describe('SLIClient', () => { }, }, }); - const sliClient = new DefaultSLIClient(esClientMock); + const summaryClient = new DefaultSLIClient(esClientMock); - const result = await sliClient.fetchSLIDataFrom(slo, lookbackWindows); + const result = await summaryClient.fetchSLIDataFrom(slo, lookbackWindows); expect(esClientMock?.search?.mock?.lastCall?.[0]).toMatchObject({ aggs: { diff --git a/x-pack/plugins/observability/server/services/slo/sli_client.ts b/x-pack/plugins/observability/server/services/slo/sli_client.ts index 6386b101e8207..fe0959b57224a 100644 --- a/x-pack/plugins/observability/server/services/slo/sli_client.ts +++ b/x-pack/plugins/observability/server/services/slo/sli_client.ts @@ -9,18 +9,19 @@ import { AggregationsAggregationContainer, AggregationsDateRangeAggregate, AggregationsSumAggregate, + AggregationsValueCountAggregate, MsearchMultisearchBody, } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { ElasticsearchClient } from '@kbn/core/server'; import { assertNever } from '@kbn/std'; import { occurrencesBudgetingMethodSchema, timeslicesBudgetingMethodSchema } from '@kbn/slo-schema'; + import { SLO_DESTINATION_INDEX_NAME } from '../../assets/constants'; import { toDateRange } from '../../domain/services/date_range'; import { InternalQueryError } from '../../errors'; -import { DateRange, Duration, IndicatorData, SLO, SLOId } from '../../domain/models'; +import { DateRange, Duration, IndicatorData, SLO } from '../../domain/models'; export interface SLIClient { - fetchCurrentSLIData(sloList: SLO[]): Promise>; fetchSLIDataFrom( slo: SLO, lookbackWindows: LookbackWindow[] @@ -39,41 +40,6 @@ type EsAggregations = Record; export class DefaultSLIClient implements SLIClient { constructor(private esClient: ElasticsearchClient) {} - async fetchCurrentSLIData(sloList: SLO[]): Promise> { - const dateRangeBySlo: Record = sloList.reduce( - (acc, slo) => ({ [slo.id]: toDateRange(slo.timeWindow), ...acc }), - {} - ); - const searches = sloList.flatMap((slo) => [ - { index: `${SLO_DESTINATION_INDEX_NAME}*` }, - generateSearchQuery(slo, dateRangeBySlo[slo.id]), - ]); - - const indicatorDataBySlo: Record = {}; - if (searches.length === 0) { - return indicatorDataBySlo; - } - - const result = await this.esClient.msearch({ searches }); - - for (let i = 0; i < result.responses.length; i++) { - const slo = sloList[i]; - if ('error' in result.responses[i]) { - // handle errorneous responses with default zero values, and keep going - indicatorDataBySlo[slo.id] = { dateRange: dateRangeBySlo[slo.id], good: 0, total: 0 }; - continue; - } - - // @ts-ignore - const { aggregations } = result.responses[i]; - const good = aggregations?.good?.value || 0; - const total = aggregations?.total?.value || 0; - indicatorDataBySlo[slo.id] = { dateRange: dateRangeBySlo[slo.id], good, total }; - } - - return indicatorDataBySlo; - } - async fetchSLIDataFrom( slo: SLO, lookbackWindows: LookbackWindow[] @@ -111,38 +77,6 @@ export class DefaultSLIClient implements SLIClient { } } -function generateSearchQuery(slo: SLO, dateRange: DateRange): MsearchMultisearchBody { - if (occurrencesBudgetingMethodSchema.is(slo.budgetingMethod)) { - return { - ...commonQuery(slo, dateRange), - aggs: { - good: { sum: { field: 'slo.numerator' } }, - total: { sum: { field: 'slo.denominator' } }, - }, - }; - } - - if (timeslicesBudgetingMethodSchema.is(slo.budgetingMethod)) { - return { - ...commonQuery(slo, dateRange), - aggs: { - good: { - sum: { - field: 'slo.isGoodSlice', - }, - }, - total: { - value_count: { - field: 'slo.isGoodSlice', - }, - }, - }, - }; - } - - assertNever(slo.budgetingMethod); -} - function commonQuery( slo: SLO, dateRange: DateRange @@ -232,7 +166,7 @@ function handleWindowedResult( } const bucket = windowAggBuckets[0]; const good = (bucket.good as AggregationsSumAggregate).value; - const total = (bucket.total as AggregationsSumAggregate).value; + const total = (bucket.total as AggregationsValueCountAggregate).value; if (good === null || total === null) { throw new InternalQueryError('Invalid aggregation sum bucket response'); } diff --git a/x-pack/plugins/observability/server/services/slo/summary_client.test.ts b/x-pack/plugins/observability/server/services/slo/summary_client.test.ts new file mode 100644 index 0000000000000..f6dcaca04b5d3 --- /dev/null +++ b/x-pack/plugins/observability/server/services/slo/summary_client.test.ts @@ -0,0 +1,256 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { ElasticsearchClientMock, elasticsearchServiceMock } from '@kbn/core/server/mocks'; +import moment from 'moment'; + +import { SLO_DESTINATION_INDEX_NAME } from '../../assets/constants'; +import { Duration, DurationUnit } from '../../domain/models'; +import { createSLO } from './fixtures/slo'; +import { DefaultSummaryClient } from './summary_client'; +import { sevenDaysRolling, weeklyCalendarAligned } from './fixtures/time_window'; + +const commonEsResponse = { + took: 100, + timed_out: false, + _shards: { + total: 0, + successful: 0, + skipped: 0, + failed: 0, + }, + hits: { + hits: [], + }, +}; + +const createEsResponse = (good: number = 90, total: number = 100) => ({ + ...commonEsResponse, + responses: [ + { + ...commonEsResponse, + aggregations: { + good: { value: good }, + total: { value: total }, + }, + }, + ], +}); + +describe('SummaryClient', () => { + let esClientMock: ElasticsearchClientMock; + + beforeEach(() => { + esClientMock = elasticsearchServiceMock.createElasticsearchClient(); + }); + + describe('fetchSummary', () => { + describe('with rolling and occurrences SLO', () => { + it('returns the summary', async () => { + const slo = createSLO({ timeWindow: sevenDaysRolling() }); + esClientMock.msearch.mockResolvedValueOnce(createEsResponse()); + const summaryClient = new DefaultSummaryClient(esClientMock); + + const result = await summaryClient.fetchSummary([slo]); + + expect(result[slo.id]).toMatchSnapshot(); + // @ts-ignore + expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ + { index: `${SLO_DESTINATION_INDEX_NAME}*` }, + { + size: 0, + query: { + bool: { + filter: [ + { term: { 'slo.id': slo.id } }, + { term: { 'slo.revision': slo.revision } }, + { + range: { + '@timestamp': { gte: expect.anything(), lt: expect.anything() }, + }, + }, + ], + }, + }, + aggs: { + good: { sum: { field: 'slo.numerator' } }, + total: { sum: { field: 'slo.denominator' } }, + }, + }, + ]); + }); + }); + + describe('with calendar aligned and occurrences SLO', () => { + it('returns the summary', async () => { + const slo = createSLO({ + timeWindow: weeklyCalendarAligned(new Date('2022-09-01T00:00:00.000Z')), + }); + esClientMock.msearch.mockResolvedValueOnce(createEsResponse()); + const summaryClient = new DefaultSummaryClient(esClientMock); + + await summaryClient.fetchSummary([slo]); + + // @ts-ignore + expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ + { index: `${SLO_DESTINATION_INDEX_NAME}*` }, + { + size: 0, + query: { + bool: { + filter: [ + { term: { 'slo.id': slo.id } }, + { term: { 'slo.revision': slo.revision } }, + { + range: { + '@timestamp': { + gte: expect.anything(), + lt: expect.anything(), + }, + }, + }, + ], + }, + }, + aggs: { + good: { sum: { field: 'slo.numerator' } }, + total: { sum: { field: 'slo.denominator' } }, + }, + }, + ]); + }); + }); + + describe('with rolling and timeslices SLO', () => { + it('returns the summary', async () => { + const slo = createSLO({ + budgetingMethod: 'timeslices', + objective: { + target: 0.95, + timesliceTarget: 0.9, + timesliceWindow: new Duration(10, DurationUnit.Minute), + }, + timeWindow: sevenDaysRolling(), + }); + esClientMock.msearch.mockResolvedValueOnce(createEsResponse()); + const summaryClient = new DefaultSummaryClient(esClientMock); + + const result = await summaryClient.fetchSummary([slo]); + + expect(result[slo.id]).toMatchSnapshot(); + // @ts-ignore searches not typed properly + expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ + { index: `${SLO_DESTINATION_INDEX_NAME}*` }, + { + size: 0, + query: { + bool: { + filter: [ + { term: { 'slo.id': slo.id } }, + { term: { 'slo.revision': slo.revision } }, + { + range: { + '@timestamp': { gte: expect.anything(), lt: expect.anything() }, + }, + }, + ], + }, + }, + aggs: { + good: { + sum: { + field: 'slo.isGoodSlice', + }, + }, + total: { + value_count: { + field: 'slo.isGoodSlice', + }, + }, + }, + }, + ]); + }); + }); + + describe('with calendar aligned and timeslices SLO', () => { + it('returns the summary', async () => { + const slo = createSLO({ + budgetingMethod: 'timeslices', + objective: { + target: 0.95, + timesliceTarget: 0.9, + timesliceWindow: new Duration(10, DurationUnit.Minute), + }, + timeWindow: weeklyCalendarAligned(new Date('2022-09-01T00:00:00.000Z')), + }); + esClientMock.msearch.mockResolvedValueOnce(createEsResponse()); + const summaryClient = new DefaultSummaryClient(esClientMock); + + const result = await summaryClient.fetchSummary([slo]); + + expect(result[slo.id]).toMatchSnapshot(); + // @ts-ignore searches not typed properly + expect(esClientMock.msearch.mock.calls[0][0].searches).toEqual([ + { index: `${SLO_DESTINATION_INDEX_NAME}*` }, + { + size: 0, + query: { + bool: { + filter: [ + { term: { 'slo.id': slo.id } }, + { term: { 'slo.revision': slo.revision } }, + { + range: { + '@timestamp': { + gte: expect.anything(), + lt: expect.anything(), + }, + }, + }, + ], + }, + }, + aggs: { + good: { + sum: { + field: 'slo.isGoodSlice', + }, + }, + total: { + value_count: { + field: 'slo.isGoodSlice', + }, + }, + }, + }, + ]); + }); + }); + }); +}); + +expect.extend({ + toBeClose(received: Date | string, actual: Date | string) { + const receivedDate = moment(received); + const actualDate = moment(actual); + return { + message: () => + `expected ${receivedDate.toISOString()} to be close to ${actualDate.toISOString()}`, + pass: Math.abs(receivedDate.diff(actualDate, 'seconds')) <= 120, + }; + }, +}); + +declare global { + // eslint-disable-next-line @typescript-eslint/no-namespace + namespace jest { + interface Matchers { + toBeClose(actual: Date | string): R; + } + } +} diff --git a/x-pack/plugins/observability/server/services/slo/summary_client.ts b/x-pack/plugins/observability/server/services/slo/summary_client.ts new file mode 100644 index 0000000000000..e531f7dd2e967 --- /dev/null +++ b/x-pack/plugins/observability/server/services/slo/summary_client.ts @@ -0,0 +1,98 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { MsearchMultisearchBody } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; +import { ElasticsearchClient } from '@kbn/core/server'; +import { occurrencesBudgetingMethodSchema, timeslicesBudgetingMethodSchema } from '@kbn/slo-schema'; +import { SLO_DESTINATION_INDEX_NAME } from '../../assets/constants'; +import { toDateRange } from '../../domain/services/date_range'; +import { DateRange, SLO, SLOId, Summary } from '../../domain/models'; +import { computeErrorBudget, computeSLI, computeSummaryStatus } from '../../domain/services'; + +export interface SummaryClient { + fetchSummary(sloList: SLO[]): Promise>; +} + +export class DefaultSummaryClient implements SummaryClient { + constructor(private esClient: ElasticsearchClient) {} + + async fetchSummary(sloList: SLO[]): Promise> { + const dateRangeBySlo: Record = sloList.reduce( + (acc, slo) => ({ [slo.id]: toDateRange(slo.timeWindow), ...acc }), + {} + ); + const searches = sloList.flatMap((slo) => [ + { index: `${SLO_DESTINATION_INDEX_NAME}*` }, + generateSearchQuery(slo, dateRangeBySlo[slo.id]), + ]); + + const summaryBySlo: Record = {}; + if (searches.length === 0) { + return summaryBySlo; + } + + const result = await this.esClient.msearch({ searches }); + + for (let i = 0; i < result.responses.length; i++) { + const slo = sloList[i]; + + // @ts-ignore + const { aggregations = {} } = result.responses[i]; + const good = aggregations?.good?.value ?? 0; + const total = aggregations?.total?.value ?? 0; + + const sliValue = computeSLI({ good, total }); + const errorBudget = computeErrorBudget(slo, { + dateRange: dateRangeBySlo[slo.id], + good, + total, + }); + summaryBySlo[slo.id] = { + sliValue, + errorBudget, + status: computeSummaryStatus(slo, sliValue, errorBudget), + }; + } + + return summaryBySlo; + } +} + +function generateSearchQuery(slo: SLO, dateRange: DateRange): MsearchMultisearchBody { + return { + size: 0, + query: { + bool: { + filter: [ + { term: { 'slo.id': slo.id } }, + { term: { 'slo.revision': slo.revision } }, + { + range: { + '@timestamp': { gte: dateRange.from.toISOString(), lt: dateRange.to.toISOString() }, + }, + }, + ], + }, + }, + ...(occurrencesBudgetingMethodSchema.is(slo.budgetingMethod) && { + aggs: { + good: { sum: { field: 'slo.numerator' } }, + total: { sum: { field: 'slo.denominator' } }, + }, + }), + ...(timeslicesBudgetingMethodSchema.is(slo.budgetingMethod) && { + aggs: { + good: { + sum: { field: 'slo.isGoodSlice' }, + }, + total: { + value_count: { field: 'slo.isGoodSlice' }, + }, + }, + }), + }; +} diff --git a/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx b/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx index 901a827766bd2..b2ed5904ac011 100644 --- a/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx +++ b/x-pack/plugins/reporting/public/management/components/report_info_flyout_content.tsx @@ -140,6 +140,12 @@ export const ReportInfoFlyoutContent: FunctionComponent = ({ info }) => { description: info.metrics?.pdf?.pages, }, + { + title: i18n.translate('xpack.reporting.listing.infoPanel.jobId', { + defaultMessage: 'Report job ID', + }), + description: info.id, + }, { title: i18n.translate('xpack.reporting.listing.infoPanel.processedByInfo', { defaultMessage: 'Processed by', diff --git a/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx b/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx index eada57161e3a3..1116652ab05f9 100644 --- a/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx +++ b/x-pack/plugins/reporting/public/share_context_menu/register_csv_reporting.tsx @@ -72,7 +72,7 @@ export const reportingCsvShareProvider = ({ icon: 'document', toolTipContent: licenseToolTipContent, disabled: licenseDisabled, - ['data-test-subj']: 'csvReportMenuItem', + ['data-test-subj']: 'CSVReports', sortOrder: 1, }, panel: { diff --git a/x-pack/plugins/reporting/public/share_context_menu/register_pdf_png_reporting.tsx b/x-pack/plugins/reporting/public/share_context_menu/register_pdf_png_reporting.tsx index 8ea26a6964be6..167ff3311f50a 100644 --- a/x-pack/plugins/reporting/public/share_context_menu/register_pdf_png_reporting.tsx +++ b/x-pack/plugins/reporting/public/share_context_menu/register_pdf_png_reporting.tsx @@ -132,7 +132,7 @@ export const reportingScreenshotShareProvider = ({ icon: 'document', toolTipContent: licenseToolTipContent, disabled: licenseDisabled, - ['data-test-subj']: 'pngReportMenuItem', + ['data-test-subj']: 'PNGReports', sortOrder: 10, }, panel: { @@ -167,7 +167,7 @@ export const reportingScreenshotShareProvider = ({ icon: 'document', toolTipContent: licenseToolTipContent, disabled: licenseDisabled, - ['data-test-subj']: 'pdfReportMenuItem', + ['data-test-subj']: 'PDFReports', sortOrder: 10, }, panel: { diff --git a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts index abebdef58fe33..00e48e7c0edd3 100644 --- a/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts +++ b/x-pack/plugins/reporting/server/lib/tasks/execute_report.ts @@ -194,12 +194,12 @@ export class ExecuteReportTask implements ReportingTask { ...doc, }); - this.logger.debug( + this.logger.info( `Claiming ${claimedReport.jobtype} ${report._id} ` + - `[_index: ${report._index}] ` + - `[_seq_no: ${report._seq_no}] ` + - `[_primary_term: ${report._primary_term}] ` + - `[attempts: ${report.attempts}] ` + + `[_index: ${report._index}] ` + + `[_seq_no: ${report._seq_no}] ` + + `[_primary_term: ${report._primary_term}] ` + + `[attempts: ${report.attempts}] ` + `[process_expiration: ${expirationTime}]` ); diff --git a/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts b/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts index 9aa0bbd7343cb..ff0ec174b0846 100644 --- a/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts +++ b/x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts @@ -34,7 +34,7 @@ import { WriteOperations, AlertingAuthorizationEntity, } from '@kbn/alerting-plugin/server'; -import { Logger, ElasticsearchClient, EcsEventOutcome } from '@kbn/core/server'; +import { Logger, ElasticsearchClient, EcsEvent } from '@kbn/core/server'; import { AuditLogger } from '@kbn/security-plugin/server'; import { IndexPatternsFetcher } from '@kbn/data-plugin/server'; import { isEmpty } from 'lodash'; @@ -146,7 +146,7 @@ export class AlertsClient { private getOutcome( operation: WriteOperations.Update | ReadOperations.Find | ReadOperations.Get - ): { outcome: EcsEventOutcome } { + ): { outcome: EcsEvent['outcome'] } { return { outcome: operation === WriteOperations.Update ? 'unknown' : 'success', }; diff --git a/x-pack/plugins/rule_registry/server/alert_data_client/audit_events.ts b/x-pack/plugins/rule_registry/server/alert_data_client/audit_events.ts index 36a6a497203e7..8ea76b768ce2e 100644 --- a/x-pack/plugins/rule_registry/server/alert_data_client/audit_events.ts +++ b/x-pack/plugins/rule_registry/server/alert_data_client/audit_events.ts @@ -5,9 +5,10 @@ * 2.0. */ -import { EcsEventOutcome, EcsEventType } from '@kbn/core/server'; +import { EcsEvent } from '@kbn/core/server'; import { AuditEvent } from '@kbn/security-plugin/server'; import { ReadOperations, WriteOperations } from '@kbn/alerting-plugin/server'; +import { ArrayElement } from '@kbn/utility-types'; export enum AlertAuditAction { GET = 'alert_get', @@ -29,7 +30,7 @@ const eventVerbs: Record = { alert_find: ['access', 'accessing', 'accessed'], }; -const eventTypes: Record = { +const eventTypes: Record> = { alert_get: 'access', alert_update: 'change', alert_find: 'access', @@ -37,7 +38,7 @@ const eventTypes: Record = { export interface AlertAuditEventParams { action: AlertAuditAction; - outcome?: EcsEventOutcome; + outcome?: EcsEvent['outcome']; id?: string; error?: Error; } diff --git a/x-pack/plugins/security/server/audit/audit_events.ts b/x-pack/plugins/security/server/audit/audit_events.ts index 26cfec1a6c420..42cc7d4712af2 100644 --- a/x-pack/plugins/security/server/audit/audit_events.ts +++ b/x-pack/plugins/security/server/audit/audit_events.ts @@ -9,7 +9,8 @@ import type { AuditAction, AddAuditEventParams as SavedObjectEventParams, } from '@kbn/core-saved-objects-server'; -import type { EcsEventOutcome, EcsEventType, KibanaRequest, LogMeta } from '@kbn/core/server'; +import type { EcsEvent, KibanaRequest, LogMeta } from '@kbn/core/server'; +import type { ArrayElement } from '@kbn/utility-types'; import type { AuthenticationProvider } from '../../common/model'; import type { AuthenticationResult } from '../authentication/authentication_result'; @@ -355,7 +356,7 @@ const savedObjectAuditVerbs: Record = { ], }; -const savedObjectAuditTypes: Record = { +const savedObjectAuditTypes: Record> = { saved_object_create: 'creation', saved_object_get: 'access', saved_object_resolve: 'access', @@ -430,7 +431,7 @@ const spaceAuditVerbs: Record = { space_find: ['access', 'accessing', 'accessed'], }; -const spaceAuditTypes: Record = { +const spaceAuditTypes: Record> = { space_create: 'creation', space_get: 'access', space_update: 'change', @@ -440,7 +441,7 @@ const spaceAuditTypes: Record = { export interface SpacesAuditEventParams { action: SpaceAuditAction; - outcome?: EcsEventOutcome; + outcome?: EcsEvent['outcome']; savedObject?: NonNullable['saved_object']; error?: Error; } diff --git a/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.test.ts b/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.test.ts index 1aad389855c10..bd6eb1fa1456e 100644 --- a/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.test.ts +++ b/x-pack/plugins/security/server/saved_objects/saved_objects_security_extension.test.ts @@ -6,7 +6,7 @@ */ import { AuditAction } from '@kbn/core-saved-objects-server'; -import type { EcsEventOutcome, SavedObjectsClient } from '@kbn/core/server'; +import type { EcsEvent, SavedObjectsClient } from '@kbn/core/server'; import { auditLoggerMock } from '../audit/mocks'; import type { CheckSavedObjectsPrivileges } from '../authorization'; @@ -472,7 +472,7 @@ describe('#addAuditEvent', () => { test(`adds an unknown audit event`, async () => { const { auditLogger, securityExtension } = setup(); const action = AuditAction.UPDATE_OBJECTS_SPACES; - const outcome: EcsEventOutcome = 'unknown'; + const outcome: EcsEvent['outcome'] = 'unknown'; const savedObject = { type: 'dashboard', id: '3' }; const spaces = ['space-id']; @@ -505,7 +505,7 @@ describe('#addAuditEvent', () => { test(`adds a success audit event`, async () => { const { auditLogger, securityExtension } = setup(); const action = AuditAction.UPDATE_OBJECTS_SPACES; - const outcome: EcsEventOutcome = 'success'; + const outcome: EcsEvent['outcome'] = 'success'; const savedObject = { type: 'dashboard', id: '3' }; const spaces = ['space-id']; @@ -538,7 +538,7 @@ describe('#addAuditEvent', () => { test(`adds a failure audit event`, async () => { const { auditLogger, securityExtension } = setup(); const action = AuditAction.DELETE; - const outcome: EcsEventOutcome = 'failure'; + const outcome: EcsEvent['outcome'] = 'failure'; const savedObject = { type: 'dashboard', id: '3' }; const error: Error = { name: 'test_error', diff --git a/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.test.ts b/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.test.ts index c571c96e87e71..085ab11076a57 100644 --- a/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.test.ts +++ b/x-pack/plugins/security/server/spaces/secure_spaces_client_wrapper.test.ts @@ -9,7 +9,7 @@ import { savedObjectsExtensionsMock } from '@kbn/core-saved-objects-api-server-m import type { ISavedObjectsSecurityExtension } from '@kbn/core-saved-objects-server'; import { AuditAction } from '@kbn/core-saved-objects-server'; import { setMapsAreEqual, setsAreEqual } from '@kbn/core-saved-objects-utils-server'; -import type { EcsEventOutcome, SavedObjectsFindResponse } from '@kbn/core/server'; +import type { EcsEvent, SavedObjectsFindResponse } from '@kbn/core/server'; import { SavedObjectsErrorHelpers } from '@kbn/core/server'; import { httpServerMock } from '@kbn/core/server/mocks'; import type { GetAllSpacesPurpose, LegacyUrlAliasTarget, Space } from '@kbn/spaces-plugin/server'; @@ -140,7 +140,7 @@ const expectNoAuthorizationCheck = ( const expectAuditEvent = ( auditLogger: AuditLogger, action: string, - outcome: EcsEventOutcome, + outcome: EcsEvent['outcome'], savedObject?: Required['kibana']['saved_object'] ) => { expect(auditLogger.log).toHaveBeenCalledWith( diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts index d60ef8dd54d51..20f41f938502b 100644 --- a/x-pack/plugins/security_solution/cypress/objects/rule.ts +++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts @@ -387,8 +387,8 @@ export const getNewTermsRule = (): NewTermsRule => ({ export const getMachineLearningRule = (): MachineLearningRule => ({ machineLearningJobs: [ - 'v3_linux_anomalous_network_activity', - 'v3_linux_anomalous_process_all_hosts', + 'Unusual Linux Network Activity', + 'Anomalous Process for a Linux Population', ], anomalyScoreThreshold: 20, name: 'New ML Rule Test', diff --git a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts index 146f5d68d70e9..80b53926ed720 100644 --- a/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts +++ b/x-pack/plugins/security_solution/cypress/screens/create_new_rule.ts @@ -111,6 +111,8 @@ export const LOOK_BACK_TIME_TYPE = export const MACHINE_LEARNING_DROPDOWN_INPUT = '[data-test-subj="mlJobSelect"] [data-test-subj="comboBoxInput"]'; +export const MACHINE_LEARNING_DROPDOWN_OPTION = '[data-test-subj="comboBoxOptionsList "] button'; + export const MACHINE_LEARNING_TYPE = '[data-test-subj="machineLearningRuleType"]'; export const MITRE_TACTIC = '.euiContextMenuItem__text'; diff --git a/x-pack/plugins/security_solution/cypress/screens/rule_details.ts b/x-pack/plugins/security_solution/cypress/screens/rule_details.ts index 38f7ff2e34607..222ef1f684193 100644 --- a/x-pack/plugins/security_solution/cypress/screens/rule_details.ts +++ b/x-pack/plugins/security_solution/cypress/screens/rule_details.ts @@ -59,7 +59,7 @@ export const INVESTIGATION_NOTES_MARKDOWN = 'test markdown'; export const INVESTIGATION_NOTES_TOGGLE = '[data-test-subj="stepAboutDetailsToggle-notes"]'; -export const MACHINE_LEARNING_JOB_ID = '[data-test-subj="machineLearningJobId"]'; +export const MACHINE_LEARNING_JOB_ID = '[data-test-subj="machineLearningJob"]'; export const MACHINE_LEARNING_JOB_STATUS = '[data-test-subj="machineLearningJobStatus"]'; diff --git a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts index b0e4239de2dbd..07a104102625f 100644 --- a/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts +++ b/x-pack/plugins/security_solution/cypress/tasks/create_new_rule.ts @@ -617,11 +617,14 @@ export const fillDefineIndicatorMatchRuleAndContinue = (rule: ThreatIndicatorRul }; export const fillDefineMachineLearningRuleAndContinue = (rule: MachineLearningRule) => { - rule.machineLearningJobs.forEach((machineLearningJob) => { - cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).click({ force: true }); - cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type(`${machineLearningJob}{enter}`); - cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type('{esc}'); - }); + const text = rule.machineLearningJobs + .map((machineLearningJob) => `${machineLearningJob}{downArrow}{enter}`) + .join(''); + cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).click({ force: true }); + cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type(text); + + cy.get(MACHINE_LEARNING_DROPDOWN_INPUT).type('{esc}'); + cy.get(ANOMALY_THRESHOLD_INPUT).type( `{selectall}${getMachineLearningRule().anomalyScoreThreshold}`, { diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/ml_rule_warning_popover.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/ml_rule_warning_popover.tsx index 85768f2bbc5ed..539cd7f1f6e74 100644 --- a/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/ml_rule_warning_popover.tsx +++ b/x-pack/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/ml_rule_warning_popover.tsx @@ -76,7 +76,7 @@ const MlRuleWarningPopoverComponent: React.FC {notRunningJobs.map((job) => ( - {job.id} + {job.customSettings?.security_app_display_name ?? job.id} ))} { + const originalModule = jest.requireActual('../../../../common/lib/kibana'); + return { + ...originalModule, + useKibana: jest.fn().mockReturnValue({ + services: { theme: { theme$: {} }, http: { basePath: { get: jest.fn(() => {}) } } }, + }), + }; +}); + +describe('MlJobLink', () => { + it('renders job name when available', () => { + const jobName = 'test_job_name'; + const { getByTestId } = render(, { + wrapper: TestProviders, + }); + + expect(getByTestId('machineLearningJobLink')).toHaveTextContent(jobName); + }); + + it('renders job id when job name is unavailable', () => { + const jobId = 'test_job_id'; + const { getByTestId } = render(, { + wrapper: TestProviders, + }); + + expect(getByTestId('machineLearningJobLink')).toHaveTextContent(jobId); + }); +}); diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_link/ml_job_link.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_link/ml_job_link.tsx index a3eefb1240486..7680b5b72dff3 100644 --- a/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_link/ml_job_link.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_link/ml_job_link.tsx @@ -18,9 +18,10 @@ const StyledJobEuiLInk = styled(EuiLink)` interface MlJobLinkProps { jobId: string; + jobName: string | undefined; } -const MlJobLinkComponent: React.FC = ({ jobId }) => { +const MlJobLinkComponent: React.FC = ({ jobId, jobName }) => { const { services: { http, ml }, } = useKibana(); @@ -33,7 +34,7 @@ const MlJobLinkComponent: React.FC = ({ jobId }) => { return ( - {jobId} + {jobName ?? jobId} ); }; diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_select/index.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_select/index.tsx index 5bce4dae67903..7e55c3cb43770 100644 --- a/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_select/index.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/rules/ml_job_select/index.tsx @@ -31,6 +31,7 @@ import * as i18n from './translations'; interface MlJobValue { id: string; description: string; + name?: string; } const JobDisplayContainer = styled.div` @@ -50,9 +51,9 @@ const MlJobEuiButton = styled(EuiButton)` margin-top: 20px; `; -const JobDisplay: React.FC = ({ id, description }) => ( +const JobDisplay: React.FC = ({ description, name, id }) => ( - {id} + {name ?? id}

    {description}

    @@ -67,8 +68,13 @@ interface MlJobSelectProps { } const renderJobOption = (option: MlJobOption) => ( - // eslint-disable-next-line @typescript-eslint/no-non-null-assertion - + ); export const MlJobSelect: React.FC = ({ describedByIds = [], field }) => { @@ -90,11 +96,17 @@ export const MlJobSelect: React.FC = ({ describedByIds = [], f value: { id: job.id, description: job.description, + name: job.customSettings?.security_app_display_name, }, - label: job.id, + // Make sure users can search for id or name. + // The label contains the name and id because EuiComboBox uses it for the textual search. + label: `${job.customSettings?.security_app_display_name} ${job.id}`, })); - const selectedJobOptions = jobOptions.filter((option) => jobIds.includes(option.value.id)); + const selectedJobOptions = jobOptions + .filter((option) => jobIds.includes(option.value.id)) + // 'label' defines what is rendered inside the selected ComboBoxPill + .map((options) => ({ ...options, label: options.value.name ?? options.value.id })); const notRunningJobIds = useMemo(() => { const selectedJobs = jobs.filter(({ id }) => jobIds.includes(id)); diff --git a/x-pack/plugins/security_solution/public/detections/components/rules/ml_jobs_description/ml_job_item.tsx b/x-pack/plugins/security_solution/public/detections/components/rules/ml_jobs_description/ml_job_item.tsx index 377600652c7d0..b706ed4135f49 100644 --- a/x-pack/plugins/security_solution/public/detections/components/rules/ml_jobs_description/ml_job_item.tsx +++ b/x-pack/plugins/security_solution/public/detections/components/rules/ml_jobs_description/ml_job_item.tsx @@ -32,7 +32,7 @@ const MlJobItemComponent: FC<{ return (
    - +
    diff --git a/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx b/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx index 4df1eb412b2b3..21d0d3a199f55 100644 --- a/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx +++ b/x-pack/plugins/security_solution/public/detections/configurations/security_solution_detections/render_cell_value.tsx @@ -7,6 +7,7 @@ import type { EuiDataGridCellValueElementProps } from '@elastic/eui'; import { EuiIcon, EuiToolTip, EuiFlexGroup, EuiFlexItem } from '@elastic/eui'; +import { find } from 'lodash/fp'; import React, { useMemo } from 'react'; import { GuidedOnboardingTourStep } from '../../../common/components/guided_onboarding_tour/tour_step'; import { isDetectionsAlertsTable } from '../../../common/components/top_n/helpers'; @@ -42,7 +43,15 @@ export const RenderCellValue: React.FC 0 ? ( + actualSuppressionCount && + actualSuppressionCount > 0 ? ( - + @@ -108,7 +114,7 @@ export const useRenderCellValue = ({ } return ( - - {defaultToEmptyTag(geo)} + ); } else { diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx index 4ebf075004b89..7f5d2a638e59c 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_execution_output.tsx @@ -92,7 +92,7 @@ export const CommandExecutionOutput = memo( return (
    - +
    {/* UX desire for 12px (current theme): achieved with EuiSpace sizes - s (8px) + xs (4px) */} diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx index 0310b0251d5d0..8aeaf9a4c0043 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/command_input.tsx @@ -12,6 +12,7 @@ import { EuiFlexGroup, EuiFlexItem, EuiButtonIcon, EuiResizeObserver } from '@el import styled from 'styled-components'; import classNames from 'classnames'; import type { EuiResizeObserverProps } from '@elastic/eui/src/components/observer/resize_observer/resize_observer'; +import type { ExecuteCommandPayload, ConsoleDataState } from '../console_state/types'; import { useWithInputShowPopover } from '../../hooks/state_selectors/use_with_input_show_popover'; import { EnteredInput } from './lib/entered_input'; import type { InputCaptureProps } from './components/input_capture'; @@ -40,6 +41,13 @@ const CommandInputContainer = styled.div` border-bottom-color: ${({ theme: { eui } }) => eui.euiColorDanger}; } + .inputDisplay { + & > * { + flex-direction: row; + align-items: center; + } + } + .textEntered { white-space: break-spaces; } @@ -88,13 +96,17 @@ export interface CommandInputProps extends CommonProps { export const CommandInput = memo(({ prompt = '', focusRef, ...commonProps }) => { useInputHints(); + const getTestId = useTestIdGenerator(useDataTestSubj()); const dispatch = useConsoleStateDispatch(); - const { rightOfCursor, textEntered, fullTextEntered } = useWithInputTextEntered(); + const { rightOfCursorText, leftOfCursorText, fullTextEntered, enteredCommand, parsedInput } = + useWithInputTextEntered(); const visibleState = useWithInputVisibleState(); - const [isKeyInputBeingCaptured, setIsKeyInputBeingCaptured] = useState(false); - const getTestId = useTestIdGenerator(useDataTestSubj()); const isPopoverOpen = !!useWithInputShowPopover(); - const [commandToExecute, setCommandToExecute] = useState(''); + + const [isKeyInputBeingCaptured, setIsKeyInputBeingCaptured] = useState(false); + const [commandToExecute, setCommandToExecute] = useState( + undefined + ); const [popoverWidth, setPopoverWidth] = useState('94vw'); const _focusRef: InputCaptureProps['focusRef'] = useRef(null); @@ -111,6 +123,10 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. const disableArrowButton = useMemo(() => fullTextEntered.trim().length === 0, [fullTextEntered]); + const userInput = useMemo(() => { + return new EnteredInput(leftOfCursorText, rightOfCursorText, parsedInput, enteredCommand); + }, [enteredCommand, leftOfCursorText, parsedInput, rightOfCursorText]); + const handleOnResize = useCallback(({ width }) => { if (width > 0) { setPopoverWidth(`${width}px`); @@ -118,15 +134,12 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. }, []); const handleSubmitButton = useCallback(() => { - setCommandToExecute(textEntered + rightOfCursor.text); - dispatch({ - type: 'updateInputTextEnteredState', - payload: { - textEntered: '', - rightOfCursor: undefined, - }, + setCommandToExecute({ + input: userInput.getFullText(true), + enteredCommand, + parsedInput, }); - }, [dispatch, textEntered, rightOfCursor.text]); + }, [enteredCommand, parsedInput, userInput]); const handleOnChangeFocus = useCallback>( (hasFocus) => { @@ -163,8 +176,18 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. // Update the store with the updated text that was entered dispatch({ type: 'updateInputTextEnteredState', - payload: ({ textEntered: prevLeftOfCursor, rightOfCursor: prevRightOfCursor }) => { - let inputText = new EnteredInput(prevLeftOfCursor, prevRightOfCursor.text); + payload: ({ + leftOfCursorText: prevLeftOfCursor, + rightOfCursorText: prevRightOfCursor, + enteredCommand: prevEnteredCommand, + parsedInput: prevParsedInput, + }) => { + const inputText = new EnteredInput( + prevLeftOfCursor, + prevRightOfCursor, + prevParsedInput, + prevEnteredCommand + ); inputText.addValue(value ?? '', selection); @@ -181,8 +204,12 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. // ENTER = Execute command and blank out the input area case 13: - setCommandToExecute(inputText.getFullText()); - inputText = new EnteredInput('', ''); + setCommandToExecute({ + input: inputText.getFullText(true), + enteredCommand: prevEnteredCommand as ConsoleDataState['input']['enteredCommand'], + parsedInput: prevParsedInput as ConsoleDataState['input']['parsedInput'], + }); + inputText.clear(); break; // ARROW LEFT @@ -207,8 +234,9 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. } return { - textEntered: inputText.getLeftOfCursorText(), - rightOfCursor: { text: inputText.getRightOfCursorText() }, + leftOfCursorText: inputText.getLeftOfCursorText(), + rightOfCursorText: inputText.getRightOfCursorText(), + argState: inputText.getArgState(), }; }, }); @@ -219,8 +247,17 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. // Execute the command if one was ENTER'd. useEffect(() => { if (commandToExecute) { - dispatch({ type: 'executeCommand', payload: { input: commandToExecute } }); - setCommandToExecute(''); + dispatch({ type: 'executeCommand', payload: commandToExecute }); + setCommandToExecute(undefined); + + // reset input + dispatch({ + type: 'updateInputTextEnteredState', + payload: { + leftOfCursorText: '', + rightOfCursorText: '', + }, + }); } }, [commandToExecute, dispatch]); @@ -248,17 +285,20 @@ export const CommandInput = memo(({ prompt = '', focusRef, .. onChangeFocus={handleOnChangeFocus} focusRef={focusRef} > - - -
    {textEntered}
    + + + {userInput.getLeftOfCursorRenderingContent()} - -
    - {rightOfCursor.text} -
    + + {userInput.getRightOfCursorRenderingContent()}     diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx new file mode 100644 index 0000000000000..28a5a082c2903 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/argument_selector_wrapper.tsx @@ -0,0 +1,142 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { memo, useCallback } from 'react'; +import { EuiFlexGroup, EuiFlexItem } from '@elastic/eui'; +import styled, { createGlobalStyle } from 'styled-components'; +import type { EuiTheme } from '@kbn/kibana-react-plugin/common'; +import { useConsoleStateDispatch } from '../../../hooks/state_selectors/use_console_state_dispatch'; +import { useWithCommandArgumentState } from '../../../hooks/state_selectors/use_with_command_argument_state'; +import type { CommandArgDefinition, CommandArgumentValueSelectorProps } from '../../../types'; + +const ArgumentSelectorWrapperContainer = styled.span` + user-select: none; + + .selectorContainer { + max-width: 25vw; + display: flex; + align-items: center; + height: 100%; + } +`; + +// FIXME:PT Delete below. Only here for DEV purposes +const DevUxStyles = createGlobalStyle<{ theme: EuiTheme }>` + + body { + + &.style1 .argSelectorWrapper { + .style1-hide { + display: none; + } + + .selectorContainer { + border: ${({ theme: { eui } }) => eui.euiBorderThin}; + border-radius: ${({ theme: { eui } }) => eui.euiBorderRadiusSmall}; + padding: 0 ${({ theme: { eui } }) => eui.euiSizeXS}; + } + } + + &.style2 { + .argSelectorWrapper { + border: ${({ theme: { eui } }) => eui.euiBorderThin}; + border-radius: ${({ theme: { eui } }) => eui.euiBorderRadiusSmall}; + overflow: hidden; + + & > .euiFlexGroup { + align-items: stretch; + } + + .style2-hide { + display: none; + } + + .argNameContainer { + background-color: ${({ theme: { eui } }) => eui.euiFormInputGroupLabelBackground}; + } + + .argName { + padding-left: ${({ theme: { eui } }) => eui.euiSizeXS}; + height: 100%; + display: flex; + align-items: center; + } + .selectorContainer { + padding: 0 ${({ theme: { eui } }) => eui.euiSizeXS}; + } + } + } + } +`; + +// Type to ensure that `SelectorComponent` is defined +type ArgDefinitionWithRequiredSelector = Omit & + Pick, 'SelectorComponent'>; + +export interface ArgumentSelectorWrapperProps { + argName: string; + argIndex: number; + argDefinition: ArgDefinitionWithRequiredSelector; +} + +/** + * handles displaying a custom argument value selector and manages its state + */ +export const ArgumentSelectorWrapper = memo( + ({ argName, argIndex, argDefinition: { SelectorComponent } }) => { + const dispatch = useConsoleStateDispatch(); + const { valueText, value, store } = useWithCommandArgumentState(argName, argIndex); + + const handleSelectorComponentOnChange = useCallback< + CommandArgumentValueSelectorProps['onChange'] + >( + (updates) => { + dispatch({ + type: 'updateInputCommandArgState', + payload: { + name: argName, + instance: argIndex, + state: updates, + }, + }); + }, + [argIndex, argName, dispatch] + ); + + return ( + + + +
    + {`--${argName}=`} + {'"'} +
    +     + + {/* `div` below ensures that the `SelectorComponent` does NOT inherit the styles of a `flex` container */} +
    + +
    +     + + {'"'} + +     + + +     + ); + } +); +ArgumentSelectorWrapper.displayName = 'ArgumentSelectorWrapper'; diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/command_input_history.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/command_input_history.tsx index fbb5b7360eddd..4e192a80d5b84 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/command_input_history.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/command_input_history.tsx @@ -43,7 +43,7 @@ export const CommandInputHistory = memo(() => { const selectableHistoryOptions = useMemo(() => { return inputHistory.map((inputItem, index) => { return { - label: inputItem.input, + label: inputItem.display, key: inputItem.id, data: inputItem, }; @@ -94,7 +94,13 @@ export const CommandInputHistory = memo(() => { dispatch({ type: 'updateInputPlaceholderState', payload: { placeholder: '' } }); if (selected) { - dispatch({ type: 'updateInputTextEnteredState', payload: { textEntered: selected.label } }); + dispatch({ + type: 'updateInputTextEnteredState', + payload: { + leftOfCursorText: (selected.data as InputHistoryItem).input, + rightOfCursorText: '', + }, + }); } dispatch({ type: 'addFocusToKeyCapture' }); @@ -124,15 +130,18 @@ export const CommandInputHistory = memo(() => { // unloads, if no option from the history was selected, then set the prior text // entered back useEffect(() => { - dispatch({ type: 'updateInputTextEnteredState', payload: { textEntered: '' } }); + dispatch({ + type: 'updateInputTextEnteredState', + payload: { leftOfCursorText: '', rightOfCursorText: '' }, + }); return () => { if (!optionWasSelected.current) { dispatch({ type: 'updateInputTextEnteredState', payload: { - textEntered: priorInputState.textEntered, - rightOfCursor: priorInputState.rightOfCursor, + leftOfCursorText: priorInputState.leftOfCursorText, + rightOfCursorText: priorInputState.rightOfCursorText, }, }); dispatch({ type: 'updateInputPlaceholderState', payload: { placeholder: '' } }); diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx index 40775d5220eed..f0dde8fb95670 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/components/input_placeholder.tsx @@ -19,6 +19,10 @@ const InputPlaceholderContainer = styled(EuiText)` padding-left: 0.5em; width: 96%; color: ${({ theme: { eui } }) => eui.euiFormControlPlaceholderText}; + user-select: none; + line-height: ${({ theme: { eui } }) => { + return `calc(${eui.euiLineHeight}em + 0.5em)`; + }}; `; export const InputPlaceholder = memo(() => { diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/hooks/use_input_hints.ts b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/hooks/use_input_hints.ts index 8d179708f3850..16abace42ad75 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/hooks/use_input_hints.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/hooks/use_input_hints.ts @@ -38,7 +38,7 @@ export const useInputHints = () => { const isInputPopoverOpen = Boolean(useWithInputShowPopover()); const commandEntered = useWithInputCommandEntered(); const commandList = useWithCommandList(); - const { textEntered } = useWithInputTextEntered(); + const { leftOfCursorText } = useWithInputTextEntered(); const commandEnteredDefinition = useMemo(() => { if (commandEntered) { @@ -105,10 +105,10 @@ export const useInputHints = () => { dispatch({ type: 'updateFooterContent', payload: { - value: textEntered || isInputPopoverOpen ? '' : UP_ARROW_ACCESS_HISTORY_HINT, + value: leftOfCursorText || isInputPopoverOpen ? '' : UP_ARROW_ACCESS_HISTORY_HINT, }, }); dispatch({ type: 'setInputState', payload: { value: undefined } }); } - }, [commandEntered, commandEnteredDefinition, dispatch, isInputPopoverOpen, textEntered]); + }, [commandEntered, commandEnteredDefinition, dispatch, isInputPopoverOpen, leftOfCursorText]); }; diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx index 54b8a487d2e09..028c4874c1cd6 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/integration_tests/command_input.test.tsx @@ -463,4 +463,39 @@ describe('When entering data into the Console input', () => { expect(getRightOfCursorText()).toEqual(''); }); }); + + describe('and a command argument has a value SelectorComponent defined', () => { + it('should insert Selector component when argument name is used', async () => { + render(); + enterCommand('cmd7 --foo', { inputOnly: true }); + + expect(getLeftOfCursorText()).toEqual('cmd7 --foo="foo[0]: foo selected"'); + }); + + it('should support using argument multiple times (allowMultiples: true)', async () => { + render(); + enterCommand('cmd7 --foo --foo', { inputOnly: true }); + + expect(getLeftOfCursorText()).toEqual( + 'cmd7 --foo="foo[0]: foo selected" --foo="foo[1]: foo selected"' + ); + }); + + it(`should remove entire argument if BACKSPACE key is pressed`, async () => { + render(); + enterCommand('cmd7 --foo', { inputOnly: true }); + typeKeyboardKey('{backspace}'); + + expect(getLeftOfCursorText()).toEqual('cmd7 '); + }); + + it(`should remove entire argument if DELETE key is pressed`, async () => { + render(); + enterCommand('cmd7 --foo', { inputOnly: true }); + typeKeyboardKey('{ArrowLeft}'); + typeKeyboardKey('{Delete}'); + + expect(getLeftOfCursorText()).toEqual('cmd7 '); + }); + }); }); diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.test.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.test.tsx new file mode 100644 index 0000000000000..fa313293d4746 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.test.tsx @@ -0,0 +1,322 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { EnteredInput } from './entered_input'; +import { parseCommandInput } from '../../../service/parsed_command_input'; +import type { CommandDefinition } from '../../..'; +import { getCommandListMock } from '../../../mocks'; +import type { EnteredCommand } from '../../console_state/types'; + +describe('When using `EnteredInput` class', () => { + let enteredInput: EnteredInput; + let commandDefinition: CommandDefinition; + + const createEnteredInput = ( + leftOfCursorText: string = 'cmd1 --comment="hello"', + rightOfCursorText: string = '', + commandDef: CommandDefinition | undefined = commandDefinition, + argValueSelectorState: EnteredCommand['argState'] = {} + ): EnteredInput => { + const parsedInput = parseCommandInput(leftOfCursorText + rightOfCursorText); + const enteredCommand: EnteredCommand | undefined = commandDef + ? { + commandDefinition: commandDef, + argState: argValueSelectorState, + argsWithValueSelectors: undefined, + } + : undefined; + + enteredInput = new EnteredInput( + leftOfCursorText, + rightOfCursorText, + parsedInput, + enteredCommand + ); + + return enteredInput; + }; + + beforeEach(() => { + commandDefinition = getCommandListMock().find((def) => def.name === 'cmd1')!; + }); + + it('should clear input when calling `clear()`', () => { + createEnteredInput('cmd1 --comment="', 'hello"'); + + expect(enteredInput.getFullText()).toEqual('cmd1 --comment="hello"'); + + enteredInput.clear(); + + expect(enteredInput.getFullText()).toEqual(''); + }); + + it.each([ + { + leftInput: 'cmd1 --comment="', + rightInput: '', + valueToAdd: 'n', + leftExpected: 'cmd1 --comment="n', + rightExpected: '', + }, + { + leftInput: 'cmd1 --comment="', + rightInput: '"', + valueToAdd: 'n', + leftExpected: 'cmd1 --comment="n', + rightExpected: '"', + }, + { + leftInput: '', + rightInput: 'cmd1 --comment=""', + valueToAdd: 'n', + leftExpected: 'n', + rightExpected: 'cmd1 --comment=""', + }, + ])( + 'Should add [$valueToAdd] to command left=[$leftInput] right=[$rightInput]', + ({ leftInput, rightInput, valueToAdd, leftExpected, rightExpected }) => { + createEnteredInput(leftInput, rightInput); + enteredInput.addValue(valueToAdd); + + expect(enteredInput.getLeftOfCursorText()).toEqual(leftExpected); + expect(enteredInput.getRightOfCursorText()).toEqual(rightExpected); + } + ); + + it.each([ + // Cursor at the end + + // Cursor at the start + { + leftInput: '', + rightInput: 'cmd1 --comment="hello"', + valueToAdd: 'n', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="n', + rightExpected: '"', + }, + // Cursor in the middle with replacement value on the right + { + leftInput: 'cmd1 --comment', + rightInput: '="hello"', + valueToAdd: 'n', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="n', + rightExpected: '"', + }, + // Cursor in the middle right between the replacement value + { + leftInput: 'cmd1 --comment="he', + rightInput: 'llo"', + valueToAdd: 'n', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="n', + rightExpected: '"', + }, + // Cursor at the end of the value that will be replaced + { + leftInput: 'cmd1 --comment="hello', + rightInput: '"', + valueToAdd: 'n', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="n', + rightExpected: '"', + }, + // Cursor at the start of the value that will be replaced + { + leftInput: 'cmd1 --comment="', + rightInput: 'hello"', + valueToAdd: 'n', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="n', + rightExpected: '"', + }, + ])( + 'Should replace (via `.addValue()`) [$valueToReplace] with [$valueToAdd] on command left=[$leftInput] right=[$rightInput]', + ({ leftInput, rightInput, valueToAdd, valueToReplace, rightExpected, leftExpected }) => { + createEnteredInput(leftInput, rightInput); + enteredInput.addValue(valueToAdd, valueToReplace); + + expect(enteredInput.getLeftOfCursorText()).toEqual(leftExpected); + expect(enteredInput.getRightOfCursorText()).toEqual(rightExpected); + } + ); + + it.each([ + { + leftInput: 'cmd1 --comment="', + rightInput: 'hello"', + direction: 'left', + leftExpected: 'cmd1 --comment=', + rightExpected: '"hello"', + }, + { + leftInput: 'cmd1 --comment="', + rightInput: 'hello"', + direction: 'right', + leftExpected: 'cmd1 --comment="h', + rightExpected: 'ello"', + }, + { + leftInput: 'cmd1 --comment="', + rightInput: 'hello"', + direction: 'end', + leftExpected: 'cmd1 --comment="hello"', + rightExpected: '', + }, + { + leftInput: 'cmd1 --comment="', + rightInput: 'hello"', + direction: 'home', + leftExpected: '', + rightExpected: 'cmd1 --comment="hello"', + }, + ])( + 'should move cursor $direction', + ({ leftInput, rightInput, direction, leftExpected, rightExpected }) => { + createEnteredInput(leftInput, rightInput); + enteredInput.moveCursorTo(direction as Parameters[0]); + + expect(enteredInput.getLeftOfCursorText()).toEqual(leftExpected); + expect(enteredInput.getRightOfCursorText()).toEqual(rightExpected); + } + ); + + it.each([ + { + leftInput: 'cmd1 --comment="hello"', + rightInput: '', + leftExpected: 'cmd1 --comment="hello"', + rightExpected: '', + }, + { + leftInput: '', + rightInput: 'cmd1 --comment="hello"', + leftExpected: '', + rightExpected: 'md1 --comment="hello"', + }, + { + leftInput: 'cmd1 --comment="h', + rightInput: 'ello"', + leftExpected: 'cmd1 --comment="h', + rightExpected: 'llo"', + }, + ])( + 'should remove expected character using `deleteChar()` when command is left=[$leftInput] right=[$rightInput]', + ({ leftInput, rightInput, leftExpected, rightExpected }) => { + createEnteredInput(leftInput, rightInput); + + enteredInput.deleteChar(); + + expect(enteredInput.getLeftOfCursorText()).toEqual(leftExpected); + expect(enteredInput.getRightOfCursorText()).toEqual(rightExpected); + } + ); + + it.each([ + { + leftInput: 'cmd1 --comment="hello"', + rightInput: '', + leftExpected: 'cmd1 --comment="hello', + rightExpected: '', + }, + { + leftInput: '', + rightInput: 'cmd1 --comment="hello"', + leftExpected: '', + rightExpected: 'cmd1 --comment="hello"', + }, + { + leftInput: 'cmd1 --comment="h', + rightInput: 'ello"', + leftExpected: 'cmd1 --comment="', + rightExpected: 'ello"', + }, + ])( + 'should remove expected character using `backspaceChar()` when command is left=[$leftInput] right=[$rightInput]', + ({ leftInput, rightInput, leftExpected, rightExpected }) => { + createEnteredInput(leftInput, rightInput); + + enteredInput.backspaceChar(); + + expect(enteredInput.getLeftOfCursorText()).toEqual(leftExpected); + expect(enteredInput.getRightOfCursorText()).toEqual(rightExpected); + } + ); + + describe.each(['deleteChar', 'backspaceChar'])( + 'and using %s with text selected', + (methodName) => { + it.each([ + { + leftInput: 'cmd1 --comment="hello"', + rightInput: '', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="', + rightExpected: '"', + }, + // Cursor at the start + { + leftInput: '', + rightInput: 'cmd1 --comment="hello"', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="', + rightExpected: '"', + }, + // Cursor in the middle with replacement value on the right + { + leftInput: 'cmd1 --comment', + rightInput: '="hello"', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="', + rightExpected: '"', + }, + // Cursor in the middle right between the replacement value + { + leftInput: 'cmd1 --comment="he', + rightInput: 'llo"', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="', + rightExpected: '"', + }, + // Cursor at the end of the value that will be replaced + { + leftInput: 'cmd1 --comment="hello', + rightInput: '"', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="', + rightExpected: '"', + }, + // Cursor at the start of the value that will be replaced + { + leftInput: 'cmd1 --comment="', + rightInput: 'hello"', + valueToReplace: 'hello', + leftExpected: 'cmd1 --comment="', + rightExpected: '"', + }, + ])( + 'Should remove selection [$valueToReplace] (via `.deleteChr()`) from command left=[$leftInput] right=[$rightInput]', + ({ leftInput, rightInput, valueToReplace, rightExpected, leftExpected }) => { + createEnteredInput(leftInput, rightInput); + + switch (methodName) { + case 'deleteChar': + enteredInput.deleteChar(valueToReplace); + break; + case 'backspaceChar': + enteredInput.backspaceChar(valueToReplace); + break; + } + + expect(enteredInput.getLeftOfCursorText()).toEqual(leftExpected); + expect(enteredInput.getRightOfCursorText()).toEqual(rightExpected); + } + ); + } + ); +}); diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.ts b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.ts deleted file mode 100644 index bf809c9bee885..0000000000000 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.ts +++ /dev/null @@ -1,98 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -/** - * Class that manages the command entered and how that is displayed to the left and right of the cursor - */ -export class EnteredInput { - constructor(private leftOfCursorText: string, private rightOfCursorText: string) {} - - private replaceSelection(selection: string, newValue: string) { - const prevFullTextEntered = this.leftOfCursorText + this.rightOfCursorText; - - this.leftOfCursorText = - prevFullTextEntered.substring(0, prevFullTextEntered.indexOf(selection)) + newValue; - - this.rightOfCursorText = prevFullTextEntered.substring( - prevFullTextEntered.indexOf(selection) + selection.length - ); - } - - getLeftOfCursorText(): string { - return this.leftOfCursorText; - } - - getRightOfCursorText(): string { - return this.rightOfCursorText; - } - - getFullText(): string { - return this.leftOfCursorText + this.rightOfCursorText; - } - - moveCursorTo(direction: 'left' | 'right' | 'end' | 'home') { - switch (direction) { - case 'end': - this.leftOfCursorText = this.leftOfCursorText + this.rightOfCursorText; - this.rightOfCursorText = ''; - break; - - case 'home': - this.rightOfCursorText = this.leftOfCursorText + this.rightOfCursorText; - this.leftOfCursorText = ''; - break; - - case 'left': - if (this.leftOfCursorText.length) { - // Add last character on the left, to the right side of the cursor - this.rightOfCursorText = - this.leftOfCursorText.charAt(this.leftOfCursorText.length - 1) + this.rightOfCursorText; - - // Remove the last character from the left (it's now on the right side of cursor) - this.leftOfCursorText = this.leftOfCursorText.substring( - 0, - this.leftOfCursorText.length - 1 - ); - } - break; - - case 'right': - if (this.rightOfCursorText.length) { - // MOve the first character from the Right side, to the left side of the cursor - this.leftOfCursorText = this.leftOfCursorText + this.rightOfCursorText.charAt(0); - - // Remove the first character from the Right side of the cursor (now on the left) - this.rightOfCursorText = this.rightOfCursorText.substring(1); - } - break; - } - } - - addValue(value: string, replaceSelection: string = '') { - if (replaceSelection.length && value.length) { - this.replaceSelection(replaceSelection, value); - } else { - this.leftOfCursorText += value; - } - } - - deleteChar(replaceSelection: string = '') { - if (replaceSelection) { - this.replaceSelection(replaceSelection, ''); - } else if (this.rightOfCursorText) { - this.rightOfCursorText = this.rightOfCursorText.substring(1); - } - } - - backspaceChar(replaceSelection: string = '') { - if (replaceSelection) { - this.replaceSelection(replaceSelection, ''); - } else if (this.leftOfCursorText) { - this.leftOfCursorText = this.leftOfCursorText.substring(0, this.leftOfCursorText.length - 1); - } - } -} diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx new file mode 100644 index 0000000000000..f6a1b67233355 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_input/lib/entered_input.tsx @@ -0,0 +1,295 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import type { ReactNode } from 'react'; +import React from 'react'; +import type { ArgumentSelectorWrapperProps } from '../components/argument_selector_wrapper'; +import { ArgumentSelectorWrapper } from '../components/argument_selector_wrapper'; +import type { ParsedCommandInterface } from '../../../service/types'; +import type { ArgSelectorState, EnteredCommand } from '../../console_state/types'; + +interface InputCharacter { + value: string; + renderValue: ReactNode; + isArgSelector: boolean; + argName: string; + argIndex: number; // zero based + argState: undefined | ArgSelectorState; +} + +const createInputCharacter = (overrides: Partial = {}): InputCharacter => { + return { + value: '', + renderValue: null, + isArgSelector: false, + argName: '', + argIndex: 0, + argState: undefined, + ...overrides, + }; +}; + +const getInputCharacters = (input: string): InputCharacter[] => { + return input.split('').map((char) => { + return createInputCharacter({ + value: char, + renderValue: char, + }); + }); +}; + +const toReactJsxFragment = (prefix: string, item: InputCharacter, index: number) => { + return {item.renderValue}; +}; + +const toInputCharacterDisplayString = ( + includeArgSelectorValues: boolean, + item: InputCharacter +): string => { + let response = item.value; + + if (includeArgSelectorValues && item.isArgSelector) { + response += `="${item.argState?.valueText ?? ''}"`; + } + + return response; +}; + +/** + * Class that manages the command entered and how that is displayed to the left and right of the cursor + */ +export class EnteredInput { + private leftOfCursorContent: InputCharacter[]; + private rightOfCursorContent: InputCharacter[]; + private canHaveArgValueSelectors: boolean; + private argState: undefined | EnteredCommand['argState']; + + constructor( + leftOfCursorText: string, + rightOfCursorText: string, + parsedInput: ParsedCommandInterface, + enteredCommand: undefined | EnteredCommand + ) { + this.leftOfCursorContent = getInputCharacters(leftOfCursorText); + this.rightOfCursorContent = getInputCharacters(rightOfCursorText); + + this.canHaveArgValueSelectors = Boolean(enteredCommand?.argsWithValueSelectors); + + // Determine if any argument value selector should be inserted + if (parsedInput.hasArgs && enteredCommand && enteredCommand.argsWithValueSelectors) { + this.argState = enteredCommand.argState; + + const inputPieces = [ + { + input: leftOfCursorText, + items: this.leftOfCursorContent, + }, + { + input: rightOfCursorText, + items: this.rightOfCursorContent, + }, + ]; + + for (const [argName, argDef] of Object.entries(enteredCommand.argsWithValueSelectors)) { + // If the argument has been used, then replace it with the Arguments Selector + if (parsedInput.hasArg(argName)) { + let argIndex = 0; + + // Loop through the input pieces (left and right side of cursor) looking for the Argument name + for (const { input, items } of inputPieces) { + const argNameMatch = `--${argName}`; + let pos = input.indexOf(argNameMatch); + + while (pos > -1) { + const argChrLength = argNameMatch.length; + const replaceValues: InputCharacter[] = Array.from( + { length: argChrLength }, + createInputCharacter + ); + const argState = enteredCommand.argState[argName]?.at(argIndex); + + replaceValues[0] = createInputCharacter({ + value: argNameMatch, + renderValue: ( + + ), + isArgSelector: true, + argName, + argIndex: argIndex++, + argState, + }); + + items.splice(pos, argChrLength, ...replaceValues); + + pos = input.indexOf(argNameMatch, pos + argChrLength); + } + } + } + } + + // Remove all empty characters (created as a result of inserting any Argument Selector components) + this.leftOfCursorContent = this.leftOfCursorContent.filter(({ value }) => value.length > 0); + this.rightOfCursorContent = this.rightOfCursorContent.filter(({ value }) => value.length > 0); + } + } + + private replaceSelection(selection: string, newValue: string) { + const prevFullTextEntered = this.getFullText(); + const newValueContent = newValue ? createInputCharacter({ value: newValue }) : undefined; + let start = prevFullTextEntered.indexOf(selection); + + const fullContent = [...this.leftOfCursorContent, ...this.rightOfCursorContent]; + + // Adjust the `start` to account for arguments that have value selectors. + // These arguments, are stored in the `fullContent` array as one single array item instead of + // one per-character. The adjustment needs to be done only if the argument appears to the left + // of the selection + if (this.canHaveArgValueSelectors) { + fullContent.forEach((inputCharacter, index) => { + if (inputCharacter.isArgSelector && index < start) { + start = start - (inputCharacter.value.length - 1); + } + }); + } + + const removedChars = fullContent.splice(start, selection.length); + + if (newValueContent) { + fullContent.splice(start, 0, newValueContent); + start++; + } + + this.leftOfCursorContent = fullContent.splice(0, start); + this.rightOfCursorContent = fullContent; + this.removeArgState(removedChars); + } + + private removeArgState(argStateList: InputCharacter[]) { + if (this.argState) { + let argStateWasAdjusted = false; + const newArgState = { ...this.argState }; + + for (const { argName, argIndex, isArgSelector } of argStateList) { + if (isArgSelector && newArgState[argName]?.at(argIndex)) { + newArgState[argName] = newArgState[argName].filter((_, index) => { + return index !== argIndex; + }); + argStateWasAdjusted = true; + } + } + + if (argStateWasAdjusted) { + this.argState = newArgState; + } + } + } + + getLeftOfCursorText(includeArgSelectorValues: boolean = false): string { + return this.leftOfCursorContent + .map(toInputCharacterDisplayString.bind(null, includeArgSelectorValues)) + .join(''); + } + + getRightOfCursorText(includeArgSelectorValues: boolean = false): string { + return this.rightOfCursorContent + .map(toInputCharacterDisplayString.bind(null, includeArgSelectorValues)) + .join(''); + } + + getFullText(includeArgSelectorValues: boolean = false): string { + return ( + this.getLeftOfCursorText(includeArgSelectorValues) + + this.getRightOfCursorText(includeArgSelectorValues) + ); + } + + getLeftOfCursorRenderingContent(): ReactNode { + return <>{this.leftOfCursorContent.map(toReactJsxFragment.bind(null, 'left'))}; + } + + getRightOfCursorRenderingContent(): ReactNode { + return <>{this.rightOfCursorContent.map(toReactJsxFragment.bind(null, 'right'))}; + } + + getArgState(): undefined | EnteredCommand['argState'] { + return this.argState; + } + + moveCursorTo(direction: 'left' | 'right' | 'end' | 'home') { + switch (direction) { + case 'end': + this.leftOfCursorContent.push(...this.rightOfCursorContent.splice(0)); + break; + + case 'home': + this.rightOfCursorContent.unshift(...this.leftOfCursorContent.splice(0)); + break; + + case 'left': + if (this.leftOfCursorContent.length) { + const itemToMove = this.leftOfCursorContent.pop(); + + if (itemToMove) { + this.rightOfCursorContent.unshift(itemToMove); + } + } + break; + + case 'right': + if (this.rightOfCursorContent.length) { + const itemToMove = this.rightOfCursorContent.shift(); + + if (itemToMove) { + this.leftOfCursorContent.push(itemToMove); + } + } + break; + } + } + + addValue(value: string, replaceSelection: string = '') { + if (replaceSelection.length && value.length) { + this.replaceSelection(replaceSelection, value); + } else if (value) { + this.leftOfCursorContent.push(createInputCharacter({ value })); + } + } + + deleteChar(replaceSelection: string = '') { + if (replaceSelection) { + this.replaceSelection(replaceSelection, ''); + } else { + const removedChar = this.rightOfCursorContent.shift(); + + if (removedChar?.isArgSelector) { + this.removeArgState([removedChar]); + } + } + } + + backspaceChar(replaceSelection: string = '') { + if (replaceSelection) { + this.replaceSelection(replaceSelection, ''); + } else { + const removedChar = this.leftOfCursorContent.pop(); + + if (removedChar?.isArgSelector) { + this.removeArgState([removedChar]); + } + } + } + + clear() { + this.leftOfCursorContent = []; + this.rightOfCursorContent = []; + this.argState = undefined; + } +} diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/command_list.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/command_list.tsx index 83c5df7397daa..854c66dcc27d7 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/command_list.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/command_list.tsx @@ -124,7 +124,8 @@ export const CommandList = memo(({ commands, display = 'defaul type: 'updateInputTextEnteredState', payload: () => { return { - textEntered: text, + leftOfCursorText: text, + rightOfCursorText: '', }; }, }); diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/hooks/use_stored_input_history.ts b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/hooks/use_stored_input_history.ts index 8a9249b3dc01f..a1614f2b36683 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/hooks/use_stored_input_history.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/hooks/use_stored_input_history.ts @@ -17,10 +17,12 @@ interface InputHistoryOfflineStorage { const COMMAND_INPUT_HISTORY_KEY = 'commandInputHistory'; /** - * The current version of the input history offline storage. Will help in the future - * if we ever need to "migrate" stored data to a new format + * The current version of the input history offline storage. + * + * NOTE: Changes to this value will likely require some migration to be added + * to `migrateHistoryData()` down below. */ -const CURRENT_VERSION = 1; +const CURRENT_VERSION = 2; const getDefaultInputHistoryStorage = (): InputHistoryOfflineStorage => { return { @@ -41,6 +43,10 @@ export const useStoredInputHistory = ( `${storagePrefix}.${COMMAND_INPUT_HISTORY_KEY}` ) as InputHistoryOfflineStorage) ?? getDefaultInputHistoryStorage(); + if (storedData.version !== CURRENT_VERSION) { + migrateHistoryData(storedData); + } + return storedData.data; } @@ -69,3 +75,19 @@ export const useSaveInputHistoryToStorage = ( [storage, storagePrefix] ); }; + +const migrateHistoryData = (storedData: InputHistoryOfflineStorage) => { + const { data, version } = storedData; + + for (const historyItem of data) { + // ------------------------------------------- + // V2: + // - adds `display` property + // ------------------------------------------- + if (version < 2) { + historyItem.display = historyItem.input; + } + } + + storedData.version = CURRENT_VERSION; +}; diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_reducer.ts b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_reducer.ts index d6c6161da3300..407ae37e2377c 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_reducer.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_reducer.ts @@ -5,6 +5,7 @@ * 2.0. */ +import { parseCommandInput } from '../../service/parsed_command_input'; import { handleInputAreaState, INPUT_DEFAULT_PLACEHOLDER_TEXT, @@ -31,16 +32,17 @@ export const initiateState = ( managedConsolePriorState?: ConsoleDataState ): ConsoleDataState => { const commands = getBuiltinCommands().concat(userCommandList); - const state = managedConsolePriorState ?? { + const state: ConsoleDataState = managedConsolePriorState ?? { commands, ...otherOptions, commandHistory: [], sidePanel: { show: null }, footerContent: '', input: { - textEntered: '', - rightOfCursor: { text: '' }, - commandEntered: '', + leftOfCursorText: '', + rightOfCursorText: '', + parsedInput: parseCommandInput(''), + enteredCommand: undefined, placeholder: INPUT_DEFAULT_PLACEHOLDER_TEXT, showPopover: undefined, history: [], @@ -102,6 +104,7 @@ export const stateDataReducer: ConsoleStoreReducer = (state, action) => { case 'updateInputTextEnteredState': case 'updateInputPlaceholderState': case 'setInputState': + case 'updateInputCommandArgState': newState = handleInputAreaState(state, action); break; diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_execute_command.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_execute_command.tsx index 764e7377a497c..94b8c07059f42 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_execute_command.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_execute_command.tsx @@ -5,13 +5,10 @@ * 2.0. */ -// FIXME:PT breakup module in order to avoid turning off eslint rule below -/* eslint-disable complexity */ - -import { i18n } from '@kbn/i18n'; import { v4 as uuidV4 } from 'uuid'; import React from 'react'; -import { FormattedMessage } from '@kbn/i18n-react'; +import { executionTranslations } from './translations'; +import type { ParsedCommandInterface } from '../../../service/types'; import { ConsoleCodeBlock } from '../../console_code_block'; import { handleInputAreaState } from './handle_input_area_state'; import { HelpCommandArgument } from '../../builtin_commands/help_command_argument'; @@ -21,8 +18,6 @@ import type { ConsoleDataState, ConsoleStoreReducer, } from '../types'; -import type { ParsedCommandInterface } from '../../../service/parsed_command_input'; -import { parseCommandInput } from '../../../service/parsed_command_input'; import { UnknownCommand } from '../../unknown_comand'; import { BadArgument } from '../../bad_argument'; import { ValidationError } from '../../validation_error'; @@ -76,7 +71,10 @@ const updateStateWithNewCommandHistoryItem = ( ): ConsoleDataState => { const updatedState = handleInputAreaState(state, { type: 'updateInputHistoryState', - payload: { command: newHistoryItem.command.input }, + payload: { + command: newHistoryItem.command.input, + display: newHistoryItem.command.inputDisplay, + }, }); updatedState.commandHistory = [...state.commandHistory, newHistoryItem]; @@ -131,16 +129,13 @@ const createCommandHistoryEntry = ( export const handleExecuteCommand: ConsoleStoreReducer< ConsoleDataAction & { type: 'executeCommand' } > = (state, action) => { - const parsedInput = parseCommandInput(action.payload.input); + const { parsedInput, enteredCommand, input: fullInputText } = action.payload; if (parsedInput.name === '') { return state; } - const { commands } = state; - const commandDefinition: CommandDefinition | undefined = commands.find( - (definition) => definition.name === parsedInput.name - ); + const commandDefinition: CommandDefinition | undefined = enteredCommand?.commandDefinition; // Unknown command if (!commandDefinition) { @@ -149,6 +144,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandHistoryEntry( { input: parsedInput.input, + inputDisplay: fullInputText, args: parsedInput, commandDefinition: { ...UnknownCommandDefinition, @@ -161,28 +157,17 @@ export const handleExecuteCommand: ConsoleStoreReducer< ); } - const command = { + const command: Command = { input: parsedInput.input, + inputDisplay: fullInputText, args: parsedInput, commandDefinition, }; const requiredArgs = getRequiredArguments(commandDefinition.args); const exclusiveOrArgs = getExclusiveOrArgs(commandDefinition.args); - const exclusiveOrErrorMessage = ( - - - {exclusiveOrArgs.map(toCliArgumentOption).join(', ')} - - ), - }} - /> - + const exclusiveOrErrorMessage = executionTranslations.onlyOneFromExclusiveOr( + exclusiveOrArgs.map(toCliArgumentOption).join(', ') ); // If args were entered, then validate them @@ -235,12 +220,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandHistoryEntry( cloneCommandDefinitionWithNewRenderComponent(command, BadArgument), createCommandExecutionState({ - errorMessage: i18n.translate( - 'xpack.securitySolution.console.commandValidation.noArgumentsSupported', - { - defaultMessage: 'Command does not support any arguments', - } - ), + errorMessage: executionTranslations.NO_ARGUMENTS_SUPPORTED, }), false ) @@ -256,26 +236,10 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandHistoryEntry( cloneCommandDefinitionWithNewRenderComponent(command, BadArgument), createCommandExecutionState({ - errorMessage: ( - - - {parsedInput.name} - - ), - unknownArgs: ( - - {unknownInputArgs.map(toCliArgumentOption).join(', ')} - - ), - }} - /> - + errorMessage: executionTranslations.unknownArgument( + unknownInputArgs.length, + parsedInput.name, + unknownInputArgs.map(toCliArgumentOption).join(', ') ), }), false @@ -294,15 +258,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandExecutionState({ errorMessage: ( - {i18n.translate( - 'xpack.securitySolution.console.commandValidation.missingRequiredArg', - { - defaultMessage: 'Missing required argument: {argName}', - values: { - argName: toCliArgumentOption(requiredArg), - }, - } - )} + {executionTranslations.missingRequiredArg(requiredArg)} ), }), @@ -341,15 +297,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandExecutionState({ errorMessage: ( - - {i18n.translate( - 'xpack.securitySolution.console.commandValidation.unsupportedArg', - { - defaultMessage: 'Unsupported argument: {argName}', - values: { argName: toCliArgumentOption(argName) }, - } - )} - + {executionTranslations.unsupportedArg(argName)} ), }), false @@ -366,13 +314,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandExecutionState({ errorMessage: ( - {i18n.translate( - 'xpack.securitySolution.console.commandValidation.argSupportedOnlyOnce', - { - defaultMessage: 'Argument can only be used once: {argName}', - values: { argName: toCliArgumentOption(argName) }, - } - )} + {executionTranslations.noMultiplesAllowed(argName)} ), }), @@ -381,6 +323,70 @@ export const handleExecuteCommand: ConsoleStoreReducer< ); } + if (argDefinition.mustHaveValue !== undefined && argDefinition.mustHaveValue !== false) { + let dataValidationError = ''; + + if (argInput.length === 0) { + dataValidationError = executionTranslations.mustHaveValue(argName); + } else { + argInput.some((argValue, index) => { + switch (argDefinition.mustHaveValue) { + case true: + case 'non-empty-string': + if (typeof argValue === 'boolean') { + dataValidationError = executionTranslations.mustHaveValue(argName); + } else if ( + argDefinition.mustHaveValue === 'non-empty-string' && + argValue.trim().length === 0 + ) { + dataValidationError = executionTranslations.mustHaveValue(argName); + } + break; + + case 'number': + case 'number-greater-than-zero': + { + const valueNumber = Number(argValue); + + if (!Number.isSafeInteger(valueNumber)) { + dataValidationError = executionTranslations.mustBeNumber(argName); + } else { + if (argDefinition.mustHaveValue === 'number-greater-than-zero') { + if (valueNumber <= 0) { + dataValidationError = executionTranslations.mustBeGreaterThanZero(argName); + } + } + } + + // If no errors, then update (mutate) the value so that correct + // format reaches the execution component + if (!dataValidationError) { + argInput[index] = valueNumber; + } + } + break; + } + + return !!dataValidationError; + }); + } + + if (dataValidationError) { + return updateStateWithNewCommandHistoryItem( + state, + createCommandHistoryEntry( + cloneCommandDefinitionWithNewRenderComponent(command, BadArgument), + + createCommandExecutionState({ + errorMessage: {dataValidationError}, + }), + false + ) + ); + } + } + + // Call validation callback if one was defined for the argument if (argDefinition.validate) { const validationResult = argDefinition.validate(argInput); @@ -392,13 +398,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandExecutionState({ errorMessage: ( - {i18n.translate( - 'xpack.securitySolution.console.commandValidation.invalidArgValue', - { - defaultMessage: 'Invalid argument value: {argName}. {error}', - values: { argName: toCliArgumentOption(argName), error: validationResult }, - } - )} + {executionTranslations.argValueValidatorError(argName, validationResult)} ), }), @@ -416,14 +416,9 @@ export const handleExecuteCommand: ConsoleStoreReducer< createCommandExecutionState({ errorMessage: ( - {i18n.translate('xpack.securitySolution.console.commandValidation.mustHaveArgs', { - defaultMessage: 'Missing required arguments: {requiredArgs}', - values: { - requiredArgs: requiredArgs - .map((argName) => toCliArgumentOption(argName)) - .join(', '), - }, - })} + {executionTranslations.missingArguments( + requiredArgs.map((argName) => toCliArgumentOption(argName)).join(', ') + )} ), }), @@ -448,11 +443,7 @@ export const handleExecuteCommand: ConsoleStoreReducer< cloneCommandDefinitionWithNewRenderComponent(command, BadArgument), createCommandExecutionState({ errorMessage: ( - - {i18n.translate('xpack.securitySolution.console.commandValidation.oneArgIsRequired', { - defaultMessage: 'At least one argument must be used', - })} - + {executionTranslations.MUST_HAVE_AT_LEAST_ONE_ARG} ), }), false diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_input_area_state.ts b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_input_area_state.ts index 092f74dc66ce1..e703d0f280480 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_input_area_state.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/handle_input_area_state.ts @@ -7,8 +7,14 @@ import { i18n } from '@kbn/i18n'; import { v4 as uuidV4 } from 'uuid'; -import { getCommandNameFromTextInput } from '../../../service/parsed_command_input'; -import type { ConsoleDataAction, ConsoleStoreReducer } from '../types'; +import type { ParsedCommandInterface } from '../../../service/types'; +import { parseCommandInput } from '../../../service/parsed_command_input'; +import type { + ConsoleDataAction, + ConsoleDataState, + ConsoleStoreReducer, + EnteredCommand, +} from '../types'; export const INPUT_DEFAULT_PLACEHOLDER_TEXT = i18n.translate( 'xpack.securitySolution.handleInputAreaState.inputPlaceholderText', @@ -17,6 +23,21 @@ export const INPUT_DEFAULT_PLACEHOLDER_TEXT = i18n.translate( } ); +const setArgSelectorValueToParsedArgs = ( + parsedInput: ParsedCommandInterface, + enteredCommand: EnteredCommand | undefined +) => { + if (enteredCommand && enteredCommand.argsWithValueSelectors) { + for (const argName of Object.keys(enteredCommand.argsWithValueSelectors)) { + if (parsedInput.hasArg(argName)) { + const argumentValues = enteredCommand.argState[argName] ?? []; + + parsedInput.args[argName] = argumentValues.map((itemState) => itemState.value); + } + } + } +}; + type InputAreaStateAction = ConsoleDataAction & { type: | 'updateInputPopoverState' @@ -24,7 +45,8 @@ type InputAreaStateAction = ConsoleDataAction & { | 'clearInputHistoryState' | 'updateInputTextEnteredState' | 'updateInputPlaceholderState' - | 'setInputState'; + | 'setInputState' + | 'updateInputCommandArgState'; }; export const handleInputAreaState: ConsoleStoreReducer = ( @@ -50,7 +72,14 @@ export const handleInputAreaState: ConsoleStoreReducer = ( input: { ...state.input, // Keeping the last 100 entries only for now - history: [{ id: uuidV4(), input: payload.command }, ...state.input.history.slice(0, 99)], + history: [ + { + id: uuidV4(), + input: payload.command, + display: payload.display ?? payload.command, + }, + ...state.input.history.slice(0, 99), + ], }, }; @@ -64,33 +93,70 @@ export const handleInputAreaState: ConsoleStoreReducer = ( }; case 'updateInputTextEnteredState': - const { textEntered: newTextEntered, rightOfCursor: newRightOfCursor = { text: '' } } = - typeof payload === 'function' - ? payload({ - textEntered: state.input.textEntered, - rightOfCursor: state.input.rightOfCursor, - }) - : payload; + const { + leftOfCursorText: newTextEntered, + rightOfCursorText: newRightOfCursor = '', + argState: adjustedArgState, + } = typeof payload === 'function' ? payload(state.input) : payload; if ( - state.input.textEntered !== newTextEntered || - state.input.rightOfCursor !== newRightOfCursor + state.input.leftOfCursorText !== newTextEntered || + state.input.rightOfCursorText !== newRightOfCursor ) { - const fullCommandText = newTextEntered + newRightOfCursor.text; - const commandEntered = - // If the user has typed a command (some text followed by at space), - // then parse it to get the command name. - fullCommandText.trimStart().indexOf(' ') !== -1 - ? getCommandNameFromTextInput(fullCommandText) - : ''; + const parsedInput = parseCommandInput(newTextEntered + newRightOfCursor); + + let enteredCommand: ConsoleDataState['input']['enteredCommand'] = + state.input.enteredCommand; + + if (enteredCommand && adjustedArgState && enteredCommand?.argState !== adjustedArgState) { + enteredCommand = { + ...enteredCommand, + argState: adjustedArgState, + }; + } + + // Determine if `enteredCommand` should be re-defined + if ( + (parsedInput.name && + (!enteredCommand || parsedInput.name !== enteredCommand.commandDefinition.name)) || + (!parsedInput.name && enteredCommand) + ) { + enteredCommand = undefined; + + const commandDefinition = state.commands.find((def) => def.name === parsedInput.name); + + if (commandDefinition) { + let argsWithValueSelectors: EnteredCommand['argsWithValueSelectors']; + + for (const [argName, argDef] of Object.entries(commandDefinition.args ?? {})) { + if (argDef.SelectorComponent) { + if (!argsWithValueSelectors) { + argsWithValueSelectors = {}; + } + + argsWithValueSelectors[argName] = argDef; + } + } + + enteredCommand = { + argState: {}, + commandDefinition, + argsWithValueSelectors, + }; + } + } + + // Update parsed input with any values that were selected via argument selectors + setArgSelectorValueToParsedArgs(parsedInput, enteredCommand); return { ...state, input: { ...state.input, - textEntered: newTextEntered, - rightOfCursor: newRightOfCursor, - commandEntered, + leftOfCursorText: newTextEntered, + rightOfCursorText: newRightOfCursor, + parsedInput, + enteredCommand, }, }; } @@ -119,6 +185,38 @@ export const handleInputAreaState: ConsoleStoreReducer = ( }; } break; + + case 'updateInputCommandArgState': + if (state.input.enteredCommand) { + const { name: argName, instance: argInstance, state: newArgState } = payload; + const updatedArgState = [...(state.input.enteredCommand.argState[argName] ?? [])]; + + updatedArgState[argInstance] = newArgState; + + const updatedEnteredCommand = { + ...state.input.enteredCommand, + argState: { + ...state.input.enteredCommand.argState, + [argName]: updatedArgState, + }, + }; + + // store a new version of parsed input that contains the updated selector value + const updatedParsedInput = parseCommandInput( + state.input.leftOfCursorText + state.input.rightOfCursorText + ); + setArgSelectorValueToParsedArgs(updatedParsedInput, updatedEnteredCommand); + + return { + ...state, + input: { + ...state.input, + parsedInput: updatedParsedInput, + enteredCommand: updatedEnteredCommand, + }, + }; + } + break; } // No updates needed. Just return original state diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/translations.tsx b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/translations.tsx new file mode 100644 index 0000000000000..5922a71ff368b --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/state_update_handlers/translations.tsx @@ -0,0 +1,131 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { i18n } from '@kbn/i18n'; +import type { ReactNode } from 'react'; +import React from 'react'; +import { FormattedMessage } from '@kbn/i18n-react'; +import { ConsoleCodeBlock } from '../../console_code_block'; + +export const executionTranslations = Object.freeze({ + mustHaveValue: (argName: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.mustHaveValue', { + defaultMessage: 'Argument --{argName} must have a value', + values: { argName }, + }); + }, + + mustBeNumber: (argName: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.mustBeNumber', { + defaultMessage: 'Argument --${argName} value must be a number', + values: { argName }, + }); + }, + + mustBeGreaterThanZero: (argName: string): string => { + return i18n.translate( + 'xpack.securitySolution.console.commandValidation.mustBeGreaterThanZero', + { + defaultMessage: 'Argument --{argName} value must be greater than zero', + values: { argName }, + } + ); + }, + + NO_ARGUMENTS_SUPPORTED: i18n.translate( + 'xpack.securitySolution.console.commandValidation.noArgumentsSupported', + { + defaultMessage: 'Command does not support any arguments', + } + ), + + missingRequiredArg: (argName: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.missingRequiredArg', { + defaultMessage: 'Missing required argument: --{argName}', + values: { + argName, + }, + }); + }, + + unsupportedArg: (argName: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.unsupportedArg', { + defaultMessage: 'Unsupported argument: --{argName}', + values: { argName }, + }); + }, + + noMultiplesAllowed: (argName: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.argSupportedOnlyOnce', { + defaultMessage: 'Argument can only be used once: --{argName}', + values: { argName }, + }); + }, + + argValueValidatorError: (argName: string, error: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.invalidArgValue', { + defaultMessage: 'Invalid argument value: --{argName}. {error}', + values: { argName, error }, + }); + }, + + missingArguments: (missingArgs: string): string => { + return i18n.translate('xpack.securitySolution.console.commandValidation.mustHaveArgs', { + defaultMessage: 'Missing required arguments: {missingArgs}', + values: { missingArgs }, + }); + }, + + MUST_HAVE_AT_LEAST_ONE_ARG: i18n.translate( + 'xpack.securitySolution.console.commandValidation.oneArgIsRequired', + { + defaultMessage: 'At least one argument must be used', + } + ), + + onlyOneFromExclusiveOr: (argNames: string): ReactNode => { + return ( + + + {argNames} + + ), + }} + /> + + ); + }, + + unknownArgument: (count: number, commandName: string, unknownArgs: string): ReactNode => { + return ( + + + {commandName} + + ), + unknownArgs: ( + + {unknownArgs} + + ), + }} + /> + + ); + }, +}); diff --git a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/types.ts b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/types.ts index 291f525196bba..67033eb09886a 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/components/console_state/types.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/components/console_state/types.ts @@ -5,9 +5,17 @@ * 2.0. */ +/* eslint-disable @typescript-eslint/no-explicit-any */ + import type { Dispatch, Reducer } from 'react'; +import type { ParsedCommandInterface } from '../../service/types'; import type { CommandInputProps } from '../command_input'; -import type { Command, CommandDefinition, CommandExecutionComponent } from '../../types'; +import type { + Command, + CommandDefinition, + CommandExecutionComponent, + CommandArgDefinition, +} from '../../types'; export interface ConsoleDataState { /** @@ -48,17 +56,22 @@ export interface ConsoleDataState { /** state for the command input area */ input: { /** - * The text the user is typing into the console input area. By default, this - * value goes into the left of the cursor position + * The left side of the cursor text entered by the user */ - textEntered: string; // FIXME:PT convert this to same structure as `rightOfCursor` + leftOfCursorText: string; - rightOfCursor: { - text: string; - }; + /** + * The right side of the cursor text entered by the user + */ + rightOfCursorText: string; + + /** + * The parsed user input + */ + parsedInput: ParsedCommandInterface; - /** The command name that was entered (derived from `textEntered` */ - commandEntered: string; + /** The entered command. Only defined if the command is "known" */ + enteredCommand: undefined | EnteredCommand; /** Placeholder text for the input area **/ placeholder: string; @@ -74,9 +87,36 @@ export interface ConsoleDataState { }; } +/** State that is provided/received to Argument Value Selectors */ +export interface ArgSelectorState { + value: any; + valueText: string | undefined; + /** + * A store (data) for the Argument Selector Component so that it can persist state between + * re-renders or between console being opened/closed + */ + store?: TState; +} + +export interface EnteredCommand { + commandDefinition: CommandDefinition; + + /** keeps a list of arguments definitions that are defined with a Value Selector component */ + argsWithValueSelectors: undefined | Record; + + argState: { + // Each arg has an array (just like the parsed input) and keeps the + // state that is provided to that instance of the argument on the input. + [argName: string]: ArgSelectorState[]; + }; +} + export interface InputHistoryItem { id: string; + /** The command that will be used internally if entry is selected again from the popup */ input: string; + /** The display value in the UI's input history popup */ + display: string; } export interface CommandHistoryItem { @@ -92,11 +132,20 @@ export interface CommandExecutionState { store: Record; } +export interface ExecuteCommandPayload { + input: string; + parsedInput: ParsedCommandInterface; + enteredCommand: ConsoleDataState['input']['enteredCommand']; +} + export type ConsoleDataAction = | { type: 'scrollDown' } | { type: 'addFocusToKeyCapture' } | { type: 'removeFocusFromKeyCapture' } - | { type: 'executeCommand'; payload: { input: string } } + | { + type: 'executeCommand'; + payload: ExecuteCommandPayload; + } | { type: 'clear' } | { type: 'showSidePanel'; @@ -119,11 +168,13 @@ export type ConsoleDataAction = } | { type: 'updateInputTextEnteredState'; - payload: PayloadValueOrFunction<{ - textEntered: string; - /** When omitted, the right side of the cursor value will be blanked out */ - rightOfCursor?: ConsoleDataState['input']['rightOfCursor']; - }>; + payload: PayloadValueOrFunction< + Pick & { + /** updates (if necessary) to any of the argument's state */ + argState?: Record; + }, + ConsoleDataState['input'] + >; } | { type: 'updateInputPopoverState'; @@ -146,7 +197,21 @@ export type ConsoleDataAction = | { type: 'updateInputHistoryState'; payload: { + /** The command that will be used internally if entry is selected again from the popup */ command: string; + /** The display value in the UI's input history popup. Defaults to `command` */ + display?: string; + }; + } + | { + type: 'updateInputCommandArgState'; + payload: { + /** Name of argument */ + name: string; + /** Instance of the argument */ + instance: number; + /** The updated state for the argument */ + state: ArgSelectorState; }; } | { @@ -154,7 +219,9 @@ export type ConsoleDataAction = payload?: never; }; -type PayloadValueOrFunction = T | ((options: Required) => T); +type PayloadValueOrFunction = + | T + | ((options: TCallbackArgs) => T); export interface ConsoleStore { state: ConsoleDataState; diff --git a/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_command_argument_state.ts b/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_command_argument_state.ts new file mode 100644 index 0000000000000..e7b602d07c405 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_command_argument_state.ts @@ -0,0 +1,34 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { useMemo } from 'react'; +import { useConsoleStore } from '../../components/console_state/console_state'; +import type { ArgSelectorState } from '../../components/console_state/types'; + +/** + * Returns the Command argument state for a given argument name. Should be used ONLY when a + * command has been entered that matches a `CommandDefinition` + * @param argName + * @param instance + */ +export const useWithCommandArgumentState = ( + argName: string, + instance: number +): ArgSelectorState => { + const enteredCommand = useConsoleStore().state.input.enteredCommand; + + return useMemo(() => { + const argInstanceState = enteredCommand?.argState[argName]?.at(instance); + + return ( + argInstanceState ?? { + value: undefined, + valueText: '', + } + ); + }, [argName, enteredCommand, instance]); +}; diff --git a/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_command_entered.ts b/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_command_entered.ts index 827163aa32833..3833ae4a5f3d9 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_command_entered.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_command_entered.ts @@ -6,8 +6,13 @@ */ import { useConsoleStore } from '../../components/console_state/console_state'; -import type { ConsoleDataState } from '../../components/console_state/types'; -export const useWithInputCommandEntered = (): ConsoleDataState['input']['commandEntered'] => { - return useConsoleStore().state.input.commandEntered; +/** + * Retrieves the command name from the text the user entered. Will only return a value if a space + * has been entered, which is the trigger to being able to actually parse out the command name + */ +export const useWithInputCommandEntered = (): string => { + const parsedInput = useConsoleStore().state.input.parsedInput; + + return parsedInput.input.trimStart().indexOf(' ') !== -1 ? parsedInput.name : ''; }; diff --git a/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_text_entered.ts b/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_text_entered.ts index 61164ed1f8421..b5bbd1cbe9415 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_text_entered.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/hooks/state_selectors/use_with_input_text_entered.ts @@ -9,18 +9,24 @@ import { useMemo } from 'react'; import { useConsoleStore } from '../../components/console_state/console_state'; import type { ConsoleDataState } from '../../components/console_state/types'; -type InputTextEntered = Pick & { +type InputTextEntered = Pick< + ConsoleDataState['input'], + 'leftOfCursorText' | 'rightOfCursorText' | 'parsedInput' | 'enteredCommand' +> & { fullTextEntered: string; }; export const useWithInputTextEntered = (): InputTextEntered => { - const inputState = useConsoleStore().state.input; + const { leftOfCursorText, rightOfCursorText, parsedInput, enteredCommand } = + useConsoleStore().state.input; return useMemo(() => { return { - textEntered: inputState.textEntered, - rightOfCursor: inputState.rightOfCursor, - fullTextEntered: inputState.textEntered + inputState.rightOfCursor.text, + leftOfCursorText, + rightOfCursorText, + parsedInput, + enteredCommand, + fullTextEntered: leftOfCursorText + rightOfCursorText, }; - }, [inputState.rightOfCursor, inputState.textEntered]); + }, [enteredCommand, leftOfCursorText, parsedInput, rightOfCursorText]); }; diff --git a/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx b/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx index ef550605714e1..b50e5ff108512 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx +++ b/x-pack/plugins/security_solution/public/management/components/console/mocks.tsx @@ -7,12 +7,17 @@ /* eslint-disable import/no-extraneous-dependencies */ -import React, { useEffect } from 'react'; +import React, { memo, useEffect } from 'react'; import { EuiCode } from '@elastic/eui'; import userEvent from '@testing-library/user-event'; import { act } from '@testing-library/react'; import { Console } from './console'; -import type { ConsoleProps, CommandDefinition, CommandExecutionComponent } from './types'; +import type { + ConsoleProps, + CommandDefinition, + CommandExecutionComponent, + CommandArgumentValueSelectorProps, +} from './types'; import type { AppContextTestRender } from '../../../common/mock/endpoint'; import { createAppRootMockRenderer } from '../../../common/mock/endpoint'; @@ -236,7 +241,35 @@ export const getCommandListMock = (): CommandDefinition[] => { }, }, }, + { + name: 'cmd7', + about: 'Command with argument selector', + RenderComponent: jest.fn(RenderComponent), + args: { + foo: { + about: 'foo stuff', + required: true, + allowMultiples: true, + SelectorComponent: ArgumentSelectorComponentMock, + }, + }, + }, ]; return commands; }; + +export const ArgumentSelectorComponentMock = memo< + CommandArgumentValueSelectorProps<{ selection: string }> +>(({ value, valueText, onChange, argName, argIndex }) => { + useEffect(() => { + if (!value) { + onChange({ valueText: 'foo selected', value: { selection: 'foo' } }); + } + }, [onChange, value]); + + return ( + {`${argName}[${argIndex}]: ${valueText}`} + ); +}); +ArgumentSelectorComponentMock.displayName = 'ArgumentSelectorComponentMock'; diff --git a/x-pack/plugins/security_solution/public/management/components/console/service/parse_command_input.test.ts b/x-pack/plugins/security_solution/public/management/components/console/service/parse_command_input.test.ts index a4d3a983041fd..c976df72259e6 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/service/parse_command_input.test.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/service/parse_command_input.test.ts @@ -5,8 +5,8 @@ * 2.0. */ -import type { ParsedCommandInterface } from './parsed_command_input'; import { parseCommandInput } from './parsed_command_input'; +import type { ParsedCommandInterface } from './types'; describe('when using parsed command input utils', () => { describe('when using parseCommandInput()', () => { diff --git a/x-pack/plugins/security_solution/public/management/components/console/service/parsed_command_input.ts b/x-pack/plugins/security_solution/public/management/components/console/service/parsed_command_input.ts index 78ab197ebd227..65c2f5daadc24 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/service/parsed_command_input.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/service/parsed_command_input.ts @@ -5,22 +5,9 @@ * 2.0. */ -/* eslint-disable @typescript-eslint/no-explicit-any */ - +import type { ParsedCommandInput, ParsedCommandInterface } from './types'; import type { CommandDefinition } from '..'; -export type PossibleArgDataTypes = string | boolean; - -export type ParsedArgData = Array< - T extends PossibleArgDataTypes ? T : never ->; - -interface ParsedCommandInput { - name: string; - args: { - [key in keyof TArgs]: ParsedArgData[key]>; - }; -} const parseInputString = (rawInput: string): ParsedCommandInput => { const input = rawInput.trim(); const response: ParsedCommandInput = { @@ -89,22 +76,6 @@ const parseInputString = (rawInput: string): ParsedCommandInput => { return response; }; -export interface ParsedCommandInterface - extends ParsedCommandInput { - input: string; - - /** - * Checks if the given argument name was entered by the user - * @param argName - */ - hasArg(argName: string): boolean; - - /** - * if any argument was entered - */ - hasArgs: boolean; -} - class ParsedCommand implements ParsedCommandInterface { public readonly name: string; public readonly args: Record; diff --git a/x-pack/plugins/security_solution/public/management/components/console/service/types.ts b/x-pack/plugins/security_solution/public/management/components/console/service/types.ts new file mode 100644 index 0000000000000..18f1e2bbae1b1 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console/service/types.ts @@ -0,0 +1,36 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +/* eslint-disable @typescript-eslint/no-explicit-any */ + +export type PossibleArgDataTypes = string | boolean; +export type ParsedArgData = Array< + T extends PossibleArgDataTypes ? T : never +>; + +export interface ParsedCommandInput { + name: string; + args: { + [key in keyof TArgs]: ParsedArgData[key]>; + }; +} + +export interface ParsedCommandInterface + extends ParsedCommandInput { + input: string; + + /** + * Checks if the given argument name was entered by the user + * @param argName + */ + hasArg(argName: string): boolean; + + /** + * if any argument was entered + */ + hasArgs: boolean; +} diff --git a/x-pack/plugins/security_solution/public/management/components/console/types.ts b/x-pack/plugins/security_solution/public/management/components/console/types.ts index 9102d77d66d09..30f8880486907 100644 --- a/x-pack/plugins/security_solution/public/management/components/console/types.ts +++ b/x-pack/plugins/security_solution/public/management/components/console/types.ts @@ -9,41 +9,69 @@ import type { ComponentType, ReactNode } from 'react'; import type { CommonProps } from '@elastic/eui'; +import type { ParsedArgData, ParsedCommandInterface, PossibleArgDataTypes } from './service/types'; import type { CommandExecutionResultComponent } from './components/command_execution_result'; -import type { CommandExecutionState } from './components/console_state/types'; +import type { CommandExecutionState, ArgSelectorState } from './components/console_state/types'; import type { Immutable, MaybeImmutable } from '../../../../common/endpoint/types'; -import type { - ParsedArgData, - ParsedCommandInterface, - PossibleArgDataTypes, -} from './service/parsed_command_input'; +/** + * Definition interface for a Command argument + */ +export interface CommandArgDefinition { + /** + * If the argument is required to be entered by the user. NOTE that this will only validate that + * the user has entered the argument name - it does not validate that the argument must have a + * value. Arguments that have no value entered by the user have (by default) a value of + * `true` boolean. + */ + required: boolean; + allowMultiples: boolean; + about: string; + /** + * If argument (when used) should have a value defined by the user. + * Default is `false` which mean that argument can be entered without any value - internally the + * value for the argument will be a boolean `true`. + * When set to `true` the argument is expected to have a value that is non-boolean + * In addition, the following options can be used with this parameter to further validate the user's input: + * + * - `non-empty-string`: user's value must be a string whose length is greater than zero. Note that + * the value entered will first be `trim()`'d. + * - `number`: user's value will be converted to a Number and ensured to be a `safe integer` + * - `number-greater-than-zero`: user's value must be a number greater than zero + */ + mustHaveValue?: boolean | 'non-empty-string' | 'number' | 'number-greater-than-zero'; + exclusiveOr?: boolean; + /** + * Validate the individual values given to this argument. + * Should return `true` if valid or a string with the error message + */ + validate?: (argData: ParsedArgData) => true | string; + + /** + * If defined, the provided Component will be rendered in place of this argument's value and + * it will be up to the Selector to provide the desired interface to the user for selecting + * the argument's value. + */ + SelectorComponent?: CommandArgumentValueSelectorComponent; +} + +/** List of arguments for a Command */ export interface CommandArgs { - [longName: string]: { - required: boolean; - allowMultiples: boolean; - exclusiveOr?: boolean; - about: string; - /** - * Validate the individual values given to this argument. - * Should return `true` if valid or a string with the error message - */ - validate?: (argData: ParsedArgData) => true | string; - - // Selector: Idea is that the schema can plugin in a rich component for the - // user to select something (ex. a file) - // FIXME: implement selector - selector?: ComponentType; - }; + [longName: string]: CommandArgDefinition; } export interface CommandDefinition { + /** Name of the command. This will be the value that the user will enter on the console to access this command */ name: string; + + /** Some information about the command */ about: ReactNode; + /** * The Component that will be used to render the Command */ RenderComponent: CommandExecutionComponent; + /** Will be used to sort the commands when building the output for the `help` command */ helpCommandPosition?: number; @@ -57,14 +85,17 @@ export interface CommandDefinition { * the console's built in output. */ HelpComponent?: CommandExecutionComponent; + /** * If defined, the button to add to the text bar will be disabled and the user will not be able to use this command if entered into the console. */ helpDisabled?: boolean; + /** * If defined, the command will be hidden from in the Help menu and help text. It will warn the user and not execute the command if manually typed in. */ helpHidden?: boolean; + /** * A store for any data needed when the command is executed. * The entire `CommandDefinition` is passed along to the component @@ -116,6 +147,11 @@ export interface Command< > { /** The raw input entered by the user */ input: string; + /** + * The input value for display on the UI. This could differ from + * `input` when Argument Value Selectors were used. + */ + inputDisplay: string; /** An object with the arguments entered by the user and their value */ args: ParsedCommandInterface; /** The command definition associated with this user command */ @@ -177,6 +213,55 @@ export type CommandExecutionComponent< TMeta = any > = ComponentType>; +/** + * The component props for an argument `SelectorComponent` + */ +export interface CommandArgumentValueSelectorProps { + /** + * The current value that was selected. This will not be displayed in the UI, but will + * be passed on to the command execution as part of the argument's value + */ + value: TSelection | undefined; + + /** + * A string value for display purposes only that describes the selected value. This + * will be used when the command is entered and displayed in the console as well as in + * the command input history popover + */ + valueText: string; + + /** + * The name of the Argument + */ + argName: string; + + /** + * The index (zero based) of the argument in the current command. This is a zero-based number indicating + * which instance of the argument is being rendered. + */ + argIndex: number; + + /** + * A store for the Argument Selector. Should be used for any component state that needs to be + * persisted across re-renders by the console. + */ + store: TState; + + /** + * callback for the Value Selector to call and provide the selection value. + * This selection value will then be passed along with the argument to the command execution + * component. + * @param newData + */ + onChange: (newData: ArgSelectorState) => void; +} + +/** + * Component for rendering an argument's value selector + */ +export type CommandArgumentValueSelectorComponent = + ComponentType; + export interface ConsoleProps extends CommonProps { /** * The list of Commands that will be available in the console for the user to execute diff --git a/x-pack/plugins/security_solution/public/management/components/console_argument_selectors/file_selector.tsx b/x-pack/plugins/security_solution/public/management/components/console_argument_selectors/file_selector.tsx new file mode 100644 index 0000000000000..4dda91f2ab232 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/console_argument_selectors/file_selector.tsx @@ -0,0 +1,131 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import React, { memo, useCallback, useMemo } from 'react'; +import { + EuiButtonIcon, + EuiFilePicker, + EuiFlexGroup, + EuiFlexItem, + EuiPopover, + htmlIdGenerator, +} from '@elastic/eui'; +import type { EuiFilePickerProps } from '@elastic/eui/src/components/form/file_picker/file_picker'; +import { i18n } from '@kbn/i18n'; +import type { CommandArgumentValueSelectorProps } from '../console/types'; + +const INITIAL_DISPLAY_LABEL = i18n.translate( + 'xpack.securitySolution.consoleArgumentSelectors.fileSelector.initialDisplayLabel', + { defaultMessage: 'Click to select file' } +); + +const OPEN_FILE_PICKER_LABEL = i18n.translate( + 'xpack.securitySolution.consoleArgumentSelectors.fileSelector.filePickerButtonLabel', + { defaultMessage: 'Open file picker' } +); + +const NO_FILE_SELECTED = i18n.translate( + 'xpack.securitySolution.consoleArgumentSelectors.fileSelector.noFileSelected', + { defaultMessage: 'No file selected' } +); + +interface ArgumentFileSelectorState { + isPopoverOpen: boolean; +} + +/** + * A Console Argument Selector component that enables the user to select a file from the local machine + */ +export const ArgumentFileSelector = memo< + CommandArgumentValueSelectorProps +>(({ value, valueText, onChange, store: _store }) => { + const state = useMemo(() => { + return _store ?? { isPopoverOpen: true }; + }, [_store]); + + const setIsPopoverOpen = useCallback( + (newValue: boolean) => { + onChange({ + value, + valueText, + store: { + ...state, + isPopoverOpen: newValue, + }, + }); + }, + [onChange, state, value, valueText] + ); + + const filePickerUUID = useMemo(() => { + return htmlIdGenerator('console')(); + }, []); + + const handleOpenPopover = useCallback(() => { + setIsPopoverOpen(true); + }, [setIsPopoverOpen]); + + const handleClosePopover = useCallback(() => { + setIsPopoverOpen(false); + }, [setIsPopoverOpen]); + + const handleFileSelection: EuiFilePickerProps['onChange'] = useCallback( + (selectedFiles) => { + // Get only the first file selected + const file = selectedFiles?.item(0); + + onChange({ + value: file ?? undefined, + valueText: file ? file.name : '', + store: { + ...state, + isPopoverOpen: false, + }, + }); + }, + [onChange, state] + ); + + return ( +
    + + +
    + {valueText || INITIAL_DISPLAY_LABEL} +
    +     + + + + + } + > + {state.isPopoverOpen && ( + + )} +     +
    + ); +}); +ArgumentFileSelector.displayName = 'ArgumentFileSelector'; diff --git a/x-pack/test/saved_object_tagging/functional/tests/constants.ts b/x-pack/plugins/security_solution/public/management/components/console_argument_selectors/index.ts similarity index 70% rename from x-pack/test/saved_object_tagging/functional/tests/constants.ts rename to x-pack/plugins/security_solution/public/management/components/console_argument_selectors/index.ts index 7c5a441e2cefe..515352120b171 100644 --- a/x-pack/test/saved_object_tagging/functional/tests/constants.ts +++ b/x-pack/plugins/security_solution/public/management/components/console_argument_selectors/index.ts @@ -4,6 +4,4 @@ * 2.0; you may not use this file except in compliance with the Elastic License * 2.0. */ - -export const TAGFILTER_DROPDOWN_SELECTOR = - '.euiFilterGroup .euiPopover:nth-child(2) .euiFilterButton'; +export * from './file_selector'; diff --git a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts index b4068c95d1407..1c57fb6401ec6 100644 --- a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts +++ b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts @@ -6,6 +6,8 @@ */ import { i18n } from '@kbn/i18n'; +import type { ParsedArgData } from '../../console/service/types'; +import { getUploadCommand } from './dev_only'; import { ExperimentalFeaturesService } from '../../../../common/experimental_features_service'; import type { EndpointCapabilities, @@ -19,7 +21,6 @@ import { KillProcessActionResult } from '../command_render_components/kill_proce import { SuspendProcessActionResult } from '../command_render_components/suspend_process_action'; import { EndpointStatusActionResult } from '../command_render_components/status_action'; import { GetProcessesActionResult } from '../command_render_components/get_processes_action'; -import type { ParsedArgData } from '../../console/service/parsed_command_input'; import type { EndpointPrivileges, ImmutableArray } from '../../../../../common/endpoint/types'; import { INSUFFICIENT_PRIVILEGES_FOR_COMMAND, @@ -370,6 +371,14 @@ export const getEndpointConsoleCommands = ({ }, ]; + // FIXME: DELETE PRIOR TO MERGE + // for dev purposes only - command only shown if url has `show_upload=` + if (location.search.includes('show_upload=')) { + consoleCommands.push( + getUploadCommand({ endpointAgentId, endpointPrivileges, endpointCapabilities }) + ); + } + // `get-file` is currently behind feature flag if (isGetFileEnabled) { consoleCommands.push({ diff --git a/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx new file mode 100644 index 0000000000000..6ec6cdf801092 --- /dev/null +++ b/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/dev_only.tsx @@ -0,0 +1,111 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +/* eslint-disable @typescript-eslint/no-explicit-any */ + +import React, { memo, useEffect } from 'react'; +import type { CommandArgumentValueSelectorProps } from '../../console/types'; +import type { CommandDefinition } from '../../console'; +import { ArgumentFileSelector } from '../../console_argument_selectors'; + +// FOR DEV PURPOSES ONLY. WILL BE DELETED PRIOR TO MERGE +// FIXME:PT DELETE FILE +export const getUploadCommand = ({ + endpointAgentId, + endpointPrivileges, + endpointCapabilities, +}: { + endpointAgentId: string; + endpointCapabilities: any; + endpointPrivileges: any; +}): CommandDefinition => { + return { + name: 'upload', + about: 'Upload and execute a file on host machine', + RenderComponent: (props) => { + window.console.log(`upload command rendering...`); + window.console.log(props); + + return ( +
    +
    {`ExecuteFileAction DEV MOCK`}
    +
    + {`File Selected: ${props.command.args.args.file[0].name}`} +
    +
    + ); + }, + meta: { + endpointId: endpointAgentId, + capabilities: endpointCapabilities, + privileges: endpointPrivileges, + }, + exampleUsage: 'some example goes here', + exampleInstruction: 'some instructions here', + args: { + file: { + about: 'Select the file that should be uploaded and executed', + required: true, + allowMultiples: false, + mustHaveValue: true, + validate: () => { + // FIXME:PT Validate File was selected + return true; + }, + SelectorComponent: ArgumentFileSelector, + }, + + n: { + required: false, + allowMultiples: true, + mustHaveValue: 'number-greater-than-zero', + about: 'just a number greater than zero', + }, + + nn: { + required: false, + allowMultiples: true, + mustHaveValue: 'number', + about: 'just a number', + }, + + mock: { + required: false, + allowMultiples: false, + about: 'using a selector', + SelectorComponent: ArgumentSelectorComponentTest, + }, + + comment: { + required: false, + allowMultiples: false, + mustHaveValue: 'non-empty-string', + about: 'A comment', + }, + }, + helpGroupLabel: 'DEV', + helpGroupPosition: 0, + helpCommandPosition: 0, + }; +}; + +const ArgumentSelectorComponentTest = memo< + CommandArgumentValueSelectorProps<{ selection: string }> +>(({ value, valueText, onChange, argIndex, argName }) => { + useEffect(() => { + if (!value) { + onChange({ valueText: 'foo selected', value: { selection: 'foo' } }); + } + }, [onChange, value]); + + return ( + {`${argName}[${argIndex}]: ${valueText}`} + ); +}); +ArgumentSelectorComponentTest.displayName = 'ArgumentSelectorComponentTest'; + +document.body.classList.add('style2'); diff --git a/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/index.ts index 5daba7f613fa9..86c43ce2f2a43 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/index.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/agent_emulator/index.ts @@ -22,8 +22,8 @@ export const cli = () => { string: ['kibana', 'elastic', 'username', 'password'], boolean: ['asSuperuser'], default: { - kibana: 'http://localhost:5601', - elasticsearch: 'http://localhost:9200', + kibana: 'http://127.0.0.1:5601', + elasticsearch: 'http://127.0.0.1:9200', username: 'elastic', password: 'changeme', asSuperuser: false, @@ -39,8 +39,8 @@ export const cli = () => { --asSuperuser If defined, then a Security super user will be created using the the credentials defined via 'username' and 'password' options. This new user will then be used to run this utility. - --kibana The url to Kibana (Default: http://localhost:5601) - --elasticsearch The url to Elasticsearch (Default: http://localhost:9200) + --kibana The url to Kibana (Default: http://127.0.0.1:5601) + --elasticsearch The url to Elasticsearch (Default: http://127.0.0.1:9200) --checkinInterval The interval between how often the Agent is checked into fleet and a metadata document update is sent for the endpoint. Default is 1 minute --actionDelay The delay (in milliseconds) that should be applied before responding diff --git a/x-pack/plugins/security_solution/scripts/endpoint/blocklists/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/blocklists/index.ts index 77c6b164a4698..f56149ac9f7ca 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/blocklists/index.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/blocklists/index.ts @@ -40,11 +40,11 @@ export const cli = () => { string: ['kibana'], default: { count: 10, - kibana: 'http://elastic:changeme@localhost:5601', + kibana: 'http://elastic:changeme@127.0.0.1:5601', }, help: ` --count Number of blocklists to create. Default: 10 - --kibana The URL to kibana including credentials. Default: http://elastic:changeme@localhost:5601 + --kibana The URL to kibana including credentials. Default: http://elastic:changeme@127.0.0.1:5601 `, }, } diff --git a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_policies/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_policies/index.ts index 6d5d1dcd63b33..5367a606f66bd 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/endpoint_policies/index.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/endpoint_policies/index.ts @@ -53,11 +53,11 @@ export const cli = () => { string: ['kibana'], default: { count: 15, - kibana: 'http://elastic:changeme@localhost:5601', + kibana: 'http://elastic:changeme@127.0.0.1:5601', }, help: ` --count Number of Endpoint Policies to create. Default: 15 - --kibana The URL to kibana including credentials. Default: http://elastic:changeme@localhost:5601 + --kibana The URL to kibana including credentials. Default: http://elastic:changeme@127.0.0.1:5601 `, }, } diff --git a/x-pack/plugins/security_solution/scripts/endpoint/event_filters/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/event_filters/index.ts index 76cfdc11bde4e..a06af8d60f1e0 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/event_filters/index.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/event_filters/index.ts @@ -44,11 +44,11 @@ export const cli = () => { string: ['kibana'], default: { count: 10, - kibana: 'http://elastic:changeme@localhost:5601', + kibana: 'http://elastic:changeme@127.0.0.1:5601', }, help: ` --count Number of event filters to create. Default: 10 - --kibana The URL to kibana including credentials. Default: http://elastic:changeme@localhost:5601 + --kibana The URL to kibana including credentials. Default: http://elastic:changeme@127.0.0.1:5601 `, }, } diff --git a/x-pack/plugins/security_solution/scripts/endpoint/host_isolation_exceptions/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/host_isolation_exceptions/index.ts index 246f3e16ef78c..d0ba1c0fb2762 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/host_isolation_exceptions/index.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/host_isolation_exceptions/index.ts @@ -38,11 +38,11 @@ export const cli = () => { string: ['kibana'], default: { count: 10, - kibana: 'http://elastic:changeme@localhost:5601', + kibana: 'http://elastic:changeme@127.0.0.1:5601', }, help: ` --count Number of host isolation exceptions to create. Default: 10 - --kibana The URL to kibana including credentials. Default: http://elastic:changeme@localhost:5601 + --kibana The URL to kibana including credentials. Default: http://elastic:changeme@127.0.0.1:5601 `, }, } diff --git a/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts index 6c8eab6f8cffc..b944835e0c8da 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/resolver_generator_script.ts @@ -170,13 +170,13 @@ async function main() { node: { alias: 'n', describe: 'elasticsearch node url', - default: 'http://elastic:changeme@localhost:9200', + default: 'http://elastic:changeme@127.0.0.1:9200', type: 'string', }, kibana: { alias: 'k', describe: 'kibana url', - default: 'http://elastic:changeme@localhost:5601', + default: 'http://elastic:changeme@127.0.0.1:5601', type: 'string', }, eventIndex: { diff --git a/x-pack/plugins/security_solution/scripts/endpoint/trusted_apps/index.ts b/x-pack/plugins/security_solution/scripts/endpoint/trusted_apps/index.ts index f1da0eda44962..ccd0561c8110a 100644 --- a/x-pack/plugins/security_solution/scripts/endpoint/trusted_apps/index.ts +++ b/x-pack/plugins/security_solution/scripts/endpoint/trusted_apps/index.ts @@ -33,7 +33,7 @@ export const cli = async () => { string: ['kibana'], default: { count: 10, - kibana: 'http://elastic:changeme@localhost:5601', + kibana: 'http://elastic:changeme@127.0.0.1:5601', }, }; const options: RunOptions = minimist(process.argv.slice(2), cliDefaults); @@ -70,7 +70,7 @@ interface RunOptions { } export const run: (options?: RunOptions) => Promise = async ({ count = 10, - kibana = 'http://elastic:changeme@localhost:5601', + kibana = 'http://elastic:changeme@127.0.0.1:5601', logger = defaultLogger, }: RunOptions = {}) => { const kbnClient = new KbnClient({ diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts index 697b993d64539..7c3ded7fdc921 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.test.ts @@ -534,6 +534,61 @@ describe('create_signals', () => { }); }); + test('it respects overriderBody params', () => { + const query = buildEventsSearchQuery({ + index: ['auditbeat-*'], + from: 'now-5m', + to: 'today', + filter: {}, + size: 100, + searchAfterSortIds: undefined, + primaryTimestamp: '@timestamp', + secondaryTimestamp: undefined, + runtimeMappings: undefined, + overrideBody: { + _source: false, + fields: ['@timestamp'], + }, + }); + expect(query).toEqual({ + allow_no_indices: true, + index: ['auditbeat-*'], + size: 100, + runtime_mappings: undefined, + track_total_hits: undefined, + ignore_unavailable: true, + body: { + query: { + bool: { + filter: [ + {}, + { + range: { + '@timestamp': { + gte: 'now-5m', + lte: 'today', + format: 'strict_date_optional_time', + }, + }, + }, + ], + }, + }, + _source: false, + fields: ['@timestamp'], + runtime_mappings: undefined, + sort: [ + { + '@timestamp': { + order: 'asc', + unmapped_type: 'date', + }, + }, + ], + }, + }); + }); + describe('buildEqlSearchRequest', () => { test('should build a basic request with time range', () => { const request = buildEqlSearchRequest({ diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts index 001550ec3671e..a04e27c1f8837 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts @@ -7,6 +7,7 @@ import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import { isEmpty } from 'lodash'; import type { Filter } from '@kbn/es-query'; +import type { OverrideBodyQuery } from './types'; import type { RuleFilterArray, TimestampOverride, @@ -27,6 +28,7 @@ interface BuildEventsSearchQuery { secondaryTimestamp: TimestampOverride | undefined; trackTotalHits?: boolean; additionalFilters?: estypes.QueryDslQueryContainer[]; + overrideBody?: OverrideBodyQuery; } interface BuildEqlSearchRequestParams { @@ -132,6 +134,7 @@ export const buildEventsSearchQuery = ({ secondaryTimestamp, trackTotalHits, additionalFilters, + overrideBody, }: BuildEventsSearchQuery) => { const timestamps = secondaryTimestamp ? [primaryTimestamp, secondaryTimestamp] @@ -193,6 +196,7 @@ export const buildEventsSearchQuery = ({ ...(aggregations ? { aggregations } : {}), runtime_mappings: runtimeMappings, sort, + ...overrideBody, }, }; diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/ml.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/ml.ts index b7cb97f906bf0..9cd7a6bce13dc 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/ml.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/executors/ml.ts @@ -80,6 +80,7 @@ export const mlExecutor = async ({ ...jobSummaries.map((job) => [ `job id: "${job.id}"`, + `job name: "${job?.customSettings?.security_app_display_name ?? job.id}"`, `job status: "${job.jobState}"`, `datafeed status: "${job.datafeedState}"`, ].join(', ') diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.test.ts index 28b00e45dd5a3..7b4e1b8ecf00a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.test.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.test.ts @@ -14,6 +14,10 @@ import type { RuleExecutorServicesMock } from '@kbn/alerting-plugin/server/mocks import { alertsMock } from '@kbn/alerting-plugin/server/mocks'; import { elasticsearchClientMock } from '@kbn/core-elasticsearch-client-server-mocks'; import { ruleExecutionLogMock } from '../rule_monitoring/mocks'; +import { buildEventsSearchQuery } from './build_events_query'; + +jest.mock('./build_events_query'); +const mockBuildEventsSearchQuery = buildEventsSearchQuery as jest.Mock; describe('singleSearchAfter', () => { const mockService: RuleExecutorServicesMock = alertsMock.createRuleExecutorServices(); @@ -157,4 +161,47 @@ describe('singleSearchAfter', () => { }) ).rejects.toThrow('Fake Error'); }); + + test('singleSearchAfter passes overrideBody to buildEventsSearchQuery', async () => { + mockService.scopedClusterClient.asCurrentUser.search.mockResolvedValueOnce( + elasticsearchClientMock.createSuccessTransportRequestPromise(sampleDocSearchResultsNoSortId()) + ); + await singleSearchAfter({ + searchAfterSortIds: undefined, + index: [], + from: 'now-360s', + to: 'now', + services: mockService, + ruleExecutionLogger, + pageSize: 1, + filter: {}, + primaryTimestamp: '@timestamp', + secondaryTimestamp: undefined, + runtimeMappings: undefined, + overrideBody: { + _source: false, + fields: ['@timestamp'], + }, + }); + + expect(mockBuildEventsSearchQuery).toHaveBeenCalledWith({ + additionalFilters: undefined, + aggregations: undefined, + filter: {}, + from: 'now-360s', + index: [], + primaryTimestamp: '@timestamp', + runtimeMappings: undefined, + searchAfterSortIds: undefined, + secondaryTimestamp: undefined, + size: 1, + sortOrder: undefined, + to: 'now', + trackTotalHits: undefined, + overrideBody: { + _source: false, + fields: ['@timestamp'], + }, + }); + }); }); diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.ts index e1ef6e5867859..84f8fcf94af64 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/single_search_after.ts @@ -11,7 +11,7 @@ import type { AlertInstanceState, RuleExecutorServices, } from '@kbn/alerting-plugin/server'; -import type { SignalSearchResponse, SignalSource } from './types'; +import type { SignalSearchResponse, SignalSource, OverrideBodyQuery } from './types'; import { buildEventsSearchQuery } from './build_events_query'; import { createErrorsFromShard, makeFloatString } from './utils'; import type { TimestampOverride } from '../../../../common/detection_engine/rule_schema'; @@ -34,6 +34,7 @@ interface SingleSearchAfterParams { trackTotalHits?: boolean; runtimeMappings: estypes.MappingRuntimeFields | undefined; additionalFilters?: estypes.QueryDslQueryContainer[]; + overrideBody?: OverrideBodyQuery; } // utilize search_after for paging results into bulk. @@ -55,6 +56,7 @@ export const singleSearchAfter = async < secondaryTimestamp, trackTotalHits, additionalFilters, + overrideBody, }: SingleSearchAfterParams): Promise<{ searchResult: SignalSearchResponse; searchDuration: string; @@ -76,6 +78,11 @@ export const singleSearchAfter = async < secondaryTimestamp, trackTotalHits, additionalFilters, + /** + * overrideBody allows the search after to ignore the _source property of the result, + * thus reducing the size of the response and increasing the performance of the query. + */ + overrideBody, }); const start = performance.now(); diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts index 0ab6ec2a01dda..2bdd9533f1ea0 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/create_threat_signals.ts @@ -124,6 +124,11 @@ export const createThreatSignals = async ({ _source: false, }; + const eventListConfig = { + fields: threatMapping.map((mapping) => mapping.entries.map((item) => item.field)).flat(), + _source: false, + }; + const threatEnrichment = buildThreatEnrichment({ ruleExecutionLogger, services, @@ -197,6 +202,7 @@ export const createThreatSignals = async ({ primaryTimestamp, secondaryTimestamp, exceptionFilter, + eventListConfig, }), createSignal: (slicedChunk) => diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts index 21d13ec421858..32c2f00af64ed 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/get_event_count.ts @@ -27,6 +27,7 @@ export const getEventList = async ({ secondaryTimestamp, runtimeMappings, exceptionFilter, + eventListConfig, }: EventsOptions): Promise> => { const calculatedPerPage = perPage ?? MAX_PER_PAGE; if (calculatedPerPage > 10000) { @@ -59,6 +60,7 @@ export const getEventList = async ({ sortOrder: 'desc', trackTotalHits: false, runtimeMappings, + overrideBody: eventListConfig, }); ruleExecutionLogger.debug(`Retrieved events items of size: ${searchResult.hits.hits.length}`); diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/types.ts index 03175fa0dda11..84cf1142e9e9c 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/types.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/threat_mapping/types.ts @@ -34,6 +34,7 @@ import type { SearchAfterAndBulkCreateReturnType, SignalsEnrichment, WrapHits, + OverrideBodyQuery, } from '../types'; import type { CompleteRule, ThreatRuleParams } from '../../rule_schema'; import type { IRuleExecutionLogForExecutors } from '../../rule_monitoring'; @@ -265,6 +266,7 @@ export interface EventsOptions { tuple: RuleRangeTuple; runtimeMappings: estypes.MappingRuntimeFields | undefined; exceptionFilter: Filter | undefined; + eventListConfig?: OverrideBodyQuery; } export interface EventDoc { diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts index af354baa67903..877239af49a9a 100644 --- a/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts +++ b/x-pack/plugins/security_solution/server/lib/detection_engine/signals/types.ts @@ -342,3 +342,9 @@ export type EventGroupingMultiBucketAggregationResult = ESSearchResponse< }; } >; + +// the new fields can be added later if needed +export interface OverrideBodyQuery { + _source?: estypes.SearchSourceConfig; + fields?: estypes.Fields; +} diff --git a/x-pack/plugins/stack_connectors/server/connector_types/email/send_email_graph_api.test.ts b/x-pack/plugins/stack_connectors/server/connector_types/email/send_email_graph_api.test.ts index 199681a13e968..4ab03837f416b 100644 --- a/x-pack/plugins/stack_connectors/server/connector_types/email/send_email_graph_api.test.ts +++ b/x-pack/plugins/stack_connectors/server/connector_types/email/send_email_graph_api.test.ts @@ -90,7 +90,6 @@ describe('sendEmailGraphApi', () => { "maxSockets": Infinity, "maxTotalSockets": Infinity, "options": Object { - "noDelay": true, "path": null, "rejectUnauthorized": true, }, @@ -181,7 +180,6 @@ describe('sendEmailGraphApi', () => { "maxSockets": Infinity, "maxTotalSockets": Infinity, "options": Object { - "noDelay": true, "path": null, "rejectUnauthorized": true, }, @@ -271,7 +269,6 @@ describe('sendEmailGraphApi', () => { "maxSockets": Infinity, "maxTotalSockets": Infinity, "options": Object { - "noDelay": true, "path": null, "rejectUnauthorized": true, }, diff --git a/x-pack/plugins/synthetics/common/constants/synthetics/client_defaults.ts b/x-pack/plugins/synthetics/common/constants/synthetics/client_defaults.ts new file mode 100644 index 0000000000000..3ea9546a1bfac --- /dev/null +++ b/x-pack/plugins/synthetics/common/constants/synthetics/client_defaults.ts @@ -0,0 +1,17 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +export const CLIENT_DEFAULTS_SYNTHETICS = { + /** + * The beginning of the default date range is 15m ago. + */ + DATE_RANGE_START: 'now-24h', + /** + * The end of the default date range is now. + */ + DATE_RANGE_END: 'now', +}; diff --git a/x-pack/plugins/synthetics/e2e/journeys/uptime/private_locations/add_monitor_private_location.ts b/x-pack/plugins/synthetics/e2e/journeys/uptime/private_locations/add_monitor_private_location.ts index 776a13afae910..19a2d54a79458 100644 --- a/x-pack/plugins/synthetics/e2e/journeys/uptime/private_locations/add_monitor_private_location.ts +++ b/x-pack/plugins/synthetics/e2e/journeys/uptime/private_locations/add_monitor_private_location.ts @@ -57,6 +57,7 @@ journey('AddPrivateLocationMonitor', async ({ page, params: { kibanaUrl } }) => page.waitForNavigation(/* { url: '${kibanaUrl}/app/integrations/browse' }*/), page.click('text=Integrations'), ]); + await page.click('text=Display beta integrations'); await page.click('text=Installed integrations'); expect(page.url()).toBe(`${kibanaUrl}/app/integrations/installed`); await page.click(`text=Elastic Synthetics`); diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/monitor_location_select.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/monitor_location_select.tsx index 9e2d864e720b0..6795341510f34 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/monitor_location_select.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/components/monitor_location_select.tsx @@ -52,7 +52,10 @@ export const MonitorLocationSelect = ({ return ''; } - if (monitorLocations.length > 1) { + const showSelection = + monitorLocations.length === 1 && monitorLocations[0].id !== selectedLocation?.id; + + if (monitorLocations.length > 1 || showSelection) { const button = ( {selectedLocation.label} diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/date_picker/synthetics_date_picker.test.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/date_picker/synthetics_date_picker.test.tsx index 7040da99c39a3..5a417b511c119 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/date_picker/synthetics_date_picker.test.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/date_picker/synthetics_date_picker.test.tsx @@ -21,7 +21,7 @@ describe('SyntheticsDatePicker component', () => { it('renders properly with mock data', async () => { const { findByText } = render(); - expect(await findByText('Last 15 minutes')).toBeInTheDocument(); + expect(await findByText('Last 24 hours')).toBeInTheDocument(); expect(await findByText('Refresh')).toBeInTheDocument(); }); diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/header/action_menu_content.test.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/header/action_menu_content.test.tsx index b672e732c791e..343c548385515 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/common/header/action_menu_content.test.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/common/header/action_menu_content.test.tsx @@ -14,7 +14,7 @@ describe('ActionMenuContent', () => { const { getByRole, getByText } = render(); const settingsAnchor = getByRole('link', { name: 'Navigate to the Uptime settings page' }); - expect(settingsAnchor.getAttribute('href')).toBe('/settings'); + expect(settingsAnchor.getAttribute('href')).toBe('/settings?dateRangeStart=now-24h'); expect(getByText('Settings')); }); diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/error_details/error_details_page.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/error_details/error_details_page.tsx index 1545c5a1df10b..67bace31a8ef2 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/error_details/error_details_page.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/error_details/error_details_page.tsx @@ -26,7 +26,7 @@ export function ErrorDetailsPage() { const checkGroupId = failedTests?.[0]?.monitor.check_group ?? ''; - const { data, isFailed, failedStep, loading: stepsLoading } = useJourneySteps(checkGroupId); + const { data, isFailedStep, failedStep, loading: stepsLoading } = useJourneySteps(checkGroupId); const lastTestRun = failedTests?.[0]; @@ -61,7 +61,7 @@ export function ErrorDetailsPage() { {data?.details?.journey && failedStep && ( - + )} diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_journey_steps.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_journey_steps.tsx index 75d6b623e34e0..bd3d45a0a59f0 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_journey_steps.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/hooks/use_journey_steps.tsx @@ -34,12 +34,6 @@ export const useJourneySteps = (checkGroup?: string, lastRefresh?: number) => { } }, [checkGroupId, dispatch, lastRefresh]); - const isFailed = - journeyData?.steps.some( - (step) => - step.synthetics?.step?.status === 'failed' || step.synthetics?.step?.status === 'skipped' - ) ?? false; - const stepEnds: JourneyStep[] = (journeyData?.steps ?? []).filter(isStepEnd); const failedStep = journeyData?.steps.find((step) => step.synthetics?.step?.status === 'failed'); const stepLabels = stepEnds.map((stepEnd) => stepEnd?.synthetics?.step?.name ?? ''); @@ -48,13 +42,17 @@ export const useJourneySteps = (checkGroup?: string, lastRefresh?: number) => { ? stepEnds.find((step) => step.synthetics?.step?.index === Number(stepIndex)) : undefined; + const isFailedStep = + failedStep?.synthetics?.step && failedStep.synthetics.step.index === Number(stepIndex); + return { data: journeyData as SyntheticsJourneyApiResponse, loading: loading ?? false, - isFailed, stepEnds, stepLabels, currentStep, failedStep, + isFailedStep, + isFailed: false, }; }; diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx index 87077c11eb5db..cc7ea08168ccc 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/errors_tab_content.tsx @@ -35,7 +35,7 @@ export const ErrorsTabContent = ({ <> - + {monitorId && ( @@ -61,11 +61,7 @@ export const ErrorsTabContent = ({ - - - - - + ); @@ -82,7 +78,3 @@ const OVERVIEW_LABEL = i18n.translate('xpack.synthetics.errors.overview', { const FAILED_TESTS_LABEL = i18n.translate('xpack.synthetics.errors.failedTests', { defaultMessage: 'Failed tests', }); - -const FAILED_TESTS_BY_STEPS_LABEL = i18n.translate('xpack.synthetics.errors.failedTests.byStep', { - defaultMessage: 'Failed tests by step', -}); diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests.tsx index 1a192a4d7abf0..1af3a904197e9 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests.tsx @@ -9,6 +9,9 @@ import React from 'react'; import { useKibana } from '@kbn/kibana-react-plugin/public'; import { useParams } from 'react-router-dom'; import { i18n } from '@kbn/i18n'; +import moment from 'moment'; +import { EuiFlexGroup, EuiFlexItem, EuiHealth, EuiText } from '@elastic/eui'; +import { useUrlParams } from '../../../hooks'; import { useMonitorQueryId } from '../hooks/use_monitor_query_id'; import { ClientPluginsStart } from '../../../../../plugin'; @@ -21,28 +24,48 @@ export const MonitorFailedTests = ({ time }: { time: { to: string; from: string const { errorStateId } = useParams<{ errorStateId: string }>(); + const [, updateUrl] = useUrlParams(); + if (!monitorId && !errorStateId) { return null; } return ( - + + ]} + onBrushEnd={({ range }) => { + updateUrl({ + dateRangeStart: moment(range[0]).toISOString(), + dateRangeEnd: moment(range[1]).toISOString(), + }); + }} + /> + + + {FAILED_TESTS_LABEL} + + + + {BRUSH_LABEL} + + + + ); }; @@ -52,3 +75,7 @@ export const FAILED_TESTS_LABEL = i18n.translate( defaultMessage: 'Failed tests', } ); + +export const BRUSH_LABEL = i18n.translate('xpack.synthetics.monitorDetails.summary.brushArea', { + defaultMessage: 'Brush an area for higher fidelity', +}); diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests_by_step.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests_by_step.tsx index 3f5b278fd3927..10c420e5e3da4 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests_by_step.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitor_details/monitor_errors/failed_tests_by_step.tsx @@ -6,42 +6,56 @@ */ import React, { Fragment } from 'react'; -import { EuiProgress, EuiSpacer, EuiLoadingContent } from '@elastic/eui'; +import { EuiProgress, EuiSpacer, EuiFlexItem, EuiLoadingContent } from '@elastic/eui'; import { i18n } from '@kbn/i18n'; +import { PanelWithTitle } from '../../common/components/panel_with_title'; +import { useSelectedMonitor } from '../hooks/use_selected_monitor'; import { useFailedTestByStep } from '../hooks/use_failed_tests_by_step'; export const FailedTestsByStep = ({ time }: { time: { to: string; from: string } }) => { const { failedSteps, loading } = useFailedTestByStep(time); + const { monitor } = useSelectedMonitor(); + + if (monitor?.type !== 'browser') { + return null; + } + if (loading && !failedSteps) { return ; } return ( - <> - -
    - {failedSteps?.map((item) => ( - - - {i18n.translate('xpack.synthetics.monitorDetails.summary.failedTests.count', { - defaultMessage: 'Failed {count}', - values: { count: item.count }, - })} - - } - max={100} - color="danger" - size="l" - value={item.percent} - label={`${item.index}. ${item.name}`} - /> - - - ))} -
    - + + + +
    + {failedSteps?.map((item) => ( + + + {i18n.translate('xpack.synthetics.monitorDetails.summary.failedTests.count', { + defaultMessage: 'Failed {count}', + values: { count: item.count }, + })} + + } + max={100} + color="danger" + size="l" + value={item.percent} + label={`${item.index}. ${item.name}`} + /> + + + ))} +
    +     +     ); }; + +const FAILED_TESTS_BY_STEPS_LABEL = i18n.translate('xpack.synthetics.errors.failedTests.byStep', { + defaultMessage: 'Failed tests by step', +}); diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_stats.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_stats.tsx index 853a627803fa1..71a52993ad6f7 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_stats.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_stats.tsx @@ -19,7 +19,6 @@ import { import { euiStyled } from '@kbn/kibana-react-plugin/common'; import { OverviewStatusState } from '../../../../../../../common/runtime_types'; -import { useSyntheticsRefreshContext } from '../../../../contexts/synthetics_refresh_context'; import * as labels from '../labels'; import { MonitorTestRunsCount } from './monitor_test_runs'; @@ -27,8 +26,6 @@ import { MonitorTestRunsSparkline } from './monitor_test_runs_sparkline'; export const MonitorStats = ({ status }: { status: OverviewStatusState | null }) => { const { euiTheme } = useEuiTheme(); - const { lastRefresh } = useSyntheticsRefreshContext(); - const to = new Date(lastRefresh).toISOString(); return ( <> @@ -67,9 +64,9 @@ export const MonitorStats = ({ status }: { status: OverviewStatusState | null }) - + - + diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_test_runs.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_test_runs.tsx index 5a6c3553e82be..8874690f0e0e5 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_test_runs.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/monitors_page/management/monitor_stats/monitor_test_runs.tsx @@ -11,30 +11,25 @@ import { useKibana } from '@kbn/kibana-react-plugin/public'; import { useTheme } from '@kbn/observability-plugin/public'; import { ReportTypes } from '@kbn/observability-plugin/public'; +import { useAbsoluteDate } from '../../../../hooks'; import { ClientPluginsStart } from '../../../../../../plugin'; import * as labels from '../labels'; -interface MonitorCompleteCountProps { - from?: string; - to?: string; -} - -export const MonitorTestRunsCount = ({ - from = 'now-30d', - to = 'now', -}: MonitorCompleteCountProps) => { +export const MonitorTestRunsCount = () => { const { observability } = useKibana().services; const theme = useTheme(); const { ExploratoryViewEmbeddable } = observability; + const { from: absFrom, to: absTo } = useAbsoluteDate({ from: 'now-30d', to: 'now' }); + return ( { +export const MonitorTestRunsSparkline = () => { const { observability } = useKibana().services; const { ExploratoryViewEmbeddable } = observability; const theme = useTheme(); + const { from, to } = useAbsoluteDate({ from: 'now-30d', to: 'now' }); + return ( { const stepIndex = Number(stepIndexString); + const selectedLocation = useSelectedLocation(); + const { data: journey, stepEnds } = useJourneySteps(checkGroupId); const memoized = useMemo( @@ -35,7 +38,13 @@ export const useStepDetailPage = () => { const { basePath } = useSyntheticsSettingsContext(); const handleStepHref = (stepNo: number) => - `${basePath}/app/synthetics/monitor/${monitorId}/test-run/${checkGroupId}/step/${stepNo}`; + getStepDetailLink({ + basePath, + monitorId, + checkGroupId, + stepIndex: stepNo, + locationId: selectedLocation?.id, + }); return { checkGroupId, @@ -52,7 +61,7 @@ export const useStepDetailLink = ({ stepIndex, }: { checkGroupId?: string; - stepIndex: string; + stepIndex: number | string; }) => { const { basePath } = useSyntheticsSettingsContext(); @@ -60,9 +69,33 @@ export const useStepDetailLink = ({ monitorId: string; }>(); + const selectedLocation = useSelectedLocation(); + if (!checkGroupId) { return ''; } - return `${basePath}/app/synthetics/monitor/${monitorId}/test-run/${checkGroupId}/step/${stepIndex}`; + return getStepDetailLink({ + basePath, + stepIndex, + monitorId, + checkGroupId, + locationId: selectedLocation?.id, + }); +}; + +const getStepDetailLink = ({ + checkGroupId, + stepIndex, + basePath, + monitorId, + locationId, +}: { + checkGroupId: string; + locationId?: string; + stepIndex: number | string; + basePath: string; + monitorId: string; +}) => { + return `${basePath}/app/synthetics/monitor/${monitorId}/test-run/${checkGroupId}/step/${stepIndex}?locationId=${locationId}`; }; diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx index be8b695221f2b..33d3fc740eb81 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx +++ b/x-pack/plugins/synthetics/public/apps/synthetics/components/step_details_page/step_detail_page.tsx @@ -30,7 +30,7 @@ export const StepDetailPage = () => { useTrackPageview({ app: 'synthetics', path: 'stepDetail' }); useTrackPageview({ app: 'synthetics', path: 'stepDetail', delay: 15000 }); - const { data, isFailed, currentStep } = useJourneySteps(); + const { data, isFailedStep, currentStep } = useJourneySteps(); useStepDetailsBreadcrumbs(); @@ -62,7 +62,7 @@ export const StepDetailPage = () => { {data?.details?.journey && currentStep && ( - + )} diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.test.ts b/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.test.ts index 64b7a8d32796a..c428d43babf68 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.test.ts +++ b/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.test.ts @@ -8,6 +8,7 @@ import DateMath from '@kbn/datemath'; import { getSupportedUrlParams } from './get_supported_url_params'; import { CLIENT_DEFAULTS } from '../../../../../common/constants'; +import { CLIENT_DEFAULTS_SYNTHETICS } from '../../../../../common/constants/synthetics/client_defaults'; describe('getSupportedUrlParams', () => { let dateMathSpy: any; @@ -51,15 +52,9 @@ describe('getSupportedUrlParams', () => { }); it('returns default values', () => { - const { - AUTOREFRESH_INTERVAL, - AUTOREFRESH_IS_PAUSED, - DATE_RANGE_START, - DATE_RANGE_END, - FILTERS, - SEARCH, - STATUS_FILTER, - } = CLIENT_DEFAULTS; + const { AUTOREFRESH_INTERVAL, AUTOREFRESH_IS_PAUSED, FILTERS, SEARCH, STATUS_FILTER } = + CLIENT_DEFAULTS; + const { DATE_RANGE_START, DATE_RANGE_END } = CLIENT_DEFAULTS_SYNTHETICS; const result = getSupportedUrlParams({}); expect(result).toEqual({ absoluteDateRangeStart: MOCK_DATE_VALUE, diff --git a/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.ts b/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.ts index b86a9437907fb..902b296e3db0e 100644 --- a/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.ts +++ b/x-pack/plugins/synthetics/public/apps/synthetics/utils/url_params/get_supported_url_params.ts @@ -5,6 +5,7 @@ * 2.0. */ +import { CLIENT_DEFAULTS_SYNTHETICS } from '../../../../../common/constants/synthetics/client_defaults'; import { parseIsPaused } from './parse_is_paused'; import { parseUrlInt } from './parse_url_int'; import { CLIENT_DEFAULTS } from '../../../../../common/constants'; @@ -37,13 +38,13 @@ const { ABSOLUTE_DATE_RANGE_END, AUTOREFRESH_INTERVAL, AUTOREFRESH_IS_PAUSED, - DATE_RANGE_START, - DATE_RANGE_END, SEARCH, FILTERS, STATUS_FILTER, } = CLIENT_DEFAULTS; +const { DATE_RANGE_START, DATE_RANGE_END } = CLIENT_DEFAULTS_SYNTHETICS; + /** * Gets the current URL values for the application. If no item is present * for the URL, a default value is supplied. diff --git a/x-pack/plugins/synthetics/server/legacy_uptime/lib/adapters/framework/adapter_types.ts b/x-pack/plugins/synthetics/server/legacy_uptime/lib/adapters/framework/adapter_types.ts index fc088e2097ddc..ec77b83977a09 100644 --- a/x-pack/plugins/synthetics/server/legacy_uptime/lib/adapters/framework/adapter_types.ts +++ b/x-pack/plugins/synthetics/server/legacy_uptime/lib/adapters/framework/adapter_types.ts @@ -28,7 +28,7 @@ import { MlPluginSetup as MlSetup } from '@kbn/ml-plugin/server'; import { RuleRegistryPluginSetupContract } from '@kbn/rule-registry-plugin/server'; import { SecurityPluginStart } from '@kbn/security-plugin/server'; import { CloudSetup } from '@kbn/cloud-plugin/server'; -import { SpacesPluginSetup } from '@kbn/spaces-plugin/server'; +import { SpacesPluginStart } from '@kbn/spaces-plugin/server'; import { FleetStartContract } from '@kbn/fleet-plugin/server'; import { BfetchServerSetup } from '@kbn/bfetch-plugin/server'; import { UptimeEsClient } from '../../lib'; @@ -54,7 +54,7 @@ export interface UptimeServerSetup { router: UptimeRouter; config: UptimeConfig; cloud?: CloudSetup; - spaces: SpacesPluginSetup; + spaces: SpacesPluginStart; fleet: FleetStartContract; security: SecurityPluginStart; savedObjectsClient?: SavedObjectsClientContract; @@ -76,7 +76,6 @@ export interface UptimeCorePluginsSetup { usageCollection: UsageCollectionSetup; ml: MlSetup; cloud?: CloudSetup; - spaces: SpacesPluginSetup; ruleRegistry: RuleRegistryPluginSetupContract; encryptedSavedObjects: EncryptedSavedObjectsPluginSetup; taskManager: TaskManagerSetupContract; @@ -90,4 +89,5 @@ export interface UptimeCorePluginsStart { encryptedSavedObjects: EncryptedSavedObjectsPluginStart; taskManager: TaskManagerStartContract; telemetry: TelemetryPluginStart; + spaces: SpacesPluginStart; } diff --git a/x-pack/plugins/synthetics/server/plugin.ts b/x-pack/plugins/synthetics/server/plugin.ts index 77ce0ec1eaf60..598fdd18b229b 100644 --- a/x-pack/plugins/synthetics/server/plugin.ts +++ b/x-pack/plugins/synthetics/server/plugin.ts @@ -86,7 +86,6 @@ export class Plugin implements PluginType { logger: this.logger, telemetry: this.telemetryEventsSender, isDev: this.initContext.env.mode.dev, - spaces: plugins.spaces, } as UptimeServerSetup; this.syntheticsService = new SyntheticsService(this.server); @@ -126,6 +125,7 @@ export class Plugin implements PluginType { this.server.fleet = pluginsStart.fleet; this.server.encryptedSavedObjects = pluginsStart.encryptedSavedObjects; this.server.savedObjectsClient = this.savedObjectsClient; + this.server.spaces = pluginsStart.spaces; } this.syntheticsService?.start(pluginsStart.taskManager); diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor.ts index 0ef04580e0681..0db555a4c48b1 100644 --- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor.ts +++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor.ts @@ -58,8 +58,6 @@ export const addSyntheticsMonitorRoute: SyntheticsRestApiRouteFactory = () => ({ // usually id is auto generated, but this is useful for testing const { id } = request.query; - const spaceId = server.spaces.spacesService.getSpaceId(request); - const monitor: SyntheticsMonitor = request.body as SyntheticsMonitor; const monitorType = monitor[ConfigKey.MONITOR_TYPE]; const monitorWithDefaults = { @@ -79,6 +77,7 @@ export const addSyntheticsMonitorRoute: SyntheticsRestApiRouteFactory = () => ({ ); try { + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); const { errors, newMonitor } = await syncNewMonitor({ normalizedMonitor: validationResult.decodedMonitor, server, diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project.ts index 924666b21cd53..11dbe95952fef 100644 --- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project.ts +++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project.ts @@ -41,7 +41,6 @@ export const addSyntheticsProjectMonitorRoute: SyntheticsRestApiRouteFactory = ( const { projectName } = request.params; const decodedProjectName = decodeURI(projectName); const monitors = (request.body?.monitors as ProjectMonitor[]) || []; - const spaceId = server.spaces.spacesService.getSpaceId(request); if (monitors.length > 250) { return response.badRequest({ @@ -52,6 +51,7 @@ export const addSyntheticsProjectMonitorRoute: SyntheticsRestApiRouteFactory = ( } try { + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); const encryptedSavedObjectsClient = server.encryptedSavedObjects.getClient(); const pushMonitorFormatter = new ProjectMonitorFormatter({ @@ -74,6 +74,11 @@ export const addSyntheticsProjectMonitorRoute: SyntheticsRestApiRouteFactory = ( }; } catch (error) { server.logger.error(`Error adding monitors to project ${decodedProjectName}`); + if (error.output.statusCode === 404) { + const spaceId = server.spaces.spacesService.getSpaceId(request); + return response.notFound({ body: { message: `Kibana space '${spaceId}' does not exist` } }); + } + throw error; } }, diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project_legacy.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project_legacy.ts index f8f29e46c1fad..28fe5761a359f 100644 --- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project_legacy.ts +++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/add_monitor_project_legacy.ts @@ -39,9 +39,11 @@ export const addSyntheticsProjectMonitorRouteLegacy: SyntheticsStreamingRouteFac syntheticsMonitorClient, subject, }): Promise => { + const monitors = (request.body?.monitors as ProjectMonitor[]) || []; + try { - const monitors = (request.body?.monitors as ProjectMonitor[]) || []; - const spaceId = server.spaces.spacesService.getSpaceId(request); + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); + const { keep_stale: keepStale, project: projectId } = request.body || {}; const { publicLocations, privateLocations } = await getAllLocations( server, @@ -76,7 +78,13 @@ export const addSyntheticsProjectMonitorRouteLegacy: SyntheticsStreamingRouteFac failedStaleMonitors: pushMonitorFormatter.failedStaleMonitors, }); } catch (error) { - subject?.error(error); + if (error?.output?.statusCode === 404) { + const spaceId = server.spaces.spacesService.getSpaceId(request); + subject?.next(`Unable to create monitors. Kibana space '${spaceId}' does not exist.`); + subject?.next({ failedMonitors: monitors.map((m) => m.id) }); + } else { + subject?.error(error); + } } finally { subject?.complete(); } diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts index d720306f357c6..f5007986d2508 100644 --- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts +++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/bulk_cruds/delete_monitor_bulk.ts @@ -35,9 +35,9 @@ export const deleteMonitorBulk = async ({ request: KibanaRequest; }) => { const { logger, telemetry, stackVersion } = server; - const spaceId = server.spaces.spacesService.getSpaceId(request); try { + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); const deleteSyncPromise = syntheticsMonitorClient.deleteMonitors( monitors.map((normalizedMonitor) => ({ ...normalizedMonitor.attributes, diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/delete_monitor.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/delete_monitor.ts index c650587048998..0dca273c2613e 100644 --- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/delete_monitor.ts +++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/delete_monitor.ts @@ -88,7 +88,6 @@ export const deleteMonitor = async ({ request: KibanaRequest; }) => { const { logger, telemetry, stackVersion } = server; - const spaceId = server.spaces.spacesService.getSpaceId(request); const { monitor, monitorWithSecret } = await getMonitorToDelete( monitorId, @@ -96,6 +95,7 @@ export const deleteMonitor = async ({ server ); try { + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); const deleteSyncPromise = syntheticsMonitorClient.deleteMonitors( [ { diff --git a/x-pack/plugins/synthetics/server/routes/monitor_cruds/edit_monitor.ts b/x-pack/plugins/synthetics/server/routes/monitor_cruds/edit_monitor.ts index fb20ca8c82de5..09b046b872ed6 100644 --- a/x-pack/plugins/synthetics/server/routes/monitor_cruds/edit_monitor.ts +++ b/x-pack/plugins/synthetics/server/routes/monitor_cruds/edit_monitor.ts @@ -56,9 +56,9 @@ export const editSyntheticsMonitorRoute: SyntheticsRestApiRouteFactory = () => ( const monitor = request.body as SyntheticsMonitor; const { monitorId } = request.params; - const spaceId = server.spaces.spacesService.getSpaceId(request); - try { + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); + const previousMonitor: SavedObject = await savedObjectsClient.get( syntheticsMonitorType, monitorId diff --git a/x-pack/plugins/synthetics/server/routes/settings/add_param.ts b/x-pack/plugins/synthetics/server/routes/settings/add_param.ts index 001967a754581..adb97493a51d8 100644 --- a/x-pack/plugins/synthetics/server/routes/settings/add_param.ts +++ b/x-pack/plugins/synthetics/server/routes/settings/add_param.ts @@ -27,8 +27,7 @@ export const addSyntheticsParamsRoute: SyntheticsRestApiRouteFactory = () => ({ writeAccess: true, handler: async ({ request, server, savedObjectsClient }): Promise => { const { namespaces, ...data } = request.body as SyntheticsParam; - - const spaceId = server.spaces.spacesService.getSpaceId(request); + const { id: spaceId } = await server.spaces.spacesService.getActiveSpace(request); const result = await savedObjectsClient.create(syntheticsParamType, data, { initialNamespaces: (namespaces ?? []).length > 0 ? namespaces : [spaceId], diff --git a/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.test.ts b/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.test.ts index 52056b77ae8b7..62a54db4460a6 100644 --- a/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.test.ts +++ b/x-pack/plugins/synthetics/server/synthetics_service/service_api_client.test.ts @@ -200,7 +200,7 @@ describe('callAPI', () => { 'x-kibana-version': '8.7.0', }, httpsAgent: expect.objectContaining({ - options: { noDelay: true, rejectUnauthorized: true, path: null }, + options: { rejectUnauthorized: true, path: null }, }), method: 'POST', url: 'https://service.dev/monitors', @@ -213,7 +213,7 @@ describe('callAPI', () => { 'x-kibana-version': '8.7.0', }, httpsAgent: expect.objectContaining({ - options: { noDelay: true, rejectUnauthorized: true, path: null }, + options: { rejectUnauthorized: true, path: null }, }), method: 'POST', url: 'https://qa.service.elstc.co/monitors', @@ -226,7 +226,7 @@ describe('callAPI', () => { 'x-kibana-version': '8.7.0', }, httpsAgent: expect.objectContaining({ - options: { noDelay: true, rejectUnauthorized: true, path: null }, + options: { rejectUnauthorized: true, path: null }, }), method: 'POST', url: 'https://qa.service.stg.co/monitors', @@ -293,7 +293,6 @@ describe('callAPI', () => { httpsAgent: expect.objectContaining({ options: { rejectUnauthorized: true, - noDelay: true, path: null, cert: 'test-certificate', key: 'test-key', diff --git a/x-pack/plugins/task_manager/server/buffered_task_store.test.ts b/x-pack/plugins/task_manager/server/buffered_task_store.test.ts index 1e585f370bc12..935192f7cc48e 100644 --- a/x-pack/plugins/task_manager/server/buffered_task_store.test.ts +++ b/x-pack/plugins/task_manager/server/buffered_task_store.test.ts @@ -5,11 +5,10 @@ * 2.0. */ -import { v4 as uuidv4 } from 'uuid'; import { taskStoreMock } from './task_store.mock'; import { BufferedTaskStore } from './buffered_task_store'; import { asErr, asOk } from './lib/result_type'; -import { TaskStatus } from './task'; +import { taskManagerMock } from './mocks'; describe('Buffered Task Store', () => { test('proxies the TaskStore for `maxAttempts` and `remove`', async () => { @@ -26,7 +25,7 @@ describe('Buffered Task Store', () => { const taskStore = taskStoreMock.create(); const bufferedStore = new BufferedTaskStore(taskStore, {}); - const task = mockTask(); + const task = taskManagerMock.createTask(); taskStore.bulkUpdate.mockResolvedValue([asOk(task)]); @@ -38,11 +37,23 @@ describe('Buffered Task Store', () => { const taskStore = taskStoreMock.create(); const bufferedStore = new BufferedTaskStore(taskStore, {}); - const tasks = [mockTask(), mockTask(), mockTask()]; + const tasks = [ + taskManagerMock.createTask(), + taskManagerMock.createTask({ id: 'task_7c149afd-6250-4ca5-a314-20af1348d5e9' }), + taskManagerMock.createTask(), + ]; taskStore.bulkUpdate.mockResolvedValueOnce([ asOk(tasks[0]), - asErr({ entity: tasks[1], error: new Error('Oh no, something went terribly wrong') }), + asErr({ + type: 'task', + id: tasks[1].id, + error: { + statusCode: 400, + error: 'Oh no, something went terribly wrong', + message: 'Oh no, something went terribly wrong', + }, + }), asOk(tasks[2]), ]); @@ -52,9 +63,17 @@ describe('Buffered Task Store', () => { bufferedStore.update(tasks[2]), ]; expect(await results[0]).toMatchObject(tasks[0]); - expect(results[1]).rejects.toMatchInlineSnapshot( - `[Error: Oh no, something went terribly wrong]` - ); + expect(results[1]).rejects.toMatchInlineSnapshot(` + Object { + "error": Object { + "error": "Oh no, something went terribly wrong", + "message": "Oh no, something went terribly wrong", + "statusCode": 400, + }, + "id": "task_7c149afd-6250-4ca5-a314-20af1348d5e9", + "type": "task", + } + `); expect(await results[2]).toMatchObject(tasks[2]); }); @@ -62,17 +81,25 @@ describe('Buffered Task Store', () => { const taskStore = taskStoreMock.create(); const bufferedStore = new BufferedTaskStore(taskStore, {}); - const duplicateIdTask = mockTask(); + const duplicateIdTask = taskManagerMock.createTask(); const tasks = [ duplicateIdTask, - mockTask(), - mockTask(), - { ...mockTask(), id: duplicateIdTask.id }, + taskManagerMock.createTask({ id: 'task_16748083-bc28-4599-893b-c8ec16e55c10' }), + taskManagerMock.createTask(), + taskManagerMock.createTask({ id: duplicateIdTask.id }), ]; taskStore.bulkUpdate.mockResolvedValueOnce([ asOk(tasks[0]), - asErr({ entity: tasks[1], error: new Error('Oh no, something went terribly wrong') }), + asErr({ + type: 'task', + id: tasks[1].id, + error: { + statusCode: 400, + error: 'Oh no, something went terribly wrong', + message: 'Oh no, something went terribly wrong', + }, + }), asOk(tasks[2]), asOk(tasks[3]), ]); @@ -84,31 +111,19 @@ describe('Buffered Task Store', () => { bufferedStore.update(tasks[3]), ]; expect(await results[0]).toMatchObject(tasks[0]); - expect(results[1]).rejects.toMatchInlineSnapshot( - `[Error: Oh no, something went terribly wrong]` - ); + expect(results[1]).rejects.toMatchInlineSnapshot(` + Object { + "error": Object { + "error": "Oh no, something went terribly wrong", + "message": "Oh no, something went terribly wrong", + "statusCode": 400, + }, + "id": "task_16748083-bc28-4599-893b-c8ec16e55c10", + "type": "task", + } + `); expect(await results[2]).toMatchObject(tasks[2]); expect(await results[3]).toMatchObject(tasks[3]); }); }); }); - -function mockTask() { - return { - id: `task_${uuidv4()}`, - attempts: 0, - schedule: undefined, - params: { hello: 'world' }, - retryAt: null, - runAt: new Date(), - scheduledAt: new Date(), - scope: undefined, - startedAt: null, - state: { foo: 'bar' }, - status: TaskStatus.Idle, - taskType: 'report', - user: undefined, - version: '123', - ownerId: '123', - }; -} diff --git a/x-pack/plugins/task_manager/server/buffered_task_store.ts b/x-pack/plugins/task_manager/server/buffered_task_store.ts index ca735dd6f3638..0e24e8e49e43f 100644 --- a/x-pack/plugins/task_manager/server/buffered_task_store.ts +++ b/x-pack/plugins/task_manager/server/buffered_task_store.ts @@ -15,15 +15,12 @@ import { unwrapPromise } from './lib/result_type'; const DEFAULT_BUFFER_MAX_DURATION = 50; export class BufferedTaskStore implements Updatable { - private bufferedUpdate: Operation; + private bufferedUpdate: Operation; constructor(private readonly taskStore: TaskStore, options: BufferOptions) { - this.bufferedUpdate = createBuffer( - (docs) => taskStore.bulkUpdate(docs), - { - bufferMaxDuration: DEFAULT_BUFFER_MAX_DURATION, - ...options, - } - ); + this.bufferedUpdate = createBuffer((docs) => taskStore.bulkUpdate(docs), { + bufferMaxDuration: DEFAULT_BUFFER_MAX_DURATION, + ...options, + }); } public async update(doc: ConcreteTaskInstance): Promise { diff --git a/x-pack/plugins/task_manager/server/ephemeral_task_lifecycle.test.ts b/x-pack/plugins/task_manager/server/ephemeral_task_lifecycle.test.ts index 353df1e11d110..d6d0881cf0d50 100644 --- a/x-pack/plugins/task_manager/server/ephemeral_task_lifecycle.test.ts +++ b/x-pack/plugins/task_manager/server/ephemeral_task_lifecycle.test.ts @@ -14,13 +14,13 @@ import { mockLogger } from './test_utils'; import { asErr, asOk } from './lib/result_type'; import { FillPoolResult } from './lib/fill_pool'; import { EphemeralTaskLifecycle, EphemeralTaskLifecycleOpts } from './ephemeral_task_lifecycle'; -import { ConcreteTaskInstance, TaskStatus } from './task'; import { v4 as uuidv4 } from 'uuid'; import { asTaskPollingCycleEvent, asTaskRunEvent, TaskPersistence } from './task_events'; import { TaskRunResult } from './task_running'; import { TaskPoolRunResult } from './task_pool'; import { TaskPoolMock } from './task_pool.mock'; import { executionContextServiceMock } from '@kbn/core/server/mocks'; +import { taskManagerMock } from './mocks'; const executionContext = executionContextServiceMock.createSetupContract(); @@ -107,7 +107,7 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const task = mockTask(); + const task = taskManagerMock.createTask(); expect(ephemeralTaskLifecycle.attemptToRun(task)).toMatchObject(asErr(task)); }); @@ -116,7 +116,7 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const task = mockTask(); + const task = taskManagerMock.createTask(); expect(ephemeralTaskLifecycle.attemptToRun(task)).toMatchObject(asOk(task)); }); @@ -127,12 +127,12 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const task = mockTask(); + const task = taskManagerMock.createTask(); expect(ephemeralTaskLifecycle.attemptToRun(task)).toMatchObject(asOk(task)); - const task2 = mockTask(); + const task2 = taskManagerMock.createTask(); expect(ephemeralTaskLifecycle.attemptToRun(task2)).toMatchObject(asOk(task2)); - const rejectedTask = mockTask(); + const rejectedTask = taskManagerMock.createTask(); expect(ephemeralTaskLifecycle.attemptToRun(rejectedTask)).toMatchObject(asErr(rejectedTask)); }); @@ -141,7 +141,7 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const task = mockTask({ id: `my-phemeral-task` }); + const task = taskManagerMock.createTask({ id: `my-phemeral-task` }); expect(ephemeralTaskLifecycle.attemptToRun(task)).toMatchObject(asOk(task)); poolCapacity.mockReturnValue({ @@ -164,7 +164,7 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const task = mockTask({ id: `my-phemeral-task` }); + const task = taskManagerMock.createTask({ id: `my-phemeral-task` }); expect(ephemeralTaskLifecycle.attemptToRun(task)).toMatchObject(asOk(task)); poolCapacity.mockReturnValue({ @@ -175,7 +175,7 @@ describe('EphemeralTaskLifecycle', () => { asTaskRunEvent( uuidv4(), asOk({ - task: mockTask(), + task: taskManagerMock.createTask(), result: TaskRunResult.Success, persistence: TaskPersistence.Ephemeral, }) @@ -194,7 +194,11 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const tasks = [mockTask(), mockTask(), mockTask()]; + const tasks = [ + taskManagerMock.createTask(), + taskManagerMock.createTask(), + taskManagerMock.createTask(), + ]; expect(ephemeralTaskLifecycle.attemptToRun(tasks[0])).toMatchObject(asOk(tasks[0])); expect(ephemeralTaskLifecycle.attemptToRun(tasks[1])).toMatchObject(asOk(tasks[1])); expect(ephemeralTaskLifecycle.attemptToRun(tasks[2])).toMatchObject(asOk(tasks[2])); @@ -228,8 +232,8 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const firstLimitedTask = mockTask({ taskType: 'report' }); - const secondLimitedTask = mockTask({ taskType: 'report' }); + const firstLimitedTask = taskManagerMock.createTask({ taskType: 'report' }); + const secondLimitedTask = taskManagerMock.createTask({ taskType: 'report' }); // both are queued expect(ephemeralTaskLifecycle.attemptToRun(firstLimitedTask)).toMatchObject( asOk(firstLimitedTask) @@ -268,8 +272,8 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const firstLimitedTask = mockTask({ taskType: 'report' }); - const secondLimitedTask = mockTask({ taskType: 'report' }); + const firstLimitedTask = taskManagerMock.createTask({ taskType: 'report' }); + const secondLimitedTask = taskManagerMock.createTask({ taskType: 'report' }); // both are queued expect(ephemeralTaskLifecycle.attemptToRun(firstLimitedTask)).toMatchObject( asOk(firstLimitedTask) @@ -317,17 +321,21 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const fooTasks = [mockTask(), mockTask(), mockTask()]; + const fooTasks = [ + taskManagerMock.createTask(), + taskManagerMock.createTask(), + taskManagerMock.createTask(), + ]; expect(ephemeralTaskLifecycle.attemptToRun(fooTasks[0])).toMatchObject(asOk(fooTasks[0])); - const firstLimitedTask = mockTask({ taskType: 'report' }); + const firstLimitedTask = taskManagerMock.createTask({ taskType: 'report' }); expect(ephemeralTaskLifecycle.attemptToRun(firstLimitedTask)).toMatchObject( asOk(firstLimitedTask) ); expect(ephemeralTaskLifecycle.attemptToRun(fooTasks[1])).toMatchObject(asOk(fooTasks[1])); - const secondLimitedTask = mockTask({ taskType: 'report' }); + const secondLimitedTask = taskManagerMock.createTask({ taskType: 'report' }); expect(ephemeralTaskLifecycle.attemptToRun(secondLimitedTask)).toMatchObject( asOk(secondLimitedTask) ); @@ -358,7 +366,11 @@ describe('EphemeralTaskLifecycle', () => { const ephemeralTaskLifecycle = new EphemeralTaskLifecycle(opts); - const tasks = [mockTask(), mockTask(), mockTask()]; + const tasks = [ + taskManagerMock.createTask(), + taskManagerMock.createTask(), + taskManagerMock.createTask(), + ]; expect(ephemeralTaskLifecycle.attemptToRun(tasks[0])).toMatchObject(asOk(tasks[0])); expect(ephemeralTaskLifecycle.attemptToRun(tasks[1])).toMatchObject(asOk(tasks[1])); expect(ephemeralTaskLifecycle.attemptToRun(tasks[2])).toMatchObject(asOk(tasks[2])); @@ -383,23 +395,3 @@ describe('EphemeralTaskLifecycle', () => { expect(ephemeralTaskLifecycle.queuedTasks).toBe(0); }); }); - -function mockTask(overrides: Partial = {}): ConcreteTaskInstance { - return { - id: uuidv4(), - runAt: new Date(), - taskType: 'foo', - schedule: undefined, - attempts: 0, - status: TaskStatus.Idle, - params: { hello: 'world' }, - state: { baby: 'Henhen' }, - user: 'jimbo', - scope: ['reporting'], - ownerId: '', - startedAt: null, - retryAt: null, - scheduledAt: new Date(), - ...overrides, - }; -} diff --git a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts index 8ce9fd7810283..1832e1235aaf6 100644 --- a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts +++ b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.test.ts @@ -7,7 +7,7 @@ import { mockLogger } from '../test_utils'; -import { createBuffer, Entity, OperationError, BulkOperation } from './bulk_operation_buffer'; +import { createBuffer, Entity, ErrorOutput, BulkOperation } from './bulk_operation_buffer'; import { mapErr, asOk, asErr, Ok, Err } from './result_type'; interface TaskInstance extends Entity { @@ -29,21 +29,20 @@ function incrementAttempts(task: TaskInstance): Ok { }); } -function errorAttempts(task: TaskInstance): Err> { +function errorAttempts(task: TaskInstance): Err { return asErr({ - entity: incrementAttempts(task).value, - error: { name: '', message: 'Oh no, something went terribly wrong', statusCode: 500 }, + type: 'task', + id: task.id, + error: { error: '', message: 'Oh no, something went terribly wrong', statusCode: 500 }, }); } describe('Bulk Operation Buffer', () => { describe('createBuffer()', () => { test('batches up multiple Operation calls', async () => { - const bulkUpdate: jest.Mocked> = jest.fn( - ([task1, task2]) => { - return Promise.resolve([incrementAttempts(task1), incrementAttempts(task2)]); - } - ); + const bulkUpdate: jest.Mocked> = jest.fn(([task1, task2]) => { + return Promise.resolve([incrementAttempts(task1), incrementAttempts(task2)]); + }); const bufferedUpdate = createBuffer(bulkUpdate); @@ -58,7 +57,7 @@ describe('Bulk Operation Buffer', () => { }); test('batch updates can be customised to execute after a certain period', async () => { - const bulkUpdate: jest.Mocked> = jest.fn((tasks) => { + const bulkUpdate: jest.Mocked> = jest.fn((tasks) => { return Promise.resolve(tasks.map(incrementAttempts)); }); @@ -95,7 +94,7 @@ describe('Bulk Operation Buffer', () => { }); test('batch updates are executed once queue hits a certain bound', async () => { - const bulkUpdate: jest.Mocked> = jest.fn((tasks) => { + const bulkUpdate: jest.Mocked> = jest.fn((tasks) => { return Promise.resolve(tasks.map(incrementAttempts)); }); @@ -128,7 +127,7 @@ describe('Bulk Operation Buffer', () => { }); test('queue upper bound is reset after each flush', async () => { - const bulkUpdate: jest.Mocked> = jest.fn((tasks) => { + const bulkUpdate: jest.Mocked> = jest.fn((tasks) => { return Promise.resolve(tasks.map(incrementAttempts)); }); @@ -164,7 +163,7 @@ describe('Bulk Operation Buffer', () => { }); test('handles both resolutions and rejections at individual task level', async () => { - const bulkUpdate: jest.Mocked> = jest.fn( + const bulkUpdate: jest.Mocked> = jest.fn( ([task1, task2, task3]) => { return Promise.resolve([ incrementAttempts(task1), @@ -183,10 +182,7 @@ describe('Bulk Operation Buffer', () => { await Promise.all([ expect(bufferedUpdate(task1)).resolves.toMatchObject(incrementAttempts(task1)), expect(bufferedUpdate(task2)).rejects.toMatchObject( - mapErr( - (err: OperationError) => asErr(err.error), - errorAttempts(task2) - ) + mapErr((err: ErrorOutput) => asErr(err), errorAttempts(task2)) ), expect(bufferedUpdate(task3)).resolves.toMatchObject(incrementAttempts(task3)), ]); @@ -195,7 +191,7 @@ describe('Bulk Operation Buffer', () => { }); test('handles bulkUpdate failure', async () => { - const bulkUpdate: jest.Mocked> = jest.fn(() => { + const bulkUpdate: jest.Mocked> = jest.fn(() => { return Promise.reject(new Error('bulkUpdate is an illusion')); }); @@ -230,7 +226,7 @@ describe('Bulk Operation Buffer', () => { }); test('logs unknown bulk operation results', async () => { - const bulkUpdate: jest.Mocked> = jest.fn( + const bulkUpdate: jest.Mocked> = jest.fn( ([task1, task2, task3]) => { return Promise.resolve([ incrementAttempts(task1), diff --git a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts index 6e05aceee9a54..10bec75c84684 100644 --- a/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts +++ b/x-pack/plugins/task_manager/server/lib/bulk_operation_buffer.ts @@ -9,6 +9,7 @@ import { Logger } from '@kbn/core/server'; import { map } from 'lodash'; import { Subject, race, from } from 'rxjs'; import { bufferWhen, filter, bufferCount, flatMap, mapTo, first } from 'rxjs/operators'; +import { SavedObjectError } from '@kbn/core-saved-objects-common'; import { either, Result, asOk, asErr, Ok, Err } from './result_type'; export interface BufferOptions { @@ -21,36 +22,30 @@ export interface Entity { id: string; } -export interface OperationError { - entity: Input; - error: ErrorOutput; +export interface ErrorOutput { + type: string; + id: string; + error: SavedObjectError; } -export type OperationResult = Result< - Output, - OperationError ->; +export type OperationResult = Result; -export type Operation = ( - entity: Input -) => Promise>; +export type Operation = (entity: T) => Promise>; -export type BulkOperation = ( - entities: Input[] -) => Promise>>; +export type BulkOperation = (entities: T[]) => Promise>>; const DONT_FLUSH = false; const FLUSH = true; -export function createBuffer( - bulkOperation: BulkOperation, +export function createBuffer( + bulkOperation: BulkOperation, { bufferMaxDuration = 0, bufferMaxOperations = Number.MAX_VALUE, logger }: BufferOptions = {} -): Operation { +): Operation { const flushBuffer = new Subject(); const storeUpdateBuffer = new Subject<{ - entity: Input; - onSuccess: (entity: Ok) => void; + entity: T; + onSuccess: (entity: Ok) => void; onFailure: (error: Err) => void; }>(); @@ -82,17 +77,15 @@ export function createBuffer) => { + (error: ErrorOutput) => { either( - pullFirstWhere(bufferedEntities, ({ entity: { id } }) => id === entity.id), + pullFirstWhere(bufferedEntities, ({ entity: { id } }) => id === error.id), ({ onFailure }) => { onFailure(asErr(error)); }, () => { if (logger) { - logger.warn( - `Unhandled failed Bulk Operation result: ${entity?.id ? entity.id : entity}` - ); + logger.warn(`Unhandled failed Bulk Operation result: ${error.id}`); } } ); @@ -148,7 +141,7 @@ export function createBuffer { storeUpdateBuffer.next({ entity, onSuccess: resolve, onFailure: reject }); }); diff --git a/x-pack/plugins/task_manager/server/lib/retryable_bulk_update.test.ts b/x-pack/plugins/task_manager/server/lib/retryable_bulk_update.test.ts new file mode 100644 index 0000000000000..aefcae67ecdd5 --- /dev/null +++ b/x-pack/plugins/task_manager/server/lib/retryable_bulk_update.test.ts @@ -0,0 +1,92 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { asErr, asOk } from './result_type'; +import { retryableBulkUpdate } from './retryable_bulk_update'; +import { taskStoreMock } from '../task_store.mock'; +import { TaskStatus } from '../task'; +import { taskManagerMock } from '../mocks'; + +describe('retryableBulkUpdate()', () => { + const taskIds = ['1', '2', '3']; + const tasks = [ + taskManagerMock.createTask({ id: '1' }), + taskManagerMock.createTask({ id: '2' }), + taskManagerMock.createTask({ id: '3' }), + ]; + const getTasks = jest.fn(); + const filter = jest.fn(); + const map = jest.fn(); + const store = taskStoreMock.create(); + + beforeEach(() => { + jest.resetAllMocks(); + getTasks.mockResolvedValue(tasks.map((task) => asOk(task))); + filter.mockImplementation(() => true); + map.mockImplementation((task) => task); + store.bulkUpdate.mockResolvedValue(tasks.map((task) => asOk(task))); + }); + + it('should call getTasks with taskIds', async () => { + await retryableBulkUpdate({ taskIds, getTasks, filter, map, store }); + expect(getTasks).toHaveBeenCalledWith(taskIds); + }); + + it('should filter tasks returned from getTasks', async () => { + filter.mockImplementation((task) => task.id === '2'); + await retryableBulkUpdate({ taskIds, getTasks, filter, map, store }); + expect(filter).toHaveBeenCalledTimes(3); + // Map happens after filter + expect(map).toHaveBeenCalledTimes(1); + expect(store.bulkUpdate).toHaveBeenCalledWith([tasks[1]]); + }); + + it('should map tasks returned from getTasks', async () => { + map.mockImplementation((task) => ({ ...task, status: TaskStatus.Claiming })); + await retryableBulkUpdate({ taskIds, getTasks, filter, map, store }); + expect(map).toHaveBeenCalledTimes(3); + expect(store.bulkUpdate).toHaveBeenCalledWith( + tasks.map((task) => ({ ...task, status: TaskStatus.Claiming })) + ); + }); + + it('should retry tasks that have a status code of 409', async () => { + getTasks.mockResolvedValueOnce(tasks.map((task) => asOk(task))); + store.bulkUpdate.mockResolvedValueOnce([ + asErr({ + type: 'task', + id: tasks[0].id, + error: { + statusCode: 409, + error: 'Conflict', + message: 'Conflict', + }, + }), + asOk(tasks[1]), + asOk(tasks[2]), + ]); + getTasks.mockResolvedValueOnce([tasks[0]].map((task) => asOk(task))); + store.bulkUpdate.mockResolvedValueOnce(tasks.map((task) => asOk(task))); + await retryableBulkUpdate({ taskIds, getTasks, filter, map, store }); + expect(store.bulkUpdate).toHaveBeenCalledTimes(2); + expect(store.bulkUpdate).toHaveBeenNthCalledWith(2, [tasks[0]]); + }); + + it('should skip updating tasks that cannot be found', async () => { + getTasks.mockResolvedValue([ + asOk(tasks[0]), + asErr({ + id: tasks[1].id, + type: 'task', + error: { error: 'Oh no', message: 'Oh no', statusCode: 404 }, + }), + asOk(tasks[2]), + ]); + await retryableBulkUpdate({ taskIds, getTasks, filter, map, store }); + expect(store.bulkUpdate).toHaveBeenCalledWith([tasks[0], tasks[2]]); + }); +}); diff --git a/x-pack/plugins/task_manager/server/lib/retryable_bulk_update.ts b/x-pack/plugins/task_manager/server/lib/retryable_bulk_update.ts new file mode 100644 index 0000000000000..3c832e31af4da --- /dev/null +++ b/x-pack/plugins/task_manager/server/lib/retryable_bulk_update.ts @@ -0,0 +1,93 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { SavedObjectError } from '@kbn/core-saved-objects-common'; +import { ConcreteTaskInstance } from '../task'; +import { TaskStore, BulkUpdateResult, BulkGetResult } from '../task_store'; +import { isErr, isOk, asErr } from './result_type'; +import { BulkUpdateTaskResult } from '../task_scheduling'; + +export const MAX_RETRIES = 2; + +export interface RetryableBulkUpdateOpts { + taskIds: string[]; + getTasks: (taskIds: string[]) => Promise; + filter: (task: ConcreteTaskInstance) => boolean; + map: (task: ConcreteTaskInstance) => ConcreteTaskInstance; + store: TaskStore; +} + +export async function retryableBulkUpdate({ + taskIds, + getTasks, + filter, + map, + store, +}: RetryableBulkUpdateOpts): Promise { + const resultMap: Record = {}; + + async function attemptToUpdate(taskIdsToAttempt: string[]) { + const tasksToUpdate = (await getTasks(taskIdsToAttempt)) + .reduce((acc, task) => { + if (isErr(task)) { + resultMap[task.error.id] = buildBulkUpdateErr(task.error); + } else { + acc.push(task.value); + } + return acc; + }, []) + .filter(filter) + .map(map); + const bulkUpdateResult = await store.bulkUpdate(tasksToUpdate); + for (const result of bulkUpdateResult) { + const taskId = getId(result); + resultMap[taskId] = result; + } + } + + await attemptToUpdate(taskIds); + + let retry = 1; + while (retry++ <= MAX_RETRIES && getRetriableTaskIds(resultMap).length > 0) { + await attemptToUpdate(getRetriableTaskIds(resultMap)); + } + + return Object.values(resultMap).reduce( + (acc, result) => { + if (isOk(result)) { + acc.tasks.push(result.value); + } else { + acc.errors.push(result.error); + } + return acc; + }, + { tasks: [], errors: [] } + ); +} + +function getId(bulkUpdateResult: BulkUpdateResult): string { + return isOk(bulkUpdateResult) ? bulkUpdateResult.value.id : bulkUpdateResult.error.id; +} + +function getRetriableTaskIds(resultMap: Record) { + return Object.values(resultMap) + .filter((result) => isErr(result) && result.error.error.statusCode === 409) + .map((result) => getId(result)); +} + +function buildBulkUpdateErr(error: { type: string; id: string; error: SavedObjectError }) { + return asErr({ + id: error.id, + type: error.type, + error: { + error: error.error.error, + statusCode: error.error.statusCode, + message: error.error.message, + ...(error.error.metadata ? error.error.metadata : {}), + }, + }); +} diff --git a/x-pack/plugins/task_manager/server/mocks.ts b/x-pack/plugins/task_manager/server/mocks.ts index 571149f08aa2a..551efc9c8c52b 100644 --- a/x-pack/plugins/task_manager/server/mocks.ts +++ b/x-pack/plugins/task_manager/server/mocks.ts @@ -5,7 +5,9 @@ * 2.0. */ +import { v4 as uuidv4 } from 'uuid'; import { TaskManagerSetupContract, TaskManagerStartContract } from './plugin'; +import { ConcreteTaskInstance, TaskStatus } from './task'; const createSetupMock = () => { const mock: jest.Mocked = { @@ -38,7 +40,29 @@ const createStartMock = () => { return mock; }; +const createTaskMock = (overrides: Partial = {}): ConcreteTaskInstance => { + return { + id: `task_${uuidv4()}`, + attempts: 0, + schedule: undefined, + params: { hello: 'world' }, + retryAt: null, + runAt: new Date(), + scheduledAt: new Date(), + scope: undefined, + startedAt: null, + state: { foo: 'bar' }, + status: TaskStatus.Idle, + taskType: 'foo', + user: undefined, + version: '123', + ownerId: '123', + ...overrides, + }; +}; + export const taskManagerMock = { createSetup: createSetupMock, createStart: createStartMock, + createTask: createTaskMock, }; diff --git a/x-pack/plugins/task_manager/server/task_scheduling.test.ts b/x-pack/plugins/task_manager/server/task_scheduling.test.ts index aeeebafe6a529..4433a0ad83e8c 100644 --- a/x-pack/plugins/task_manager/server/task_scheduling.test.ts +++ b/x-pack/plugins/task_manager/server/task_scheduling.test.ts @@ -13,14 +13,14 @@ import { asTaskRunEvent, TaskPersistence } from './task_events'; import { TaskLifecycleEvent } from './polling_lifecycle'; import { TaskScheduling } from './task_scheduling'; import { asErr, asOk } from './lib/result_type'; -import { ConcreteTaskInstance, TaskStatus } from './task'; +import { TaskStatus } from './task'; import { createInitialMiddleware } from './lib/middleware'; import { taskStoreMock } from './task_store.mock'; import { TaskRunResult } from './task_running'; import { mockLogger } from './test_utils'; import { TaskTypeDictionary } from './task_type_dictionary'; import { ephemeralTaskLifecycleMock } from './ephemeral_task_lifecycle.mock'; -import { mustBeAllOf } from './queries/query_clauses'; +import { taskManagerMock } from './mocks'; let fakeTimer: sinon.SinonFakeTimers; jest.mock('uuid', () => ({ @@ -156,75 +156,72 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; beforeEach(() => { mockTaskStore.bulkUpdate.mockImplementation(() => - Promise.resolve([{ tag: 'ok', value: mockTask() }]) + Promise.resolve([{ tag: 'ok', value: taskManagerMock.createTask() }]) ); }); - test('should search for tasks by ids enabled = false when enabling', async () => { - mockTaskStore.fetch.mockResolvedValue({ docs: [] }); - const taskScheduling = new TaskScheduling(taskSchedulingOpts); - - await taskScheduling.bulkEnable([id]); - - expect(mockTaskStore.fetch).toHaveBeenCalledTimes(1); - expect(mockTaskStore.fetch).toHaveBeenCalledWith({ - query: { - bool: { - must: [ - { - terms: { - _id: [`task:${id}`], - }, - }, - { - term: { - 'task.enabled': false, - }, - }, - ], - }, - }, - size: 100, - }); - }); - test('should split search on chunks when input ids array too large', async () => { - mockTaskStore.fetch.mockResolvedValue({ docs: [] }); + mockTaskStore.bulkGet.mockResolvedValue([]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkEnable(Array.from({ length: 1250 }), false); - expect(mockTaskStore.fetch).toHaveBeenCalledTimes(13); + expect(mockTaskStore.bulkGet).toHaveBeenCalledTimes(13); }); test('should transform response into correct format', async () => { - const successfulTask = mockTask({ + const successfulTask = taskManagerMock.createTask({ id: 'task-1', enabled: false, schedule: { interval: '1h' }, }); - const failedTask = mockTask({ id: 'task-2', enabled: false, schedule: { interval: '1h' } }); + const failedToUpdateTask = taskManagerMock.createTask({ + id: 'task-2', + enabled: false, + schedule: { interval: '1h' }, + }); mockTaskStore.bulkUpdate.mockImplementation(() => Promise.resolve([ { tag: 'ok', value: successfulTask }, - { tag: 'err', error: { entity: failedTask, error: new Error('fail') } }, + { + tag: 'err', + error: { + type: 'task', + id: failedToUpdateTask.id, + error: { + statusCode: 400, + error: 'fail', + message: 'fail', + }, + }, + }, ]) ); - mockTaskStore.fetch.mockResolvedValue({ docs: [successfulTask, failedTask] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(successfulTask), asOk(failedToUpdateTask)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); - const result = await taskScheduling.bulkEnable([successfulTask.id, failedTask.id]); + const result = await taskScheduling.bulkEnable([successfulTask.id, failedToUpdateTask.id]); expect(result).toEqual({ tasks: [successfulTask], - errors: [{ task: failedTask, error: new Error('fail') }], + errors: [ + { + type: 'task', + id: failedToUpdateTask.id, + error: { + statusCode: 400, + error: 'fail', + message: 'fail', + }, + }, + ], }); }); test('should not enable task if it is already enabled', async () => { - const task = mockTask({ id, enabled: true, schedule: { interval: '3h' } }); + const task = taskManagerMock.createTask({ id, enabled: true, schedule: { interval: '3h' } }); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkEnable([id]); @@ -235,7 +232,7 @@ describe('TaskScheduling', () => { }); test('should set runAt and scheduledAt if runSoon is true', async () => { - const task = mockTask({ + const task = taskManagerMock.createTask({ id, enabled: false, schedule: { interval: '3h' }, @@ -245,7 +242,7 @@ describe('TaskScheduling', () => { mockTaskStore.bulkUpdate.mockImplementation(() => Promise.resolve([{ tag: 'ok', value: task }]) ); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkEnable([id]); @@ -263,7 +260,7 @@ describe('TaskScheduling', () => { }); test('should not set runAt and scheduledAt if runSoon is false', async () => { - const task = mockTask({ + const task = taskManagerMock.createTask({ id, enabled: false, schedule: { interval: '3h' }, @@ -273,7 +270,7 @@ describe('TaskScheduling', () => { mockTaskStore.bulkUpdate.mockImplementation(() => Promise.resolve([{ tag: 'ok', value: task }]) ); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkEnable([id], false); @@ -293,75 +290,72 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; beforeEach(() => { mockTaskStore.bulkUpdate.mockImplementation(() => - Promise.resolve([{ tag: 'ok', value: mockTask() }]) + Promise.resolve([{ tag: 'ok', value: taskManagerMock.createTask() }]) ); }); - test('should search for tasks by ids enabled = true when disabling', async () => { - mockTaskStore.fetch.mockResolvedValue({ docs: [] }); - const taskScheduling = new TaskScheduling(taskSchedulingOpts); - - await taskScheduling.bulkDisable([id]); - - expect(mockTaskStore.fetch).toHaveBeenCalledTimes(1); - expect(mockTaskStore.fetch).toHaveBeenCalledWith({ - query: { - bool: { - must: [ - { - terms: { - _id: [`task:${id}`], - }, - }, - { - term: { - 'task.enabled': true, - }, - }, - ], - }, - }, - size: 100, - }); - }); - test('should split search on chunks when input ids array too large', async () => { - mockTaskStore.fetch.mockResolvedValue({ docs: [] }); + mockTaskStore.bulkGet.mockResolvedValue([]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkDisable(Array.from({ length: 1250 })); - expect(mockTaskStore.fetch).toHaveBeenCalledTimes(13); + expect(mockTaskStore.bulkGet).toHaveBeenCalledTimes(13); }); test('should transform response into correct format', async () => { - const successfulTask = mockTask({ + const successfulTask = taskManagerMock.createTask({ id: 'task-1', enabled: false, schedule: { interval: '1h' }, }); - const failedTask = mockTask({ id: 'task-2', enabled: true, schedule: { interval: '1h' } }); + const failedToUpdateTask = taskManagerMock.createTask({ + id: 'task-2', + enabled: true, + schedule: { interval: '1h' }, + }); mockTaskStore.bulkUpdate.mockImplementation(() => Promise.resolve([ { tag: 'ok', value: successfulTask }, - { tag: 'err', error: { entity: failedTask, error: new Error('fail') } }, + { + tag: 'err', + error: { + type: 'task', + id: failedToUpdateTask.id, + error: { + statusCode: 400, + error: 'fail', + message: 'fail', + }, + }, + }, ]) ); - mockTaskStore.fetch.mockResolvedValue({ docs: [successfulTask, failedTask] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(successfulTask), asOk(failedToUpdateTask)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); - const result = await taskScheduling.bulkDisable([successfulTask.id, failedTask.id]); + const result = await taskScheduling.bulkDisable([successfulTask.id, failedToUpdateTask.id]); expect(result).toEqual({ tasks: [successfulTask], - errors: [{ task: failedTask, error: new Error('fail') }], + errors: [ + { + type: 'task', + id: failedToUpdateTask.id, + error: { + statusCode: 400, + error: 'fail', + message: 'fail', + }, + }, + ], }); }); test('should not disable task if it is already disabled', async () => { - const task = mockTask({ id, enabled: false, schedule: { interval: '3h' } }); + const task = taskManagerMock.createTask({ id, enabled: false, schedule: { interval: '3h' } }); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkDisable([id]); @@ -376,69 +370,73 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; beforeEach(() => { mockTaskStore.bulkUpdate.mockImplementation(() => - Promise.resolve([{ tag: 'ok', value: mockTask() }]) + Promise.resolve([{ tag: 'ok', value: taskManagerMock.createTask() }]) ); }); - test('should search for tasks by ids and idle status', async () => { - mockTaskStore.fetch.mockResolvedValue({ docs: [] }); - const taskScheduling = new TaskScheduling(taskSchedulingOpts); - - await taskScheduling.bulkUpdateSchedules([id], { interval: '1h' }); - - expect(mockTaskStore.fetch).toHaveBeenCalledTimes(1); - expect(mockTaskStore.fetch).toHaveBeenCalledWith({ - query: mustBeAllOf( - { - terms: { - _id: [`task:${id}`], - }, - }, - { - term: { - 'task.status': 'idle', - }, - } - ), - size: 100, - }); - }); - test('should split search on chunks when input ids array too large', async () => { - mockTaskStore.fetch.mockResolvedValue({ docs: [] }); + mockTaskStore.bulkGet.mockResolvedValue([]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkUpdateSchedules(Array.from({ length: 1250 }), { interval: '1h' }); - expect(mockTaskStore.fetch).toHaveBeenCalledTimes(13); + expect(mockTaskStore.bulkGet).toHaveBeenCalledTimes(13); }); test('should transform response into correct format', async () => { - const successfulTask = mockTask({ id: 'task-1', schedule: { interval: '1h' } }); - const failedTask = mockTask({ id: 'task-2', schedule: { interval: '1h' } }); + const successfulTask = taskManagerMock.createTask({ + id: 'task-1', + schedule: { interval: '1h' }, + }); + const failedToUpdateTask = taskManagerMock.createTask({ + id: 'task-2', + schedule: { interval: '1h' }, + }); mockTaskStore.bulkUpdate.mockImplementation(() => Promise.resolve([ { tag: 'ok', value: successfulTask }, - { tag: 'err', error: { entity: failedTask, error: new Error('fail') } }, + { + tag: 'err', + error: { + type: 'task', + id: failedToUpdateTask.id, + error: { + statusCode: 400, + error: 'fail', + message: 'fail', + }, + }, + }, ]) ); - mockTaskStore.fetch.mockResolvedValue({ docs: [successfulTask, failedTask] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(successfulTask), asOk(failedToUpdateTask)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); - const result = await taskScheduling.bulkUpdateSchedules([successfulTask.id, failedTask.id], { - interval: '1h', - }); + const result = await taskScheduling.bulkUpdateSchedules( + [successfulTask.id, failedToUpdateTask.id], + { interval: '1h' } + ); expect(result).toEqual({ tasks: [successfulTask], - errors: [{ task: failedTask, error: new Error('fail') }], + errors: [ + { + type: 'task', + id: failedToUpdateTask.id, + error: { + statusCode: 400, + error: 'fail', + message: 'fail', + }, + }, + ], }); }); test('should not update task if new interval is equal to previous', async () => { - const task = mockTask({ id, schedule: { interval: '3h' } }); + const task = taskManagerMock.createTask({ id, schedule: { interval: '3h' } }); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkUpdateSchedules([id], { interval: '3h' }); @@ -451,9 +449,13 @@ describe('TaskScheduling', () => { test('should postpone task run if new interval is greater than previous', async () => { // task set to be run in 2 hrs from now const runInTwoHrs = new Date(Date.now() + moment.duration(2, 'hours').asMilliseconds()); - const task = mockTask({ id, schedule: { interval: '3h' }, runAt: runInTwoHrs }); + const task = taskManagerMock.createTask({ + id, + schedule: { interval: '3h' }, + runAt: runInTwoHrs, + }); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkUpdateSchedules([id], { interval: '5h' }); @@ -471,9 +473,13 @@ describe('TaskScheduling', () => { test('should set task run sooner if new interval is lesser than previous', async () => { // task set to be run in one 2hrs from now const runInTwoHrs = new Date(Date.now() + moment.duration(2, 'hours').asMilliseconds()); - const task = mockTask({ id, schedule: { interval: '3h' }, runAt: runInTwoHrs }); + const task = taskManagerMock.createTask({ + id, + schedule: { interval: '3h' }, + runAt: runInTwoHrs, + }); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkUpdateSchedules([id], { interval: '2h' }); @@ -490,9 +496,13 @@ describe('TaskScheduling', () => { test('should set task run to now if time that passed from last run is greater than new interval', async () => { // task set to be run in one 1hr from now. With interval of '2h', it means last run happened 1 hour ago const runInOneHr = new Date(Date.now() + moment.duration(1, 'hour').asMilliseconds()); - const task = mockTask({ id, schedule: { interval: '2h' }, runAt: runInOneHr }); + const task = taskManagerMock.createTask({ + id, + schedule: { interval: '2h' }, + runAt: runInOneHr, + }); - mockTaskStore.fetch.mockResolvedValue({ docs: [task] }); + mockTaskStore.bulkGet.mockResolvedValue([asOk(task)]); const taskScheduling = new TaskScheduling(taskSchedulingOpts); await taskScheduling.bulkUpdateSchedules([id], { interval: '30m' }); @@ -511,13 +521,15 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Idle })); - mockTaskStore.update.mockResolvedValueOnce(mockTask({ id })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Idle }) + ); + mockTaskStore.update.mockResolvedValueOnce(taskManagerMock.createTask({ id })); const result = await taskScheduling.runSoon(id); expect(mockTaskStore.update).toHaveBeenCalledWith( - mockTask({ + taskManagerMock.createTask({ id, status: TaskStatus.Idle, runAt: expect.any(Date), @@ -532,12 +544,14 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Failed })); - mockTaskStore.update.mockResolvedValueOnce(mockTask({ id })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Failed }) + ); + mockTaskStore.update.mockResolvedValueOnce(taskManagerMock.createTask({ id })); const result = await taskScheduling.runSoon(id); expect(mockTaskStore.update).toHaveBeenCalledWith( - mockTask({ + taskManagerMock.createTask({ id, status: TaskStatus.Idle, runAt: expect.any(Date), @@ -552,7 +566,9 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Idle })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Idle }) + ); mockTaskStore.update.mockRejectedValueOnce(500); const result = taskScheduling.runSoon(id); @@ -566,7 +582,9 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Idle })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Idle }) + ); mockTaskStore.update.mockRejectedValueOnce({ statusCode: 409 }); const result = await taskScheduling.runSoon(id); @@ -580,7 +598,9 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Claiming })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Claiming }) + ); mockTaskStore.update.mockRejectedValueOnce(409); const result = taskScheduling.runSoon(id); @@ -595,7 +615,9 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Running })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Running }) + ); mockTaskStore.update.mockRejectedValueOnce(409); const result = taskScheduling.runSoon(id); @@ -610,7 +632,9 @@ describe('TaskScheduling', () => { const id = '01ddff11-e88a-4d13-bc4e-256164e755e2'; const taskScheduling = new TaskScheduling(taskSchedulingOpts); - mockTaskStore.get.mockResolvedValueOnce(mockTask({ id, status: TaskStatus.Unrecognized })); + mockTaskStore.get.mockResolvedValueOnce( + taskManagerMock.createTask({ id, status: TaskStatus.Unrecognized }) + ); mockTaskStore.update.mockRejectedValueOnce(409); const result = taskScheduling.runSoon(id); @@ -633,7 +657,7 @@ describe('TaskScheduling', () => { describe('ephemeralRunNow', () => { test('runs a task ephemerally', async () => { const ephemeralEvents$ = new Subject(); - const ephemeralTask = mockTask({ + const ephemeralTask = taskManagerMock.createTask({ state: { foo: 'bar', }, @@ -679,7 +703,7 @@ describe('TaskScheduling', () => { test('rejects ephemeral task if lifecycle returns an error', async () => { const ephemeralEvents$ = new Subject(); - const ephemeralTask = mockTask({ + const ephemeralTask = taskManagerMock.createTask({ state: { foo: 'bar', }, @@ -723,7 +747,7 @@ describe('TaskScheduling', () => { }); test('rejects ephemeral task if ephemeralTaskLifecycle is not defined', async () => { - const ephemeralTask = mockTask({ + const ephemeralTask = taskManagerMock.createTask({ state: { foo: 'bar', }, @@ -820,25 +844,3 @@ describe('TaskScheduling', () => { }); }); }); - -function mockTask(overrides: Partial = {}): ConcreteTaskInstance { - return { - id: 'claimed-by-id', - runAt: new Date(), - taskType: 'foo', - schedule: undefined, - attempts: 0, - enabled: true, - status: TaskStatus.Claiming, - params: { hello: 'world' }, - state: { baby: 'Henhen' }, - user: 'jimbo', - scope: ['reporting'], - ownerId: '', - startedAt: null, - retryAt: null, - scheduledAt: new Date(), - traceparent: 'taskTraceparent', - ...overrides, - }; -} diff --git a/x-pack/plugins/task_manager/server/task_scheduling.ts b/x-pack/plugins/task_manager/server/task_scheduling.ts index 3178b85eb390b..86bf91048253f 100644 --- a/x-pack/plugins/task_manager/server/task_scheduling.ts +++ b/x-pack/plugins/task_manager/server/task_scheduling.ts @@ -7,14 +7,13 @@ import { filter, take } from 'rxjs/operators'; import pMap from 'p-map'; +import { SavedObjectError } from '@kbn/core-saved-objects-common'; import { v4 as uuidv4 } from 'uuid'; -import { chunk, pick } from 'lodash'; +import { chunk, flatten, pick } from 'lodash'; import { Subject } from 'rxjs'; import agent from 'elastic-apm-node'; import { Logger } from '@kbn/core/server'; -import { QueryDslQueryContainer } from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; -import { mustBeAllOf } from './queries/query_clauses'; import { either, isErr, mapErr } from './lib/result_type'; import { ErroredTask, @@ -40,6 +39,7 @@ import { ensureDeprecatedFieldsAreCorrected } from './lib/correct_deprecated_fie import { TaskLifecycleEvent } from './polling_lifecycle'; import { EphemeralTaskLifecycle } from './ephemeral_task_lifecycle'; import { EphemeralTaskRejectedDueToCapacityError } from './task_running'; +import { retryableBulkUpdate } from './lib/retryable_bulk_update'; const VERSION_CONFLICT_STATUS = 409; const BULK_ACTION_SIZE = 100; @@ -63,7 +63,7 @@ export interface BulkUpdateTaskResult { /** * list of failed tasks and errors caused failure */ - errors: Array<{ task: ConcreteTaskInstance; error: Error }>; + errors: Array<{ type: string; id: string; error: SavedObjectError }>; } export interface RunSoonResult { id: ConcreteTaskInstance['id']; @@ -153,52 +153,28 @@ export class TaskScheduling { } public async bulkDisable(taskIds: string[]) { - const enabledTasks = await this.bulkGetTasksHelper(taskIds, { - term: { - 'task.enabled': true, - }, + return await retryableBulkUpdate({ + taskIds, + store: this.store, + getTasks: async (ids) => await this.bulkGetTasksHelper(ids), + filter: (task) => !!task.enabled, + map: (task) => ({ ...task, enabled: false }), }); - - const updatedTasks = enabledTasks - .flatMap(({ docs }) => docs) - .reduce((acc, task) => { - // if task is not enabled, no need to update it - if (!task.enabled) { - return acc; - } - - acc.push({ ...task, enabled: false }); - return acc; - }, []); - - return await this.bulkUpdateTasksHelper(updatedTasks); } public async bulkEnable(taskIds: string[], runSoon: boolean = true) { - const disabledTasks = await this.bulkGetTasksHelper(taskIds, { - term: { - 'task.enabled': false, - }, - }); - - const updatedTasks = disabledTasks - .flatMap(({ docs }) => docs) - .reduce((acc, task) => { - // if task is enabled, no need to update it - if (task.enabled) { - return acc; - } - + return await retryableBulkUpdate({ + taskIds, + store: this.store, + getTasks: async (ids) => await this.bulkGetTasksHelper(ids), + filter: (task) => !task.enabled, + map: (task) => { if (runSoon) { - acc.push({ ...task, enabled: true, scheduledAt: new Date(), runAt: new Date() }); - } else { - acc.push({ ...task, enabled: true }); + return { ...task, enabled: true, scheduledAt: new Date(), runAt: new Date() }; } - - return acc; - }, []); - - return await this.bulkUpdateTasksHelper(updatedTasks); + return { ...task, enabled: true }; + }, + }); } /** @@ -214,20 +190,13 @@ export class TaskScheduling { taskIds: string[], schedule: IntervalSchedule ): Promise { - const tasks = await this.bulkGetTasksHelper(taskIds, { - term: { - 'task.status': 'idle', - }, - }); - - const updatedTasks = tasks - .flatMap(({ docs }) => docs) - .reduce((acc, task) => { - // if task schedule interval is the same, no need to update it - if (task.schedule?.interval === schedule.interval) { - return acc; - } - + return retryableBulkUpdate({ + taskIds, + store: this.store, + getTasks: async (ids) => await this.bulkGetTasksHelper(ids), + filter: (task) => + task.status === TaskStatus.Idle && task.schedule?.interval !== schedule.interval, + map: (task) => { const oldIntervalInMs = parseIntervalAsMillisecond(task.schedule?.interval ?? '0s'); // computing new runAt using formula: @@ -237,45 +206,18 @@ export class TaskScheduling { task.runAt.getTime() - oldIntervalInMs + parseIntervalAsMillisecond(schedule.interval) ); - acc.push({ ...task, schedule, runAt: new Date(newRunAtInMs) }); - return acc; - }, []); - - return await this.bulkUpdateTasksHelper(updatedTasks); + return { ...task, schedule, runAt: new Date(newRunAtInMs) }; + }, + }); } - private async bulkGetTasksHelper(taskIds: string[], ...must: QueryDslQueryContainer[]) { - return await pMap( + private async bulkGetTasksHelper(taskIds: string[]) { + const batches = await pMap( chunk(taskIds, BULK_ACTION_SIZE), - async (taskIdsChunk) => - this.store.fetch({ - query: mustBeAllOf( - { - terms: { - _id: taskIdsChunk.map((taskId) => `task:${taskId}`), - }, - }, - ...must - ), - size: BULK_ACTION_SIZE, - }), + async (taskIdsChunk) => this.store.bulkGet(taskIdsChunk), { concurrency: 10 } ); - } - - private async bulkUpdateTasksHelper(updatedTasks: ConcreteTaskInstance[]) { - return (await this.store.bulkUpdate(updatedTasks)).reduce( - (acc, task) => { - if (task.tag === 'ok') { - acc.tasks.push(task.value); - } else { - acc.errors.push({ error: task.error.error, task: task.error.entity }); - } - - return acc; - }, - { tasks: [], errors: [] } - ); + return flatten(batches); } /** diff --git a/x-pack/plugins/task_manager/server/task_store.mock.ts b/x-pack/plugins/task_manager/server/task_store.mock.ts index cc9aac708b2de..23818bc943508 100644 --- a/x-pack/plugins/task_manager/server/task_store.mock.ts +++ b/x-pack/plugins/task_manager/server/task_store.mock.ts @@ -26,6 +26,7 @@ export const taskStoreMock = { fetch: jest.fn(), aggregate: jest.fn(), updateByQuery: jest.fn(), + bulkGet: jest.fn(), index, taskManagerId, } as unknown as jest.Mocked; diff --git a/x-pack/plugins/task_manager/server/task_store.test.ts b/x-pack/plugins/task_manager/server/task_store.test.ts index dfc21a7142ece..7e5128ff679f0 100644 --- a/x-pack/plugins/task_manager/server/task_store.test.ts +++ b/x-pack/plugins/task_manager/server/task_store.test.ts @@ -22,6 +22,7 @@ import { SavedObjectAttributes, SavedObjectsErrorHelpers } from '@kbn/core/serve import { TaskTypeDictionary } from './task_type_dictionary'; import { mockLogger } from './test_utils'; import { AdHocTaskCounter } from './lib/adhoc_task_counter'; +import { asErr } from './lib/result_type'; const savedObjectsClient = savedObjectsRepositoryMock.create(); const serializer = savedObjectsServiceMock.createSerializer(); @@ -661,6 +662,70 @@ describe('TaskStore', () => { }); }); + describe('bulkGet', () => { + let store: TaskStore; + + beforeAll(() => { + store = new TaskStore({ + index: 'tasky', + taskManagerId: '', + serializer, + esClient: elasticsearchServiceMock.createClusterClient().asInternalUser, + definitions: taskDefinitions, + savedObjectsRepository: savedObjectsClient, + adHocTaskCounter, + }); + }); + + test('gets a task specified by id', async () => { + savedObjectsClient.bulkGet.mockResolvedValue({ saved_objects: [] }); + await store.bulkGet(['1', '2']); + expect(savedObjectsClient.bulkGet).toHaveBeenCalledWith([ + { type: 'task', id: '1' }, + { type: 'task', id: '2' }, + ]); + }); + + test('returns error when task not found', async () => { + savedObjectsClient.bulkGet.mockResolvedValue({ + saved_objects: [ + { + type: 'task', + id: '1', + attributes: {}, + references: [], + error: { + error: 'Oh no', + message: 'Oh no', + statusCode: 404, + }, + }, + ], + }); + const result = await store.bulkGet(['1']); + expect(result).toEqual([ + asErr({ + type: 'task', + id: '1', + error: { + error: 'Oh no', + message: 'Oh no', + statusCode: 404, + }, + }), + ]); + }); + + test('pushes error from saved objects client to errors$', async () => { + const firstErrorPromise = store.errors$.pipe(first()).toPromise(); + savedObjectsClient.bulkGet.mockRejectedValue(new Error('Failure')); + await expect(store.bulkGet([randomId()])).rejects.toThrowErrorMatchingInlineSnapshot( + `"Failure"` + ); + expect(await firstErrorPromise).toMatchInlineSnapshot(`[Error: Failure]`); + }); + }); + describe('getLifecycle', () => { test('returns the task status if the task exists ', async () => { expect.assertions(5); diff --git a/x-pack/plugins/task_manager/server/task_store.ts b/x-pack/plugins/task_manager/server/task_store.ts index e810ea5c1ef3e..af8dd7cc25b12 100644 --- a/x-pack/plugins/task_manager/server/task_store.ts +++ b/x-pack/plugins/task_manager/server/task_store.ts @@ -10,6 +10,7 @@ */ import { Subject } from 'rxjs'; import { omit, defaults, get } from 'lodash'; +import { SavedObjectError } from '@kbn/core-saved-objects-common'; import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey'; import type { SavedObjectsBulkDeleteResponse } from '@kbn/core/server'; @@ -75,7 +76,11 @@ export interface FetchResult { export type BulkUpdateResult = Result< ConcreteTaskInstance, - { entity: ConcreteTaskInstance; error: Error } + { type: string; id: string; error: SavedObjectError } +>; + +export type BulkGetResult = Array< + Result >; export interface UpdateByQueryResult { @@ -252,14 +257,14 @@ export class TaskStore { return attrsById; }, new Map()); - let updatedSavedObjects: Array; + let updatedSavedObjects: Array>; try { ({ saved_objects: updatedSavedObjects } = await this.savedObjectsRepository.bulkUpdate( docs.map((doc) => ({ type: 'task', id: doc.id, - options: { version: doc.version }, + version: doc.version, attributes: attributesByDocId.get(doc.id)!, })), { @@ -271,9 +276,14 @@ export class TaskStore { throw e; } - return updatedSavedObjects.map((updatedSavedObject, index) => - isSavedObjectsUpdateResponse(updatedSavedObject) - ? asOk( + return updatedSavedObjects.map((updatedSavedObject) => { + return updatedSavedObject.error !== undefined + ? asErr({ + type: 'task', + id: updatedSavedObject.id, + error: updatedSavedObject.error, + }) + : asOk( savedObjectToConcreteTaskInstance({ ...updatedSavedObject, attributes: defaults( @@ -281,15 +291,8 @@ export class TaskStore { attributesByDocId.get(updatedSavedObject.id)! ), }) - ) - : asErr({ - // The SavedObjectsRepository maintains the order of the docs - // so we can rely on the index in the `docs` to match an error - // on the same index in the `bulkUpdate` result - entity: docs[index], - error: updatedSavedObject, - }) - ); + ); + }); } /** @@ -340,6 +343,30 @@ export class TaskStore { return savedObjectToConcreteTaskInstance(result); } + /** + * Gets tasks by ids + * + * @param {Array} ids + * @returns {Promise} + */ + public async bulkGet(ids: string[]): Promise { + let result; + try { + result = await this.savedObjectsRepository.bulkGet( + ids.map((id) => ({ type: 'task', id })) + ); + } catch (e) { + this.errors$.next(e); + throw e; + } + return result.saved_objects.map((task) => { + if (task.error) { + return asErr({ id: task.id, type: task.type, error: task.error }); + } + return asOk(savedObjectToConcreteTaskInstance(task)); + }); + } + /** * Gets task lifecycle step by id * @@ -535,9 +562,3 @@ function ensureAggregationOnlyReturnsTaskObjects(opts: AggregationOpts): Aggrega query, }; } - -function isSavedObjectsUpdateResponse( - result: SavedObjectsUpdateResponse | Error -): result is SavedObjectsUpdateResponse { - return result && typeof (result as SavedObjectsUpdateResponse).id === 'string'; -} diff --git a/x-pack/plugins/task_manager/tsconfig.json b/x-pack/plugins/task_manager/tsconfig.json index 2dbc39fb70725..0caec8f729150 100644 --- a/x-pack/plugins/task_manager/tsconfig.json +++ b/x-pack/plugins/task_manager/tsconfig.json @@ -17,6 +17,7 @@ "@kbn/safer-lodash-set", "@kbn/es-types", "@kbn/apm-utils", + "@kbn/core-saved-objects-common", ], "exclude": [ "target/**/*", diff --git a/x-pack/plugins/translations/translations/fr-FR.json b/x-pack/plugins/translations/translations/fr-FR.json index 7bc02c0c7cdf1..879d5c195b1d3 100644 --- a/x-pack/plugins/translations/translations/fr-FR.json +++ b/x-pack/plugins/translations/translations/fr-FR.json @@ -2072,9 +2072,6 @@ "discover.fieldChooser.discoverField.addButtonAriaLabel": "Ajouter {field} au tableau", "discover.fieldChooser.discoverField.removeButtonAriaLabel": "Supprimer {field} du tableau", "discover.fieldChooser.fieldCalculator.fieldIsNotPresentInDocumentsErrorMessage": "Ce champ est présent dans votre mapping Elasticsearch, mais pas dans les {hitsLength} documents affichés dans le tableau des documents. Cependant, vous pouvez toujours le consulter ou effectuer une recherche dessus.", - "discover.fieldChooser.filter.fieldSelectorLabel": "Sélection des options du filtre {id}", - "discover.fieldNameDescription.dateRangeField": "Range of {dateFieldTypeLink} values. {viewSupportedDateFormatsLink}", - "discover.fieldNameDescription.versionField": "Versions des logiciels. Prend en charge les règles de priorité de {SemanticVersioningLink}.", "discover.grid.copyClipboardButtonTitle": "Copier la valeur de {column}", "discover.grid.copyColumnValuesToClipboard.toastTitle": "Valeurs de la colonne \"{column}\" copiées dans le presse-papiers", "discover.grid.filterForAria": "Filtrer sur cette {value}", @@ -2104,7 +2101,6 @@ "discover.advancedSettings.defaultColumnsText": "Les colonnes affichées par défaut dans l'application Discover. Si elles sont vides, un résumé du document s’affiche.", "discover.advancedSettings.defaultColumnsTitle": "Colonnes par défaut", "discover.advancedSettings.disableDocumentExplorer": "Explorateur de documents ou vue classique", - "discover.advancedSettings.discover.fieldNameDescription.versionFieldLinkText": "Gestion sémantique des versions", "discover.advancedSettings.discover.fieldStatisticsLinkText": "Vue des statistiques de champ", "discover.advancedSettings.discover.modifyColumnsOnSwitchText": "Supprimez les colonnes qui ne sont pas disponibles dans la nouvelle vue de données.", "discover.advancedSettings.discover.modifyColumnsOnSwitchTitle": "Modifier les colonnes en cas de changement des vues de données", @@ -2271,64 +2267,10 @@ "discover.fieldChooser.discoverField.value": "Valeur", "discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForGeoFieldsErrorMessage": "L'analyse n'est pas disponible pour les champs géométriques.", "discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForObjectFieldsErrorMessage": "L'analyse n'est pas disponible pour les champs d'objet.", - "discover.fieldChooser.fieldFilterButtonLabel": "Filtrer par type", "discover.fieldChooser.fieldsMobileButtonLabel": "Champs", - "discover.fieldChooser.filter.aggregatableLabel": "Regroupable", - "discover.fieldChooser.filter.filterByTypeLabel": "Filtrer par type", "discover.fieldChooser.filter.indexAndFieldsSectionAriaLabel": "Index et champs", - "discover.fieldChooser.filter.searchableLabel": "Interrogeable", - "discover.fieldChooser.filter.toggleButton.any": "tout", - "discover.fieldChooser.filter.toggleButton.no": "non", - "discover.fieldChooser.filter.toggleButton.yes": "oui", - "discover.fieldChooser.filter.typeLabel": "Type", - "discover.fieldChooser.popoverTitle": "Types de champ", - "discover.fieldChooser.searchPlaceHolder": "Rechercher les noms de champs", - "discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "Masquer les paramètres de filtre de champs", - "discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "Afficher les paramètres de filtre de champs", "discover.fieldList.flyoutBackIcon": "Retour", "discover.fieldList.flyoutHeading": "Liste des champs", - "discover.fieldNameDescription.booleanField": "Valeurs vraies ou fausses.", - "discover.fieldNameDescription.conflictField": "Le champ possède des valeurs de différents types. Corrigez le problème dans Gestion > Vues de données.", - "discover.fieldNameDescription.dateField": "Chaîne de date ou nombre de secondes ou de millisecondes depuis 1/1/1970.", - "discover.fieldNameDescription.dateRangeFieldLinkText": "date", - "discover.fieldNameDescription.geoPointField": "Points de latitude et de longitude.", - "discover.fieldNameDescription.geoShapeField": "Formes complexes, telles que des polygones.", - "discover.fieldNameDescription.histogramField": "Valeurs numériques pré-agrégées sous forme d'histogramme.", - "discover.fieldNameDescription.ipAddressField": "Adresses IPv4 et IPv6.", - "discover.fieldNameDescription.ipAddressRangeField": "Plage de valeurs IP prenant en charge les adresses IPv4 ou IPv6 (ou les 2).", - "discover.fieldNameDescription.keywordField": "Contenu structuré tel qu'un ID, une adresse e-mail, un nom d'hôte, un code de statut, ou une balise.", - "discover.fieldNameDescription.murmur3Field": "Champ qui calcule et stocke les hachages de valeurs.", - "discover.fieldNameDescription.nestedField": "Objet JSON qui conserve la relation entre ses sous-champs.", - "discover.fieldNameDescription.numberField": "Valeurs Long, Entier, Court, Octet, Double et Élément flottant.", - "discover.fieldNameDescription.stringField": "Texte intégral tel que le corps d'un e-mail ou la description d'un produit.", - "discover.fieldNameDescription.textField": "Texte intégral tel que le corps d'un e-mail ou la description d'un produit.", - "discover.fieldNameDescription.unknownField": "Champ inconnu", - "discover.fieldNameDescription.viewSupportedDateFormatsLinkText": "Affichez les formats de date pris en charge.", - "discover.fieldNameIcons.booleanAriaLabel": "Champ booléen", - "discover.fieldNameIcons.conflictFieldAriaLabel": "Champ conflictuel", - "discover.fieldNameIcons.dateFieldAriaLabel": "Champ de date", - "discover.fieldNameIcons.dateRangeFieldAriaLabel": "Champ de plage de dates", - "discover.fieldNameIcons.geoPointFieldAriaLabel": "Champ de point géographique", - "discover.fieldNameIcons.geoShapeFieldAriaLabel": "Champ de forme géométrique", - "discover.fieldNameIcons.histogramFieldAriaLabel": "Champ d'histogramme", - "discover.fieldNameIcons.ipAddressFieldAriaLabel": "Champ d'adresse IP", - "discover.fieldNameIcons.ipRangeFieldAriaLabel": "Champ de plage d’IP", - "discover.fieldNameIcons.keywordFieldAriaLabel": "Champ de mot-clé", - "discover.fieldNameIcons.murmur3FieldAriaLabel": "Champ Murmur3", - "discover.fieldNameIcons.nestedFieldAriaLabel": "Champ imbriqué", - "discover.fieldNameIcons.numberFieldAriaLabel": "Champ numérique", - "discover.fieldNameIcons.sourceFieldAriaLabel": "Champ source", - "discover.fieldNameIcons.stringFieldAriaLabel": "Champ de chaîne", - "discover.fieldNameIcons.textFieldAriaLabel": "Champ de texte", - "discover.fieldNameIcons.unknownFieldAriaLabel": "Champ inconnu", - "discover.fieldNameIcons.versionFieldAriaLabel": "Champ de version", - "discover.fieldTypesPopover.buttonAriaLabel": "Aide sur le type de filtre", - "discover.fieldTypesPopover.dataTypeColumnTitle": "Type de données", - "discover.fieldTypesPopover.descriptionColumnTitle": "Description", - "discover.fieldTypesPopover.fieldTypesDocLinkLabel": "types de champ", - "discover.fieldTypesPopover.iconTitle": "Aide sur le type de filtre", - "discover.fieldTypesPopover.learnMoreText": "Découvrez", - "discover.fieldTypesPopover.tableTitle": "Description des types de champ", "discover.grid.closePopover": "Fermer la fenêtre contextuelle", "discover.grid.copyClipboardButton": "Copier dans le presse-papiers", "discover.grid.copyColumnNameToClipboard.toastTitle": "Copié dans le presse-papiers", @@ -5162,9 +5104,6 @@ "unifiedFieldList.fieldStats.filterOutValueButtonAriaLabel": "Exclure le {field} : \"{value}\"", "unifiedFieldList.fieldStats.filterValueButtonAriaLabel": "Filtrer sur le {field} : \"{value}\"", "unifiedFieldList.fieldStats.noFieldDataInSampleDescription": "Aucune donnée de champ pour {sampledDocumentsFormatted} {sampledDocuments, plural, one {exemple d'enregistrement} other {exemples d'enregistrement}}.", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.deprecation": "Ce paramètre est déclassé et ne sera plus pris en charge à partir de la version 8.6.", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.description": "Lorsque cette option est activée, l’échantillonnage de document est utilisé pour déterminer l’existence des champs (disponibles ou vides) pour la liste de champs Lens au lieu de se fonder sur les mappings d’index.", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.title": "Utiliser l’échantillonnage d’existence des champs", "unifiedFieldList.fieldList.noFieldsCallout.noDataLabel": "Aucun champ.", "unifiedFieldList.fieldList.noFieldsCallout.noFields.extendTimeBullet": "Extension de la plage temporelle", "unifiedFieldList.fieldList.noFieldsCallout.noFields.fieldTypeFilterBullet": "Utilisation de différents filtres de champ", @@ -11874,7 +11813,7 @@ "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.addDocument.helptext": "Tester avec un document de votre index", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.description": "Vous pouvez simuler les résultats de votre pipeline en transmettant un tableau de documents.", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.runButton": "Simuler un pipeline", - "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle": "Documents", + "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle.documents": "Documents", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.title": "Consulter les résultats de pipeline (facultatif)", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.title": "Ajouter un pipeline d'inférence", "xpack.enterpriseSearch.content.indices.pipelines.ingestionPipeline.apiIndexSubtitle": "Les pipelines d'ingestion optimisent votre index pour les applications de recherche. Si vous souhaitez utiliser ces pipelines dans votre index basé sur des API, vous devrez les référencer explicitement dans vos requêtes d'API.", @@ -18191,7 +18130,6 @@ "xpack.lens.indexPattern.timeShiftSmallWarning": "{label} utilise un décalage temporel de {columnTimeShift} qui est inférieur à l'intervalle de l'histogramme des dates de {interval}. Pour éviter une non-correspondance des données, utilisez un multiple de {interval} comme décalage.", "xpack.lens.indexPattern.tsdbRollupWarning": "{label} utilise une fonction qui n'est pas prise en charge par les données cumulées. Sélectionnez une autre fonction ou modifiez la plage temporelle.", "xpack.lens.indexPattern.uniqueLabel": "{label} [{num}]", - "xpack.lens.indexPattern.useFieldExistenceSamplingBody": "L'échantillonnage d'existence des champs a été déclassé et sera retiré dans Kibana {version}. Vous pouvez désactiver cette fonctionnalité dans {link}.", "xpack.lens.indexPattern.valueCountOf": "Nombre de {name}", "xpack.lens.indexPatternSuggestion.removeLayerLabel": "Afficher uniquement {indexPatternTitle}", "xpack.lens.indexPatternSuggestion.removeLayerPositionLabel": "Afficher uniquement le calque {layerNumber}", @@ -18525,7 +18463,6 @@ "xpack.lens.indexPattern.advancedSettings": "Avancé", "xpack.lens.indexPattern.allFieldsForTextBasedLabelHelp": "Glissez-déposez les champs disponibles dans l’espace de travail et créez des visualisations. Pour modifier les champs disponibles, modifiez votre requête.", "xpack.lens.indexPattern.allFieldsLabelHelp": "Glissez-déposez les champs disponibles dans l’espace de travail et créez des visualisations. Pour modifier les champs disponibles, sélectionnez une vue de données différente, modifiez vos requêtes ou utilisez une plage temporelle différente. Certains types de champ ne peuvent pas être visualisés dans Lens, y compris les champ de texte intégral et champs géographiques.", - "xpack.lens.indexPattern.allFieldsSamplingLabelHelp": "Les champs disponibles contiennent les données des 500 premiers documents correspondant aux filtres. Pour afficher tous les filtres, développez les champs vides. Vous ne pouvez pas créer de visualisations avec des champs de texte intégral, géographiques, lissés et d’objet.", "xpack.lens.indexPattern.ascendingCountPrecisionErrorWarning.link": "veuillez consulter la documentation", "xpack.lens.indexPattern.availableFieldsLabel": "Champs disponibles", "xpack.lens.indexPattern.avg": "Moyenne", @@ -18592,7 +18529,6 @@ "xpack.lens.indexPattern.fieldStatsButtonEmptyLabel": "Ce champ ne comporte aucune donnée mais vous pouvez toujours effectuer un glisser-déposer pour visualiser.", "xpack.lens.indexPattern.fieldStatsButtonLabel": "Cliquez pour obtenir un aperçu du champ, ou effectuez un glisser-déposer pour visualiser.", "xpack.lens.indexPattern.fieldStatsNoData": "Lens ne peut pas créer de visualisation avec ce champ, car il ne contient pas de données. Pour créer une visualisation, glissez-déposez un autre champ.", - "xpack.lens.indexPattern.fieldStatsSamplingNoData": "Lens ne peut pas créer de visualisation avec ce champ, car il ne contient aucune donnée dans les 500 premiers documents correspondant aux filtres. Pour créer une visualisation, glissez-déposez un autre champ.", "xpack.lens.indexPattern.filterBy.clickToEdit": "Cliquer pour modifier", "xpack.lens.indexPattern.filterBy.emptyFilterQuery": "(vide)", "xpack.lens.indexPattern.filterBy.label": "Filtrer par", @@ -18792,7 +18728,6 @@ "xpack.lens.indexPattern.timeShift.year": "Il y a 1 an (1y)", "xpack.lens.indexPattern.timeShiftPlaceholder": "Saisissez des valeurs personnalisées (par ex. 8w)", "xpack.lens.indexPattern.useAsTopLevelAgg": "Agréger d'abord en fonction de cette dimension", - "xpack.lens.indexPattern.useFieldExistenceSampling.advancedSettings": "Paramètres avancés", "xpack.lens.label.gauge.labelMajor.header": "Titre", "xpack.lens.label.gauge.labelMinor.header": "Sous-titre", "xpack.lens.label.header": "Étiquette", @@ -26737,7 +26672,6 @@ "xpack.securitySolution.console.commandValidation.exclusiveOr": "Cette commande ne prend en charge qu'un seul des arguments suivants : {argNames}", "xpack.securitySolution.console.commandValidation.invalidArgValue": "Valeur d'argument non valide : {argName}. {error}", "xpack.securitySolution.console.commandValidation.missingRequiredArg": "Argument requis manquant : {argName}", - "xpack.securitySolution.console.commandValidation.mustHaveArgs": "Arguments requis manquants : {requiredArgs}", "xpack.securitySolution.console.commandValidation.unknownArgument": "{countOfInvalidArgs, plural, =1 {Argument} other {Arguments}} de {command} non pris en charge par cette commande : {unknownArgs}", "xpack.securitySolution.console.commandValidation.unsupportedArg": "Argument non pris en charge : {argName}", "xpack.securitySolution.console.sidePanel.helpDescription": "Utilisez le bouton Ajouter ({icon}) pour insérer une action de réponse dans la barre de texte. Le cas échéant, ajoutez des paramètres ou commentaires supplémentaires.", diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index f7737d7fcf9aa..402ba651a3275 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -2070,9 +2070,6 @@ "discover.fieldChooser.discoverField.addButtonAriaLabel": "{field}を表に追加", "discover.fieldChooser.discoverField.removeButtonAriaLabel": "{field}を表から削除", "discover.fieldChooser.fieldCalculator.fieldIsNotPresentInDocumentsErrorMessage": "このフィールドはElasticsearchマッピングに表示されますが、ドキュメントテーブルの{hitsLength}件のドキュメントには含まれません。可視化や検索は可能な場合があります。", - "discover.fieldChooser.filter.fieldSelectorLabel": "{id}フィルターオプションの選択", - "discover.fieldNameDescription.dateRangeField": "{dateFieldTypeLink}値の範囲。{viewSupportedDateFormatsLink}", - "discover.fieldNameDescription.versionField": "ソフトウェアバージョン。{SemanticVersioningLink}優先度ルールをサポートします。", "discover.grid.copyClipboardButtonTitle": "{column}の値をコピー", "discover.grid.copyColumnValuesToClipboard.toastTitle": "\"{column}\"列の値がクリップボードにコピーされました", "discover.grid.filterForAria": "この{value}でフィルターを適用", @@ -2102,7 +2099,6 @@ "discover.advancedSettings.defaultColumnsText": "デフォルトでDiscoverアプリに表示される列。空の場合、ドキュメントの概要が表示されます。", "discover.advancedSettings.defaultColumnsTitle": "デフォルトの列", "discover.advancedSettings.disableDocumentExplorer": "ドキュメントエクスプローラーまたはクラシックビュー", - "discover.advancedSettings.discover.fieldNameDescription.versionFieldLinkText": "セマンティックバージョニング", "discover.advancedSettings.discover.fieldStatisticsLinkText": "フィールド統計情報ビュー", "discover.advancedSettings.discover.modifyColumnsOnSwitchText": "新しいデータビューで使用できない列を削除します。", "discover.advancedSettings.discover.modifyColumnsOnSwitchTitle": "データビューを変更するときに列を修正", @@ -2269,64 +2265,10 @@ "discover.fieldChooser.discoverField.value": "値", "discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForGeoFieldsErrorMessage": "ジオフィールドは分析できません。", "discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForObjectFieldsErrorMessage": "オブジェクトフィールドは分析できません。", - "discover.fieldChooser.fieldFilterButtonLabel": "タイプでフィルタリング", "discover.fieldChooser.fieldsMobileButtonLabel": "フィールド", - "discover.fieldChooser.filter.aggregatableLabel": "集約可能", - "discover.fieldChooser.filter.filterByTypeLabel": "タイプでフィルタリング", "discover.fieldChooser.filter.indexAndFieldsSectionAriaLabel": "インデックスとフィールド", - "discover.fieldChooser.filter.searchableLabel": "検索可能", - "discover.fieldChooser.filter.toggleButton.any": "すべて", - "discover.fieldChooser.filter.toggleButton.no": "いいえ", - "discover.fieldChooser.filter.toggleButton.yes": "はい", - "discover.fieldChooser.filter.typeLabel": "型", - "discover.fieldChooser.popoverTitle": "フィールド型", - "discover.fieldChooser.searchPlaceHolder": "検索フィールド名", - "discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "フィールド設定を非表示", - "discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "フィールド設定を表示", "discover.fieldList.flyoutBackIcon": "戻る", "discover.fieldList.flyoutHeading": "フィールドリスト", - "discover.fieldNameDescription.booleanField": "True および False 値。", - "discover.fieldNameDescription.conflictField": "フィールドには異なる型の値があります。［管理 > データビュー］で解決してください。", - "discover.fieldNameDescription.dateField": "日付文字列、または1/1/1970以降の秒またはミリ秒の数値。", - "discover.fieldNameDescription.dateRangeFieldLinkText": "日付", - "discover.fieldNameDescription.geoPointField": "緯度および経度点。", - "discover.fieldNameDescription.geoShapeField": "多角形などの複雑な図形。", - "discover.fieldNameDescription.histogramField": "ヒストグラムの形式の集計された数値。", - "discover.fieldNameDescription.ipAddressField": "IPv4およびIPv6アドレス。", - "discover.fieldNameDescription.ipAddressRangeField": "IPv4またはIPv6（または混合）のアドレスをサポートするIP値の範囲。", - "discover.fieldNameDescription.keywordField": "ID、電子メールアドレス、ホスト名、ステータスコード、タグなどの構造化されたコンテンツ。", - "discover.fieldNameDescription.murmur3Field": "値のハッシュタグを計算して格納するフィールド。", - "discover.fieldNameDescription.nestedField": "サブフィールド間の関係を保持するJSONオブジェクト。", - "discover.fieldNameDescription.numberField": "長整数、整数、短整数、バイト、倍精度浮動小数点数、浮動小数点数の値。", - "discover.fieldNameDescription.stringField": "電子メール本文や製品説明などの全文テキスト。", - "discover.fieldNameDescription.textField": "電子メール本文や製品説明などの全文テキスト。", - "discover.fieldNameDescription.unknownField": "不明なフィールド", - "discover.fieldNameDescription.viewSupportedDateFormatsLinkText": "サポートされている日付形式を表示します。", - "discover.fieldNameIcons.booleanAriaLabel": "ブールフィールド", - "discover.fieldNameIcons.conflictFieldAriaLabel": "矛盾フィールド", - "discover.fieldNameIcons.dateFieldAriaLabel": "日付フィールド", - "discover.fieldNameIcons.dateRangeFieldAriaLabel": "日付範囲フィールド", - "discover.fieldNameIcons.geoPointFieldAriaLabel": "地理ポイントフィールド", - "discover.fieldNameIcons.geoShapeFieldAriaLabel": "地理情報シェイプフィールド", - "discover.fieldNameIcons.histogramFieldAriaLabel": "ヒストグラムフィールド", - "discover.fieldNameIcons.ipAddressFieldAriaLabel": "IPアドレスフィールド", - "discover.fieldNameIcons.ipRangeFieldAriaLabel": "IP範囲フィールド", - "discover.fieldNameIcons.keywordFieldAriaLabel": "キーワードフィールド", - "discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3フィールド", - "discover.fieldNameIcons.nestedFieldAriaLabel": "入れ子フィールド", - "discover.fieldNameIcons.numberFieldAriaLabel": "数値フィールド", - "discover.fieldNameIcons.sourceFieldAriaLabel": "ソースフィールド", - "discover.fieldNameIcons.stringFieldAriaLabel": "文字列フィールド", - "discover.fieldNameIcons.textFieldAriaLabel": "テキストフィールド", - "discover.fieldNameIcons.unknownFieldAriaLabel": "不明なフィールド", - "discover.fieldNameIcons.versionFieldAriaLabel": "バージョンフィールド", - "discover.fieldTypesPopover.buttonAriaLabel": "フィルタータイプのヘルプ", - "discover.fieldTypesPopover.dataTypeColumnTitle": "データ型", - "discover.fieldTypesPopover.descriptionColumnTitle": "説明", - "discover.fieldTypesPopover.fieldTypesDocLinkLabel": "フィールド型", - "discover.fieldTypesPopover.iconTitle": "フィルタータイプのヘルプ", - "discover.fieldTypesPopover.learnMoreText": "詳細", - "discover.fieldTypesPopover.tableTitle": "フィールド型の説明", "discover.grid.closePopover": "ポップオーバーを閉じる", "discover.grid.copyClipboardButton": "クリップボードにコピー", "discover.grid.copyColumnNameToClipboard.toastTitle": "クリップボードにコピーされました", @@ -5159,9 +5101,6 @@ "unifiedFieldList.fieldStats.filterOutValueButtonAriaLabel": "{field}を除外：\"{value}\"", "unifiedFieldList.fieldStats.filterValueButtonAriaLabel": "{field}を除外：\"{value}\"", "unifiedFieldList.fieldStats.noFieldDataInSampleDescription": "{sampledDocumentsFormatted}サンプル{sampledDocuments, plural, other {レコード}}のフィールドデータがありません。", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.deprecation": "この設定はサポートが終了し、8.6以降ではサポートされません。", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.description": "有効な場合、インデックスマッピングを使用するのではなく、ドキュメントサンプリングを使用して、Lensフィールドリストのフィールドの存在（使用可能または空）を決定します。", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.title": "フィールド存在サンプリングを使用", "unifiedFieldList.fieldList.noFieldsCallout.noDataLabel": "フィールドがありません。", "unifiedFieldList.fieldList.noFieldsCallout.noFields.extendTimeBullet": "時間範囲を拡張中", "unifiedFieldList.fieldList.noFieldsCallout.noFields.fieldTypeFilterBullet": "別のフィールドフィルターを使用", @@ -11861,7 +11800,7 @@ "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.addDocument.helptext": "インデックスからのドキュメントでテスト", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.description": "パイプライン結果をシミュレートするには、ドキュメントの配列を渡します。", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.runButton": "パイプラインのシミュレート", - "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle": "ドキュメント", + "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle.documents": "ドキュメント", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.title": "パイプライン結果の確認（任意）", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.title": "推論パイプラインの追加", "xpack.enterpriseSearch.content.indices.pipelines.ingestionPipeline.apiIndexSubtitle": "インジェストパイプラインは、検索アプリケーションのインデックスを最適化します。APIベースのインデックスでこれらのパイプラインを使用する場合は、APIリクエストで明示的に参照する必要があります。", @@ -18171,7 +18110,6 @@ "xpack.lens.indexPattern.timeShiftSmallWarning": "{label}は{columnTimeShift}の時間シフトを使用しています。これは{interval}の日付ヒストグラム間隔よりも小さいです。不一致のデータを防止するには、時間シフトとして{interval}を使用します。", "xpack.lens.indexPattern.tsdbRollupWarning": "{label}は、ロールアップされたデータによってサポートされていない関数を使用しています。別の関数を選択するか、時間範囲を選択してください。", "xpack.lens.indexPattern.uniqueLabel": "{label} [{num}]", - "xpack.lens.indexPattern.useFieldExistenceSamplingBody": "フィールド存在サンプリングは廃止予定であり、Kibana {version}で削除される予定です。{link}でこの機能を無効化できます。", "xpack.lens.indexPattern.valueCountOf": "{name}のカウント", "xpack.lens.indexPatternSuggestion.removeLayerLabel": "{indexPatternTitle}のみを表示", "xpack.lens.indexPatternSuggestion.removeLayerPositionLabel": "レイヤー{layerNumber}のみを表示", @@ -18507,7 +18445,6 @@ "xpack.lens.indexPattern.advancedSettings": "高度な設定", "xpack.lens.indexPattern.allFieldsForTextBasedLabelHelp": "使用可能なフィールドをワークスペースまでドラッグし、ビジュアライゼーションを作成します。使用可能なフィールドを変更するには、クエリを編集します。", "xpack.lens.indexPattern.allFieldsLabelHelp": "使用可能なフィールドをワークスペースまでドラッグし、ビジュアライゼーションを作成します。使用可能なフィールドを変更するには、別のデータビューを選択するか、クエリを編集するか、別の時間範囲を使用します。一部のフィールドタイプは、完全なテキストおよびグラフィックフィールドを含む Lens では、ビジュアライゼーションできません。", - "xpack.lens.indexPattern.allFieldsSamplingLabelHelp": "使用可能なフィールドには、フィルターと一致する最初の 500 件のドキュメントのデータがあります。すべてのフィールドを表示するには、空のフィールドを展開します。全文、地理、フラット化、オブジェクトフィールドでビジュアライゼーションを作成できません。", "xpack.lens.indexPattern.ascendingCountPrecisionErrorWarning.link": "ドキュメントをご覧ください", "xpack.lens.indexPattern.availableFieldsLabel": "利用可能なフィールド", "xpack.lens.indexPattern.avg": "平均", @@ -18574,7 +18511,6 @@ "xpack.lens.indexPattern.fieldStatsButtonEmptyLabel": "このフィールドにはデータがありませんが、ドラッグアンドドロップで可視化できます。", "xpack.lens.indexPattern.fieldStatsButtonLabel": "フィールドプレビューを表示するには、クリックします。可視化するには、ドラッグアンドドロップします。", "xpack.lens.indexPattern.fieldStatsNoData": "Lensはこのフィールドのビジュアライゼーションを作成できません。フィールドにデータがありません。ビジュアライゼーションを作成するには、別のフィールドをドラッグします。", - "xpack.lens.indexPattern.fieldStatsSamplingNoData": "Lensはこのフィールドのビジュアライゼーションを作成できません。フィルターと一致する最初の500件のドキュメントではフィールドにデータがありません。ビジュアライゼーションを作成するには、別のフィールドをドラッグします。", "xpack.lens.indexPattern.filterBy.clickToEdit": "クリックして編集", "xpack.lens.indexPattern.filterBy.emptyFilterQuery": "（空）", "xpack.lens.indexPattern.filterBy.label": "フィルタリング条件", @@ -18774,7 +18710,6 @@ "xpack.lens.indexPattern.timeShift.year": "1年前（1y）", "xpack.lens.indexPattern.timeShiftPlaceholder": "カスタム値を入力（例：8w）", "xpack.lens.indexPattern.useAsTopLevelAgg": "最初にこのディメンションで集約", - "xpack.lens.indexPattern.useFieldExistenceSampling.advancedSettings": "高度な設定", "xpack.lens.label.gauge.labelMajor.header": "タイトル", "xpack.lens.label.gauge.labelMinor.header": "サブタイトル", "xpack.lens.label.header": "ラベル", @@ -26713,7 +26648,6 @@ "xpack.securitySolution.console.commandValidation.exclusiveOr": "このコマンドは次の引数のいずれかのみをサポートします：{argNames}", "xpack.securitySolution.console.commandValidation.invalidArgValue": "無効な引数値：{argName}。{error}", "xpack.securitySolution.console.commandValidation.missingRequiredArg": "不足している必須の引数：{argName}", - "xpack.securitySolution.console.commandValidation.mustHaveArgs": "不足している必須の引数：{requiredArgs}", "xpack.securitySolution.console.commandValidation.unknownArgument": "次の{command} {countOfInvalidArgs, plural, other {引数}}はこのコマンドでサポートされていません：{unknownArgs}", "xpack.securitySolution.console.commandValidation.unsupportedArg": "サポートされていない引数：{argName}", "xpack.securitySolution.console.sidePanel.helpDescription": "追加（{icon}）ボタンを使用して、テキストバーに対応アクションを入力します。必要に応じて、パラメーターまたはコメントを追加します。", diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 2cf614e7aedea..70d591e4bd3bf 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -2074,9 +2074,6 @@ "discover.fieldChooser.discoverField.addButtonAriaLabel": "将 {field} 添加到表中", "discover.fieldChooser.discoverField.removeButtonAriaLabel": "从表中移除 {field}", "discover.fieldChooser.fieldCalculator.fieldIsNotPresentInDocumentsErrorMessage": "此字段在您的 Elasticsearch 映射中，但不在文档表中显示的 {hitsLength} 个文档中。您可能仍能够基于它可视化或搜索。", - "discover.fieldChooser.filter.fieldSelectorLabel": "{id} 筛选选项的选择", - "discover.fieldNameDescription.dateRangeField": "{dateFieldTypeLink} 值的范围。{viewSupportedDateFormatsLink}", - "discover.fieldNameDescription.versionField": "软件版本。支持 {SemanticVersioningLink} 优先规则。", "discover.grid.copyClipboardButtonTitle": "复制 {column} 的值", "discover.grid.copyColumnValuesToClipboard.toastTitle": "“{column}”列的值已复制到剪贴板", "discover.grid.filterForAria": "筛留此 {value}", @@ -2106,7 +2103,6 @@ "discover.advancedSettings.defaultColumnsText": "Discover 应用中默认显示的列。如果为空，将显示文档摘要。", "discover.advancedSettings.defaultColumnsTitle": "默认列", "discover.advancedSettings.disableDocumentExplorer": "Document Explorer 或经典视图", - "discover.advancedSettings.discover.fieldNameDescription.versionFieldLinkText": "语义版本控制", "discover.advancedSettings.discover.fieldStatisticsLinkText": "字段统计信息视图", "discover.advancedSettings.discover.modifyColumnsOnSwitchText": "移除新数据视图中不存在的列。", "discover.advancedSettings.discover.modifyColumnsOnSwitchTitle": "在更改数据视图时修改列", @@ -2273,64 +2269,10 @@ "discover.fieldChooser.discoverField.value": "值", "discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForGeoFieldsErrorMessage": "分析不适用于地理字段。", "discover.fieldChooser.fieldCalculator.analysisIsNotAvailableForObjectFieldsErrorMessage": "分析不适用于对象字段。", - "discover.fieldChooser.fieldFilterButtonLabel": "按类型筛选", "discover.fieldChooser.fieldsMobileButtonLabel": "字段", - "discover.fieldChooser.filter.aggregatableLabel": "可聚合", - "discover.fieldChooser.filter.filterByTypeLabel": "按类型筛选", "discover.fieldChooser.filter.indexAndFieldsSectionAriaLabel": "索引和字段", - "discover.fieldChooser.filter.searchableLabel": "可搜索", - "discover.fieldChooser.filter.toggleButton.any": "任意", - "discover.fieldChooser.filter.toggleButton.no": "否", - "discover.fieldChooser.filter.toggleButton.yes": "是", - "discover.fieldChooser.filter.typeLabel": "类型", - "discover.fieldChooser.popoverTitle": "字段类型", - "discover.fieldChooser.searchPlaceHolder": "搜索字段名称", - "discover.fieldChooser.toggleFieldFilterButtonHideAriaLabel": "隐藏字段筛选设置", - "discover.fieldChooser.toggleFieldFilterButtonShowAriaLabel": "显示字段筛选设置", "discover.fieldList.flyoutBackIcon": "返回", "discover.fieldList.flyoutHeading": "字段列表", - "discover.fieldNameDescription.booleanField": "True 和 False 值。", - "discover.fieldNameDescription.conflictField": "字体具有不同类型的值。在“管理”>“数据视图”中解析。", - "discover.fieldNameDescription.dateField": "日期字符串或 1/1/1970 以来的秒数或毫秒数。", - "discover.fieldNameDescription.dateRangeFieldLinkText": "日期", - "discover.fieldNameDescription.geoPointField": "纬度和经度点。", - "discover.fieldNameDescription.geoShapeField": "复杂形状，如多边形。", - "discover.fieldNameDescription.histogramField": "直方图形式的预聚合数字值。", - "discover.fieldNameDescription.ipAddressField": "IPv4 和 IPv6 地址。", - "discover.fieldNameDescription.ipAddressRangeField": "支持 IPv4 或 IPv6（或混合）地址的 IP 值的范围。", - "discover.fieldNameDescription.keywordField": "结构化内容，如 ID、电子邮件地址、主机名、状态代码或标签。", - "discover.fieldNameDescription.murmur3Field": "计算和存储值哈希的字段。", - "discover.fieldNameDescription.nestedField": "保留其子字段之间关系的 JSON 对象。", - "discover.fieldNameDescription.numberField": "长整型、整数、短整型、字节、双精度和浮点值。", - "discover.fieldNameDescription.stringField": "全文本，如电子邮件正文或产品描述。", - "discover.fieldNameDescription.textField": "全文本，如电子邮件正文或产品描述。", - "discover.fieldNameDescription.unknownField": "未知字段", - "discover.fieldNameDescription.viewSupportedDateFormatsLinkText": "查看支持的日期格式。", - "discover.fieldNameIcons.booleanAriaLabel": "布尔值字段", - "discover.fieldNameIcons.conflictFieldAriaLabel": "冲突字段", - "discover.fieldNameIcons.dateFieldAriaLabel": "日期字段", - "discover.fieldNameIcons.dateRangeFieldAriaLabel": "日期范围字段", - "discover.fieldNameIcons.geoPointFieldAriaLabel": "地理点字段", - "discover.fieldNameIcons.geoShapeFieldAriaLabel": "几何形状字段", - "discover.fieldNameIcons.histogramFieldAriaLabel": "直方图字段", - "discover.fieldNameIcons.ipAddressFieldAriaLabel": "IP 地址字段", - "discover.fieldNameIcons.ipRangeFieldAriaLabel": "IP 范围字段", - "discover.fieldNameIcons.keywordFieldAriaLabel": "关键字字段", - "discover.fieldNameIcons.murmur3FieldAriaLabel": "Murmur3 字段", - "discover.fieldNameIcons.nestedFieldAriaLabel": "嵌套字段", - "discover.fieldNameIcons.numberFieldAriaLabel": "数字字段", - "discover.fieldNameIcons.sourceFieldAriaLabel": "源字段", - "discover.fieldNameIcons.stringFieldAriaLabel": "字符串字段", - "discover.fieldNameIcons.textFieldAriaLabel": "文本字段", - "discover.fieldNameIcons.unknownFieldAriaLabel": "未知字段", - "discover.fieldNameIcons.versionFieldAriaLabel": "版本字段", - "discover.fieldTypesPopover.buttonAriaLabel": "筛选类型帮助", - "discover.fieldTypesPopover.dataTypeColumnTitle": "数据类型", - "discover.fieldTypesPopover.descriptionColumnTitle": "描述", - "discover.fieldTypesPopover.fieldTypesDocLinkLabel": "字段类型", - "discover.fieldTypesPopover.iconTitle": "筛选类型帮助", - "discover.fieldTypesPopover.learnMoreText": "详细了解", - "discover.fieldTypesPopover.tableTitle": "字段类型描述", "discover.grid.closePopover": "关闭弹出框", "discover.grid.copyClipboardButton": "复制到剪贴板", "discover.grid.copyColumnNameToClipboard.toastTitle": "已复制到剪贴板", @@ -5165,9 +5107,6 @@ "unifiedFieldList.fieldStats.filterOutValueButtonAriaLabel": "筛除 {field}：“{value}”", "unifiedFieldList.fieldStats.filterValueButtonAriaLabel": "筛留 {field}：“{value}”", "unifiedFieldList.fieldStats.noFieldDataInSampleDescription": "{sampledDocumentsFormatted} 个样例{sampledDocuments, plural, other {记录}}无字段数据。", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.deprecation": "此设置已过时，自 8.6 中起不再受支持。", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.description": "如果启用，文档采样将用于确定 Lens 字段列表中的字段是否存在（可用或为空），而不依赖索引映射。", - "unifiedFieldList.advancedSettings.useFieldExistenceSampling.title": "使用字段存在采样", "unifiedFieldList.fieldList.noFieldsCallout.noDataLabel": "无字段。", "unifiedFieldList.fieldList.noFieldsCallout.noFields.extendTimeBullet": "延伸时间范围", "unifiedFieldList.fieldList.noFieldsCallout.noFields.fieldTypeFilterBullet": "使用不同的字段筛选", @@ -11878,7 +11817,7 @@ "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.addDocument.helptext": "使用您索引中的文档进行测试", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.description": "您可以通过传递文档数组来模拟管道结果。", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.runButton": "模拟管道", - "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle": "文档", + "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.subtitle.documents": "文档", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.steps.test.title": "复查管道结果（可选）", "xpack.enterpriseSearch.content.indices.pipelines.addInferencePipelineModal.title": "添加推理管道", "xpack.enterpriseSearch.content.indices.pipelines.ingestionPipeline.apiIndexSubtitle": "采集管道将针对搜索应用程序优化您的索引。如果希望在基于 API 的索引中使用这些管道，您需要在 API 请求中显式引用它们。", @@ -18196,7 +18135,6 @@ "xpack.lens.indexPattern.timeShiftSmallWarning": "{label} 使用的时间偏移 {columnTimeShift} 小于 Date Histogram 时间间隔 {interval} 。要防止数据不匹配，请使用 {interval} 的倍数作为时间偏移。", "xpack.lens.indexPattern.tsdbRollupWarning": "{label} 使用的函数不受汇总/打包数据支持。请选择其他函数，或更改时间范围。", "xpack.lens.indexPattern.uniqueLabel": "{label} [{num}]", - "xpack.lens.indexPattern.useFieldExistenceSamplingBody": "字段存在采样已过时，将在 Kibana {version} 中移除。您可以在 {link} 中禁用此功能。", "xpack.lens.indexPattern.valueCountOf": "{name} 的计数", "xpack.lens.indexPatternSuggestion.removeLayerLabel": "仅显示 {indexPatternTitle}", "xpack.lens.indexPatternSuggestion.removeLayerPositionLabel": "仅显示图层 {layerNumber}", @@ -18532,7 +18470,6 @@ "xpack.lens.indexPattern.advancedSettings": "高级", "xpack.lens.indexPattern.allFieldsForTextBasedLabelHelp": "将可用字段拖放到工作区并创建可视化。要更改可用字段，请编辑您的查询。", "xpack.lens.indexPattern.allFieldsLabelHelp": "将可用字段拖放到工作区并创建可视化。要更改可用字段，请选择不同数据视图，编辑您的查询或使用不同时间范围。一些字段类型无法在 Lens 中可视化，包括全文本字段和地理字段。", - "xpack.lens.indexPattern.allFieldsSamplingLabelHelp": "可用字段包含与您的筛选匹配的前 500 个文档中的数据。要查看所有字段，请展开空字段。无法使用全文本、地理、扁平和对象字段创建可视化。", "xpack.lens.indexPattern.ascendingCountPrecisionErrorWarning.link": "访问文档", "xpack.lens.indexPattern.availableFieldsLabel": "可用字段", "xpack.lens.indexPattern.avg": "平均值", @@ -18599,7 +18536,6 @@ "xpack.lens.indexPattern.fieldStatsButtonEmptyLabel": "此字段不包含任何数据，但您仍然可以拖放以进行可视化。", "xpack.lens.indexPattern.fieldStatsButtonLabel": "单击以进行字段预览，或拖放以进行可视化。", "xpack.lens.indexPattern.fieldStatsNoData": "Lens 无法使用此字段创建可视化，因为其中未包含数据。要创建可视化，请拖放其他字段。", - "xpack.lens.indexPattern.fieldStatsSamplingNoData": "Lens 无法使用此字段创建可视化，因为其中未包含与您的筛选匹配的前 500 个文档中的数据。要创建可视化，请拖放其他字段。", "xpack.lens.indexPattern.filterBy.clickToEdit": "单击以编辑", "xpack.lens.indexPattern.filterBy.emptyFilterQuery": "（空）", "xpack.lens.indexPattern.filterBy.label": "筛选依据", @@ -18799,7 +18735,6 @@ "xpack.lens.indexPattern.timeShift.year": "1 年前 (1y)", "xpack.lens.indexPattern.timeShiftPlaceholder": "键入定制值（如 8w）", "xpack.lens.indexPattern.useAsTopLevelAgg": "首先按此维度聚合", - "xpack.lens.indexPattern.useFieldExistenceSampling.advancedSettings": "高级设置", "xpack.lens.label.gauge.labelMajor.header": "标题", "xpack.lens.label.gauge.labelMinor.header": "子标题", "xpack.lens.label.header": "标签", @@ -26745,7 +26680,6 @@ "xpack.securitySolution.console.commandValidation.exclusiveOr": "此命令只支持以下参数之一：{argNames}", "xpack.securitySolution.console.commandValidation.invalidArgValue": "无效的参数值：{argName}。{error}", "xpack.securitySolution.console.commandValidation.missingRequiredArg": "缺少所需参数：{argName}", - "xpack.securitySolution.console.commandValidation.mustHaveArgs": "缺少所需参数：{requiredArgs}", "xpack.securitySolution.console.commandValidation.unknownArgument": "此命令不支持以下 {command} {countOfInvalidArgs, plural, other {参数}}：{unknownArgs}", "xpack.securitySolution.console.commandValidation.unsupportedArg": "不支持的参数：{argName}", "xpack.securitySolution.console.sidePanel.helpDescription": "使用添加 ({icon}) 按钮将响应操作填充到文本栏。在必要时添加其他参数或注释。", diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts index a645d89998093..df9fc34e17014 100644 --- a/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts +++ b/x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/disable.ts @@ -26,8 +26,7 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte const supertest = getService('supertest'); const supertestWithoutAuth = getService('supertestWithoutAuth'); - // Failing: See https://github.com/elastic/kibana/issues/141849 - describe.skip('disable', () => { + describe('disable', () => { const objectRemover = new ObjectRemover(supertest); after(() => objectRemover.removeAll()); diff --git a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/disable.ts b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/disable.ts index dab57143e0b6d..d4149c9cf2fb8 100644 --- a/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/disable.ts +++ b/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/disable.ts @@ -26,8 +26,7 @@ export default function createDisableRuleTests({ getService }: FtrProviderContex const retry = getService('retry'); const supertest = getService('supertest'); - // Failing: See https://github.com/elastic/kibana/issues/141864 - describe.skip('disable', () => { + describe('disable', () => { const objectRemover = new ObjectRemover(supertestWithoutAuth); const ruleUtils = new RuleUtils({ space: Spaces.space1, supertestWithoutAuth }); diff --git a/x-pack/test/api_integration/apis/management/index_management/indices.js b/x-pack/test/api_integration/apis/management/index_management/indices.js index b617a1ba14f4a..26dd64aeffda3 100644 --- a/x-pack/test/api_integration/apis/management/index_management/indices.js +++ b/x-pack/test/api_integration/apis/management/index_management/indices.js @@ -33,15 +33,10 @@ export default function ({ getService }) { clearCache, } = registerHelpers({ supertest }); - // FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/145022 - describe.skip('indices', () => { + describe('indices', () => { after(() => Promise.all([cleanUpEsResources()])); describe('clear cache', () => { - it('should clear the cache on all indices', async () => { - await clearCache('*').expect(200); - }); - it('should clear the cache on a single index', async () => { const index = await createIndex(); await clearCache(index).expect(200); diff --git a/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts b/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts index f3920d78588f3..0ac7d13808a2a 100644 --- a/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts +++ b/x-pack/test/api_integration/apis/synthetics/add_monitor_project.ts @@ -99,6 +99,20 @@ export default function ({ getService }: FtrProviderContext) { }); }); + it('project monitors - returns 404 for non-existing spaces', async () => { + const project = `test-project-${uuidv4()}`; + await supertest + .put( + `/s/i_dont_exist${API_URLS.SYNTHETICS_MONITORS_PROJECT_UPDATE.replace( + '{projectName}', + project + )}` + ) + .set('kbn-xsrf', 'true') + .send(projectMonitors) + .expect(404); + }); + it('project monitors - handles browser monitors', async () => { const successfulMonitors = [projectMonitors.monitors[0]]; const project = `test-project-${uuidv4()}`; diff --git a/x-pack/test/api_integration/apis/synthetics/add_monitor_project_legacy.ts b/x-pack/test/api_integration/apis/synthetics/add_monitor_project_legacy.ts index c3a48d22da1c5..ff0c1bbf0f9a1 100644 --- a/x-pack/test/api_integration/apis/synthetics/add_monitor_project_legacy.ts +++ b/x-pack/test/api_integration/apis/synthetics/add_monitor_project_legacy.ts @@ -559,6 +559,19 @@ export default function ({ getService }: FtrProviderContext) { } }); + it('project monitors - returns error if the space does not exist', async () => { + const messages = await parseStreamApiResponse( + kibanaServerUrl + '/s/i_dont_exist' + API_URLS.SYNTHETICS_MONITORS_PROJECT_LEGACY, + JSON.stringify(projectMonitors) + ); + + expect(messages).to.have.length(2); + expect(messages[0]).to.equal( + "Unable to create monitors. Kibana space 'i_dont_exist' does not exist." + ); + expect(messages[1].failedMonitors).to.eql(projectMonitors.monitors.map((m) => m.id)); + }); + it('project monitors - returns a list of successfully updated monitors', async () => { try { await supertest diff --git a/x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/default_space.json b/x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/default_space.json new file mode 100644 index 0000000000000..2591ad96d87a3 --- /dev/null +++ b/x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/default_space.json @@ -0,0 +1,142 @@ +{ + "id": "tag-1", + "type": "tag", + "attributes": { + "name": "tag-1", + "description": "My first tag!", + "color": "#FF00FF" + }, + "references": [], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "tag-2", + "type": "tag", + "attributes": { + "name": "tag-2", + "description": "Another awesome tag", + "color": "#123456" + }, + "references": [], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "tag-3", + "type": "tag", + "attributes": { + "name": "tag-3", + "description": "Last but not least", + "color": "#000000" + }, + "references": [], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "logstash-*", + "type": "index-pattern", + "attributes": { + "fieldFormatMap": "{\"bytes\":{\"id\":\"bytes\"}}", + "fields": "[{\"name\":\"referer\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"agent\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"xss.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.lastname\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.dest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"utc_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.char\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"clientip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"machine.ram\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"links\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"id\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"phpmemory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.twitter:card.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"ip\",\"type\":\"ip\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:modified_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:site_name.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:tag\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"agent.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"headings\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.og:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"request\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"index.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"memory\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"relatedContent.twitter:site\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.coordinates\",\"type\":\"geo_point\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"meta.related\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@message.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.article:section\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"xss\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"links.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"geo.srcdest\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"extension.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"machine.os.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@tags\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"host.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:type.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"geo.src\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"spaces.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:image:height.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"url\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:site_name\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:title\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"@message\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.twitter:image.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"@timestamp\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"bytes\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"response\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"meta.user.firstname\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":true,\"doc_values\":false},{\"name\":\"relatedContent.og:image:width.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.og:description.raw\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"relatedContent.article:published_time\",\"type\":\"date\",\"count\":0,\"scripted\":false,\"indexed\":true,\"analyzed\":false,\"doc_values\":true},{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"indexed\":false,\"analyzed\":false,\"doc_values\":false}]", + "timeFieldName": "@timestamp", + "title": "logstash-*" + }, + "references": [], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "vis-area-1", + "type": "visualization", + "attributes": { + "title": "Visualization 1 (tag-1)", + "description": "AreaChart", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Visualization AreaChart\",\"type\":\"area\"}" + }, + "references": [ + { + "type": "tag", + "id": "tag-1", + "name": "tag-1-ref" + } + ], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "vis-area-2", + "type": "visualization", + "attributes": { + "title": "Visualization 2 (tag-2)", + "description": "AreaChart", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Visualization AreaChart\",\"type\":\"area\"}" + }, + "references": [ + { + "type": "tag", + "id": "tag-2", + "name": "tag-2-ref" + } + ], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "vis-area-3", + "type": "visualization", + "attributes": { + "title": "Visualization 3 (tag-1 + tag-3)", + "description": "AreaChart", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Visualization AreaChart\",\"type\":\"area\"}" + }, + "references": [ + { "type": "tag", + "id": "tag-1", + "name": "tag-1-ref" + }, + { "type": "tag", + "id": "tag-3", + "name": "tag-3-ref" + } + ], + "updated_at": "2021-06-17T18:57:58.076Z" +} + +{ + "id": "vis-area-4", + "type": "visualization", + "attributes": { + "title": "Visualization 4 (tag-2)", + "description": "AreaChart", + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"index\":\"logstash-*\",\"query\":{\"query_string\":{\"query\":\"*\",\"analyze_wildcard\":true}},\"filter\":[]}" + }, + "uiStateJSON": "{}", + "version": 1, + "visState": "{\"title\":\"Visualization AreaChart\",\"type\":\"area\"}" + }, + "references": [ + { "type": "tag", + "id": "tag-2", + "name": "tag-2-ref" + } + ], + "updated_at": "2021-06-17T18:57:58.076Z" +} diff --git a/x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/space_1.json b/x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/space_1.json new file mode 100644 index 0000000000000..2706fcf932108 --- /dev/null +++ b/x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/space_1.json @@ -0,0 +1,11 @@ +{ + "id": "space_1-tag-3", + "type": "tag", + "attributes": { + "name": "tag-3", + "description": "Tag 3 in space 1", + "color": "#117744" + }, + "references": [], + "updated_at": "2021-06-17T18:57:58.076Z" +} diff --git a/x-pack/test/ftr_apis/common/lib/authentication.ts b/x-pack/test/ftr_apis/common/lib/authentication.ts new file mode 100644 index 0000000000000..7f4802ecfb372 --- /dev/null +++ b/x-pack/test/ftr_apis/common/lib/authentication.ts @@ -0,0 +1,243 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +export const ROLES = { + KIBANA_RBAC_DEFAULT_SPACE_READ_USER: { + name: 'kibana_rbac_default_space_read_user', + privileges: { + kibana: [ + { + base: ['read'], + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_WRITE_USER: { + name: 'kibana_rbac_default_space_write_user', + privileges: { + kibana: [ + { + base: ['all'], + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER: { + name: 'kibana_rbac_default_space_so_management_write_user', + privileges: { + kibana: [ + { + feature: { + savedObjectsManagement: ['all'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_SO_MANAGEMENT_READ_USER: { + name: 'kibana_rbac_default_space_so_management_read_user', + privileges: { + kibana: [ + { + feature: { + savedObjectsManagement: ['read'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_SO_TAGGING_READ_USER: { + name: 'kibana_rbac_default_space_so_tagging_read_user', + privileges: { + kibana: [ + { + feature: { + savedObjectsTagging: ['read'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_SO_TAGGING_WRITE_USER: { + name: 'kibana_rbac_default_space_so_tagging_write_user', + privileges: { + kibana: [ + { + feature: { + savedObjectsTagging: ['all'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_DASHBOARD_READ_USER: { + name: 'kibana_rbac_default_space_dashboard_read_user', + privileges: { + kibana: [ + { + feature: { + dashboard: ['read'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_DASHBOARD_WRITE_USER: { + name: 'kibana_rbac_default_space_dashboard_write_user', + privileges: { + kibana: [ + { + feature: { + dashboard: ['all'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_VISUALIZE_READ_USER: { + name: 'kibana_rbac_default_space_visualize_read_user', + privileges: { + kibana: [ + { + feature: { + visualize: ['read'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_VISUALIZE_WRITE_USER: { + name: 'kibana_rbac_default_space_visualize_write_user', + privileges: { + kibana: [ + { + feature: { + visualize: ['all'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER: { + name: 'kibana_rbac_default_space_advanced_settings_read_user', + privileges: { + kibana: [ + { + feature: { + advancedSettings: ['read'], + }, + spaces: ['default'], + }, + ], + }, + }, + KIBANA_RBAC_DEFAULT_SPACE_MAPS_READ_USER: { + name: 'kibana_rbac_default_space_maps_read_user', + privileges: { + kibana: [ + { + feature: { + maps: ['read'], + }, + spaces: ['default'], + }, + ], + }, + }, +}; + +export const USERS = { + NOT_A_KIBANA_USER: { + username: 'not_a_kibana_user', + password: 'password', + roles: [], + description: 'user with no access', + }, + SUPERUSER: { + username: 'elastic', + password: 'changeme', + roles: [], + superuser: true, + description: 'superuser', + }, + DEFAULT_SPACE_READ_USER: { + username: 'a_kibana_rbac_default_space_read_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_READ_USER.name], + description: 'rbac user with read on default space', + }, + DEFAULT_SPACE_WRITE_USER: { + username: 'a_kibana_rbac_default_space_write_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_WRITE_USER.name], + description: 'rbac user with all on default space', + }, + DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER: { + username: 'a_kibana_rbac_default_space_so_management_write_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER.name], + description: 'rbac user with all on SO management on default space', + }, + DEFAULT_SPACE_SO_TAGGING_READ_USER: { + username: 'a_kibana_rbac_default_space_so_tagging_read_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_SO_TAGGING_READ_USER.name], + }, + DEFAULT_SPACE_SO_TAGGING_READ_SO_MANAGEMENT_READ_USER: { + username: 'a_kibana_rbac_default_space_so_tagging_read_so_management_read_user', + password: 'password', + roles: [ + ROLES.KIBANA_RBAC_DEFAULT_SPACE_SO_TAGGING_READ_USER.name, + ROLES.KIBANA_RBAC_DEFAULT_SPACE_SO_MANAGEMENT_READ_USER.name, + ], + }, + DEFAULT_SPACE_SO_TAGGING_WRITE_USER: { + username: 'a_kibana_rbac_default_space_so_tagging_write_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_SO_TAGGING_WRITE_USER.name], + }, + DEFAULT_SPACE_DASHBOARD_READ_USER: { + username: 'a_kibana_rbac_default_space_dashboard_read_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_DASHBOARD_READ_USER.name], + }, + DEFAULT_SPACE_VISUALIZE_READ_USER: { + username: 'a_kibana_rbac_default_space_visualize_read_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_VISUALIZE_READ_USER.name], + }, + DEFAULT_SPACE_DASHBOARD_WRITE_USER: { + username: 'a_kibana_rbac_default_space_dashboard_write_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_DASHBOARD_WRITE_USER.name], + }, + DEFAULT_SPACE_VISUALIZE_WRITE_USER: { + username: 'a_kibana_rbac_default_space_visualize_write_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_VISUALIZE_WRITE_USER.name], + }, + DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER: { + username: 'a_kibana_rbac_default_space_advanced_settings_read_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER.name], + }, + DEFAULT_SPACE_MAPS_READ_USER: { + username: 'a_kibana_rbac_default_space_maps_read_user', + password: 'password', + roles: [ROLES.KIBANA_RBAC_DEFAULT_SPACE_MAPS_READ_USER.name], + }, +}; diff --git a/x-pack/test/ftr_apis/common/lib/create_users_and_roles.ts b/x-pack/test/ftr_apis/common/lib/create_users_and_roles.ts new file mode 100644 index 0000000000000..2987d561f7762 --- /dev/null +++ b/x-pack/test/ftr_apis/common/lib/create_users_and_roles.ts @@ -0,0 +1,40 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { FtrProviderContext as CommonFtrProviderContext } from '../../../common/ftr_provider_context'; +import { USERS, ROLES } from './authentication'; +import { User, Role } from './types'; + +export const createUsersAndRoles = async (getService: CommonFtrProviderContext['getService']) => { + const security = getService('security'); + + const createRole = async ({ name, privileges }: Role) => { + return await security.role.create(name, privileges); + }; + + const createUser = async ({ username, password, roles, superuser }: User) => { + // no need to create superuser + if (superuser) { + return; + } + + return await security.user.create(username, { + password, + roles, + full_name: username.replace('_', ' '), + email: `${username}@elastic.co`, + }); + }; + + for (const role of Object.values(ROLES)) { + await createRole(role); + } + + for (const user of Object.values(USERS)) { + await createUser(user); + } +}; diff --git a/x-pack/test/ftr_apis/common/lib/index.ts b/x-pack/test/ftr_apis/common/lib/index.ts new file mode 100644 index 0000000000000..9d23dc2541f8c --- /dev/null +++ b/x-pack/test/ftr_apis/common/lib/index.ts @@ -0,0 +1,10 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +export type { Role, User, ExpectedResponse } from './types'; +export { ROLES, USERS } from './authentication'; +export { createUsersAndRoles } from './create_users_and_roles'; diff --git a/x-pack/test/ftr_apis/common/lib/types.ts b/x-pack/test/ftr_apis/common/lib/types.ts new file mode 100644 index 0000000000000..76cdeba36d0a9 --- /dev/null +++ b/x-pack/test/ftr_apis/common/lib/types.ts @@ -0,0 +1,24 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +export interface User { + username: string; + password: string; + roles: string[]; + superuser?: boolean; + description?: string; +} + +export interface Role { + name: string; + privileges: any; +} + +export interface ExpectedResponse { + httpCode: number; + expectResponse: (body: Record) => void | Promise; +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/bulk_delete.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/bulk_delete.ts new file mode 100644 index 0000000000000..1ba800413237e --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/bulk_delete.ts @@ -0,0 +1,92 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { USERS, User, ExpectedResponse } from '../../common/lib'; +import { FtrProviderContext } from '../services'; +import { createTestSpaces, deleteTestSpaces, createData, deleteData } from './test_utils'; + +// eslint-disable-next-line import/no-default-export +export default function (ftrContext: FtrProviderContext) { + const supertest = ftrContext.getService('supertestWithoutAuth'); + + describe('POST /internal/ftr/kbn_client_so/_bulk_delete', () => { + before(async () => { + await createTestSpaces(ftrContext); + }); + + after(async () => { + await deleteTestSpaces(ftrContext); + }); + + beforeEach(async () => { + await createData(ftrContext); + }); + + afterEach(async () => { + await deleteData(ftrContext); + }); + + const responses: Record = { + authorized: { + httpCode: 200, + expectResponse: ({ body }) => { + expect(body.statuses.length).to.eql(1); + }, + }, + unauthorized: { + httpCode: 403, + expectResponse: ({ body }) => { + expect(body).to.eql({ + statusCode: 403, + error: 'Forbidden', + message: 'Forbidden', + }); + }, + }, + }; + + const expectedResults: Record = { + authorized: [USERS.SUPERUSER], + unauthorized: [ + USERS.DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_WRITE_USER, + USERS.DEFAULT_SPACE_READ_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_READ_USER, + USERS.DEFAULT_SPACE_DASHBOARD_READ_USER, + USERS.DEFAULT_SPACE_VISUALIZE_READ_USER, + USERS.DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER, + USERS.NOT_A_KIBANA_USER, + ], + }; + + const createUserTest = ( + { username, password, description }: User, + { httpCode, expectResponse }: ExpectedResponse + ) => { + it(`returns expected ${httpCode} response for ${description ?? username}`, async () => { + await supertest + .post(`/internal/ftr/kbn_client_so/_bulk_delete`) + .send([{ type: 'tag', id: 'tag-1' }]) + .auth(username, password) + .expect(httpCode) + .then(expectResponse); + }); + }; + + const createTestSuite = () => { + Object.entries(expectedResults).forEach(([responseId, users]) => { + const response: ExpectedResponse = responses[responseId]; + users.forEach((user) => { + createUserTest(user, response); + }); + }); + }; + + createTestSuite(); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/create.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/create.ts new file mode 100644 index 0000000000000..50aee16f1b9f0 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/create.ts @@ -0,0 +1,103 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { USERS, User, ExpectedResponse } from '../../common/lib'; +import { FtrProviderContext } from '../services'; +import { createTestSpaces, deleteTestSpaces, createData, deleteData } from './test_utils'; + +// eslint-disable-next-line import/no-default-export +export default function (ftrContext: FtrProviderContext) { + const supertest = ftrContext.getService('supertestWithoutAuth'); + + describe('POST /internal/ftr/kbn_client_so/{type}', () => { + before(async () => { + await createTestSpaces(ftrContext); + }); + + after(async () => { + await deleteTestSpaces(ftrContext); + }); + + beforeEach(async () => { + await createData(ftrContext); + }); + + afterEach(async () => { + await deleteData(ftrContext); + }); + + const responses: Record = { + authorized: { + httpCode: 200, + expectResponse: ({ body }) => { + expect(body.attributes).to.eql({ + name: 'My new tag', + description: 'I just created that', + color: '#009000', + }); + }, + }, + unauthorized: { + httpCode: 403, + expectResponse: ({ body }) => { + expect(body).to.eql({ + statusCode: 403, + error: 'Forbidden', + message: 'Forbidden', + }); + }, + }, + }; + + const expectedResults: Record = { + authorized: [USERS.SUPERUSER], + unauthorized: [ + USERS.DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_WRITE_USER, + USERS.DEFAULT_SPACE_READ_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_READ_USER, + USERS.DEFAULT_SPACE_DASHBOARD_READ_USER, + USERS.DEFAULT_SPACE_VISUALIZE_READ_USER, + USERS.DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER, + USERS.DEFAULT_SPACE_MAPS_READ_USER, + USERS.NOT_A_KIBANA_USER, + ], + }; + + const createUserTest = ( + { username, password, description }: User, + { httpCode, expectResponse }: ExpectedResponse + ) => { + it(`returns expected ${httpCode} response for ${description ?? username}`, async () => { + await supertest + .post(`/internal/ftr/kbn_client_so/tag`) + .send({ + attributes: { + name: 'My new tag', + description: 'I just created that', + color: '#009000', + }, + }) + .auth(username, password) + .expect(httpCode) + .then(expectResponse); + }); + }; + + const createTestSuite = () => { + Object.entries(expectedResults).forEach(([responseId, users]) => { + const response: ExpectedResponse = responses[responseId]; + users.forEach((user) => { + createUserTest(user, response); + }); + }); + }; + + createTestSuite(); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/delete.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/delete.ts new file mode 100644 index 0000000000000..f3b04c3cab492 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/delete.ts @@ -0,0 +1,92 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { USERS, User, ExpectedResponse } from '../../common/lib'; +import { FtrProviderContext } from '../services'; +import { createTestSpaces, deleteTestSpaces, createData, deleteData } from './test_utils'; + +// eslint-disable-next-line import/no-default-export +export default function (ftrContext: FtrProviderContext) { + const supertest = ftrContext.getService('supertestWithoutAuth'); + + describe('DELETE /internal/ftr/kbn_client_so/{type}/{id}', () => { + before(async () => { + await createTestSpaces(ftrContext); + }); + + after(async () => { + await deleteTestSpaces(ftrContext); + }); + + beforeEach(async () => { + await createData(ftrContext); + }); + + afterEach(async () => { + await deleteData(ftrContext); + }); + + const responses: Record = { + authorized: { + httpCode: 200, + expectResponse: ({ body }) => { + expect(body).to.eql({}); + }, + }, + unauthorized: { + httpCode: 403, + expectResponse: ({ body }) => { + expect(body).to.eql({ + statusCode: 403, + error: 'Forbidden', + message: 'Forbidden', + }); + }, + }, + }; + + const expectedResults: Record = { + authorized: [USERS.SUPERUSER], + unauthorized: [ + USERS.DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_WRITE_USER, + USERS.DEFAULT_SPACE_READ_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_READ_USER, + USERS.DEFAULT_SPACE_DASHBOARD_READ_USER, + USERS.DEFAULT_SPACE_VISUALIZE_READ_USER, + USERS.DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER, + USERS.DEFAULT_SPACE_MAPS_READ_USER, + USERS.NOT_A_KIBANA_USER, + ], + }; + + const createUserTest = ( + { username, password, description }: User, + { httpCode, expectResponse }: ExpectedResponse + ) => { + it(`returns expected ${httpCode} response for ${description ?? username}`, async () => { + await supertest + .delete(`/internal/ftr/kbn_client_so/visualization/vis-area-1`) + .auth(username, password) + .expect(httpCode) + .then(expectResponse); + }); + }; + + const createTestSuite = () => { + Object.entries(expectedResults).forEach(([responseId, users]) => { + const response: ExpectedResponse = responses[responseId]; + users.forEach((user) => { + createUserTest(user, response); + }); + }); + }; + + createTestSuite(); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/find.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/find.ts new file mode 100644 index 0000000000000..803db0affbfa7 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/find.ts @@ -0,0 +1,94 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { USERS, User, ExpectedResponse } from '../../common/lib'; +import { FtrProviderContext } from '../services'; +import { createData, createTestSpaces, deleteData, deleteTestSpaces } from './test_utils'; + +// eslint-disable-next-line import/no-default-export +export default function (ftrContext: FtrProviderContext) { + const supertest = ftrContext.getService('supertestWithoutAuth'); + + describe('GET /internal/ftr/kbn_client_so/_find', () => { + before(async () => { + await createTestSpaces(ftrContext); + }); + + after(async () => { + await deleteTestSpaces(ftrContext); + }); + + beforeEach(async () => { + await createData(ftrContext); + }); + + afterEach(async () => { + await deleteData(ftrContext); + }); + + const responses: Record = { + authorized: { + httpCode: 200, + expectResponse: ({ body }) => { + expect(body.saved_objects.length).to.be.greaterThan(0); + }, + }, + unauthorized: { + httpCode: 403, + expectResponse: ({ body }) => { + expect(body).to.eql({ + error: 'Forbidden', + message: 'Forbidden', + statusCode: 403, + }); + }, + }, + }; + const expectedResults: Record = { + authorized: [USERS.SUPERUSER], + unauthorized: [ + USERS.DEFAULT_SPACE_READ_USER, + USERS.DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_READ_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_WRITE_USER, + USERS.DEFAULT_SPACE_DASHBOARD_READ_USER, + USERS.DEFAULT_SPACE_VISUALIZE_READ_USER, + USERS.DEFAULT_SPACE_MAPS_READ_USER, + USERS.DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER, + USERS.NOT_A_KIBANA_USER, + ], + }; + + const createUserTest = ( + { username, password, description }: User, + { httpCode, expectResponse }: ExpectedResponse + ) => { + it(`returns expected ${httpCode} response for ${description ?? username}`, async () => { + await supertest + .get(`/internal/ftr/kbn_client_so/_find`) + .query({ + type: 'tag', + }) + .auth(username, password) + .expect(httpCode) + .then(expectResponse); + }); + }; + + const createTestSuite = () => { + Object.entries(expectedResults).forEach(([responseId, users]) => { + const response: ExpectedResponse = responses[responseId]; + users.forEach((user) => { + createUserTest(user, response); + }); + }); + }; + + createTestSuite(); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/get.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/get.ts new file mode 100644 index 0000000000000..db4f507a64645 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/get.ts @@ -0,0 +1,92 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { USERS, User, ExpectedResponse } from '../../common/lib'; +import { FtrProviderContext } from '../services'; +import { createTestSpaces, deleteTestSpaces, createData, deleteData } from './test_utils'; + +// eslint-disable-next-line import/no-default-export +export default function (ftrContext: FtrProviderContext) { + const supertest = ftrContext.getService('supertestWithoutAuth'); + + describe('GET /internal/ftr/kbn_client_so/{type}/{id}', () => { + before(async () => { + await createTestSpaces(ftrContext); + }); + + after(async () => { + await deleteTestSpaces(ftrContext); + }); + + beforeEach(async () => { + await createData(ftrContext); + }); + + afterEach(async () => { + await deleteData(ftrContext); + }); + + const responses: Record = { + authorized: { + httpCode: 200, + expectResponse: ({ body }) => { + expect(body.id).to.eql('vis-area-4'); + }, + }, + unauthorized: { + httpCode: 403, + expectResponse: ({ body }) => { + expect(body).to.eql({ + statusCode: 403, + error: 'Forbidden', + message: 'Forbidden', + }); + }, + }, + }; + + const expectedResults: Record = { + authorized: [USERS.SUPERUSER], + unauthorized: [ + USERS.NOT_A_KIBANA_USER, + USERS.DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER, + USERS.DEFAULT_SPACE_READ_USER, + USERS.DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_READ_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_WRITE_USER, + USERS.DEFAULT_SPACE_DASHBOARD_READ_USER, + USERS.DEFAULT_SPACE_VISUALIZE_READ_USER, + USERS.DEFAULT_SPACE_MAPS_READ_USER, + ], + }; + + const createUserTest = ( + { username, password, description }: User, + { httpCode, expectResponse }: ExpectedResponse + ) => { + it(`returns expected ${httpCode} response for ${description ?? username}`, async () => { + await supertest + .get(`/internal/ftr/kbn_client_so/visualization/vis-area-4`) + .auth(username, password) + .expect(httpCode) + .then(expectResponse); + }); + }; + + const createTestSuite = () => { + Object.entries(expectedResults).forEach(([responseId, users]) => { + const response: ExpectedResponse = responses[responseId]; + users.forEach((user) => { + createUserTest(user, response); + }); + }); + }; + + createTestSuite(); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/index.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/index.ts new file mode 100644 index 0000000000000..ca5bf0cb89221 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/index.ts @@ -0,0 +1,25 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { FtrProviderContext } from '../services'; +import { createUsersAndRoles } from '../../common/lib'; + +// eslint-disable-next-line import/no-default-export +export default function ({ getService, loadTestFile }: FtrProviderContext) { + describe('FTR API - security and spaces integration', function () { + before(async () => { + await createUsersAndRoles(getService); + }); + + loadTestFile(require.resolve('./get')); + loadTestFile(require.resolve('./create')); + loadTestFile(require.resolve('./update')); + loadTestFile(require.resolve('./delete')); + loadTestFile(require.resolve('./find')); + loadTestFile(require.resolve('./bulk_delete')); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/test_utils.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/test_utils.ts new file mode 100644 index 0000000000000..7ab99302043fa --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/test_utils.ts @@ -0,0 +1,50 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { FtrProviderContext } from '../services'; + +export const createTestSpaces = async ({ getService }: FtrProviderContext) => { + const spaceService = getService('spaces'); + await spaceService.create({ + id: 'space_1', + name: 'Space 1', + description: 'This is the first test space', + }); + await spaceService.create({ + id: 'space_2', + name: 'Space 2', + description: 'This is the second test space', + }); +}; + +export const deleteTestSpaces = async ({ getService }: FtrProviderContext) => { + const spaceService = getService('spaces'); + await spaceService.delete('space_1'); + await spaceService.delete('space_2'); +}; + +export const createData = async ({ getService }: FtrProviderContext) => { + const kibanaServer = getService('kibanaServer'); + await kibanaServer.importExport.load( + 'x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/default_space.json' + ); + await kibanaServer.importExport.load( + 'x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/space_1.json', + { space: 'space_1' } + ); +}; + +export const deleteData = async ({ getService }: FtrProviderContext) => { + const kibanaServer = getService('kibanaServer'); + await kibanaServer.importExport.unload( + 'x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/default_space.json' + ); + await kibanaServer.importExport.unload( + 'x-pack/test/ftr_apis/common/fixtures/es_archiver/base_data/space_1.json', + { space: 'space_1' } + ); +}; diff --git a/x-pack/test/ftr_apis/security_and_spaces/apis/update.ts b/x-pack/test/ftr_apis/security_and_spaces/apis/update.ts new file mode 100644 index 0000000000000..fe3ade47195a6 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/apis/update.ts @@ -0,0 +1,95 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import expect from '@kbn/expect'; +import { USERS, User, ExpectedResponse } from '../../common/lib'; +import { FtrProviderContext } from '../services'; +import { createTestSpaces, deleteTestSpaces, createData, deleteData } from './test_utils'; + +// eslint-disable-next-line import/no-default-export +export default function (ftrContext: FtrProviderContext) { + const supertest = ftrContext.getService('supertestWithoutAuth'); + + describe('PUT /internal/ftr/kbn_client_so/{type}/{id}', () => { + before(async () => { + await createTestSpaces(ftrContext); + }); + + after(async () => { + await deleteTestSpaces(ftrContext); + }); + + beforeEach(async () => { + await createData(ftrContext); + }); + + afterEach(async () => { + await deleteData(ftrContext); + }); + + const responses: Record = { + authorized: { + httpCode: 200, + expectResponse: ({ body }) => { + expect(body.attributes.name).to.eql('Updated title'); + }, + }, + unauthorized: { + httpCode: 403, + expectResponse: ({ body }) => { + expect(body).to.eql({ + statusCode: 403, + error: 'Forbidden', + message: 'Forbidden', + }); + }, + }, + }; + + const expectedResults: Record = { + authorized: [USERS.SUPERUSER], + unauthorized: [ + USERS.DEFAULT_SPACE_SO_MANAGEMENT_WRITE_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_WRITE_USER, + USERS.DEFAULT_SPACE_READ_USER, + USERS.DEFAULT_SPACE_SO_TAGGING_READ_USER, + USERS.DEFAULT_SPACE_DASHBOARD_READ_USER, + USERS.DEFAULT_SPACE_VISUALIZE_READ_USER, + USERS.DEFAULT_SPACE_ADVANCED_SETTINGS_READ_USER, + USERS.DEFAULT_SPACE_MAPS_READ_USER, + USERS.NOT_A_KIBANA_USER, + ], + }; + + const createUserTest = ( + { username, password, description }: User, + { httpCode, expectResponse }: ExpectedResponse + ) => { + it(`returns expected ${httpCode} response for ${description ?? username}`, async () => { + await supertest + .put(`/internal/ftr/kbn_client_so/tag/tag-1`) + .send({ + attributes: { name: 'Updated title' }, + }) + .auth(username, password) + .expect(httpCode) + .then(expectResponse); + }); + }; + + const createTestSuite = () => { + Object.entries(expectedResults).forEach(([responseId, users]) => { + const response: ExpectedResponse = responses[responseId]; + users.forEach((user) => { + createUserTest(user, response); + }); + }); + }; + + createTestSuite(); + }); +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/config.ts b/x-pack/test/ftr_apis/security_and_spaces/config.ts new file mode 100644 index 0000000000000..8cfc662bb0b96 --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/config.ts @@ -0,0 +1,37 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { FtrConfigProviderContext } from '@kbn/test'; +import { services } from './services'; + +// eslint-disable-next-line import/no-default-export +export default async function ({ readConfigFile }: FtrConfigProviderContext) { + const apiIntegrationConfig = await readConfigFile( + require.resolve('../../api_integration/config.ts') + ); + + return { + testFiles: [require.resolve('./apis')], + servers: apiIntegrationConfig.get('servers'), + services, + junit: { + reportName: 'X-Pack FTR API Integration Tests - Security and Spaces', + }, + esTestCluster: { + ...apiIntegrationConfig.get('esTestCluster'), + license: 'trial', + }, + kbnTestServer: { + ...apiIntegrationConfig.get('kbnTestServer'), + serverArgs: [ + ...apiIntegrationConfig.get('kbnTestServer.serverArgs'), + '--server.xsrf.disableProtection=true', + `--xpack.fleet.registryUrl=http://localhost:12345`, // setting to invalid registry url to prevent installing preconfigured packages + ], + }, + }; +} diff --git a/x-pack/test/ftr_apis/security_and_spaces/services.ts b/x-pack/test/ftr_apis/security_and_spaces/services.ts new file mode 100644 index 0000000000000..cb1db3f8469ee --- /dev/null +++ b/x-pack/test/ftr_apis/security_and_spaces/services.ts @@ -0,0 +1,15 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License + * 2.0; you may not use this file except in compliance with the Elastic License + * 2.0. + */ + +import { GenericFtrProviderContext } from '@kbn/test'; +import { services as apiIntegrationServices } from '../../api_integration/services'; + +export const services = { + ...apiIntegrationServices, +}; + +export type FtrProviderContext = GenericFtrProviderContext; diff --git a/x-pack/test/functional/apps/dashboard/group2/dashboard_tagging.ts b/x-pack/test/functional/apps/dashboard/group2/dashboard_tagging.ts deleted file mode 100644 index 1bd258233a7cc..0000000000000 --- a/x-pack/test/functional/apps/dashboard/group2/dashboard_tagging.ts +++ /dev/null @@ -1,102 +0,0 @@ -/* - * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - * or more contributor license agreements. Licensed under the Elastic License - * 2.0; you may not use this file except in compliance with the Elastic License - * 2.0. - */ - -import expect from '@kbn/expect'; -import { FtrProviderContext } from '../../../ftr_provider_context'; - -export default function ({ getService, getPageObjects }: FtrProviderContext) { - const listingTable = getService('listingTable'); - const testSubjects = getService('testSubjects'); - const kibanaServer = getService('kibanaServer'); - const esArchiver = getService('esArchiver'); - const find = getService('find'); - const PageObjects = getPageObjects([ - 'common', - 'tagManagement', - 'header', - 'dashboard', - 'visualize', - 'lens', - ]); - - const dashboardTag = 'extremely-cool-dashboard'; - const dashboardTitle = 'Coolest Blank Dashboard'; - - describe('dashboard tagging', () => { - const verifyTagFromListingPage = async () => { - await PageObjects.dashboard.gotoDashboardLandingPage(); - await listingTable.waitUntilTableIsLoaded(); - - // open the filter dropdown - const filterButton = await find.byCssSelector( - '.euiFilterGroup .euiPopover:nth-child(2) .euiFilterButton' - ); - await filterButton.click(); - await testSubjects.click( - `tag-searchbar-option-${PageObjects.tagManagement.testSubjFriendly(dashboardTag)}` - ); - // click elsewhere to close the filter dropdown - const searchFilter = await find.byCssSelector('.euiPageTemplate .euiFieldSearch'); - await searchFilter.click(); - // wait until the table refreshes - await listingTable.waitUntilTableIsLoaded(); - const itemNames = await listingTable.getAllItemsNames(); - expect(itemNames).to.contain(dashboardTitle); - }; - - const createTagFromDashboard = async () => { - await testSubjects.click('dashboardSaveMenuItem'); - await testSubjects.click('savedObjectTagSelector'); - await testSubjects.click(`tagSelectorOption-action__create`); - - expect(await PageObjects.tagManagement.tagModal.isOpened()).to.be(true); - - await PageObjects.tagManagement.tagModal.fillForm( - { - name: dashboardTag, - color: '#fc03db', - description: '', - }, - { - submit: true, - } - ); - expect(await PageObjects.tagManagement.tagModal.isOpened()).to.be(false); - }; - - before(async () => { - await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/logstash_functional'); - await kibanaServer.importExport.load( - 'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json' - ); - await PageObjects.common.navigateToApp('dashboard'); - await PageObjects.dashboard.preserveCrossAppState(); - await PageObjects.dashboard.clickNewDashboard(); - }); - - after(async () => { - await esArchiver.unload('x-pack/test/functional/es_archives/logstash_functional'); - await kibanaServer.importExport.unload( - 'x-pack/test/functional/fixtures/kbn_archiver/lens/lens_basic.json' - ); - await kibanaServer.savedObjects.cleanStandardList(); - }); - - it('adds a new tag to a new Dashboard', async () => { - await createTagFromDashboard(); - PageObjects.dashboard.saveDashboard(dashboardTitle, {}, false); - await verifyTagFromListingPage(); - }); - - it('retains its saved object tags after quicksave', async () => { - await PageObjects.dashboard.gotoDashboardEditMode(dashboardTitle); - await PageObjects.dashboard.useMargins(false); // turn margins off to cause quicksave to be enabled - await PageObjects.dashboard.clickQuickSave(); - await verifyTagFromListingPage(); - }); - }); -} diff --git a/x-pack/test/functional/apps/dashboard/group2/index.ts b/x-pack/test/functional/apps/dashboard/group2/index.ts index 666756735e80f..bc6a13af29c5f 100644 --- a/x-pack/test/functional/apps/dashboard/group2/index.ts +++ b/x-pack/test/functional/apps/dashboard/group2/index.ts @@ -11,7 +11,6 @@ export default function ({ loadTestFile }: FtrProviderContext) { describe('dashboard', function () { loadTestFile(require.resolve('./sync_colors')); loadTestFile(require.resolve('./_async_dashboard')); - loadTestFile(require.resolve('./dashboard_tagging')); loadTestFile(require.resolve('./dashboard_lens_by_value')); loadTestFile(require.resolve('./dashboard_maps_by_value')); loadTestFile(require.resolve('./panel_titles')); diff --git a/x-pack/test/functional/apps/discover/reporting.ts b/x-pack/test/functional/apps/discover/reporting.ts index ddb5d774765bb..026129e7f0778 100644 --- a/x-pack/test/functional/apps/discover/reporting.ts +++ b/x-pack/test/functional/apps/discover/reporting.ts @@ -98,7 +98,7 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { // get clipboard value using field search input, since // 'browser.getClipboardValue()' doesn't work, due to permissions - const textInput = await testSubjects.find('fieldFilterSearchInput'); + const textInput = await testSubjects.find('fieldListFiltersFieldSearch'); await textInput.click(); await browser.getActions().keyDown(Key.CONTROL).perform(); await browser.getActions().keyDown('v').perform(); diff --git a/x-pack/test/functional/apps/infra/hosts_view.ts b/x-pack/test/functional/apps/infra/hosts_view.ts index 0de5bbbd7d57b..1fce5db372ebf 100644 --- a/x-pack/test/functional/apps/infra/hosts_view.ts +++ b/x-pack/test/functional/apps/infra/hosts_view.ts @@ -15,10 +15,88 @@ const END_DATE = moment.utc(DATES.metricsAndLogs.hosts.max); const timepickerFormat = 'MMM D, YYYY @ HH:mm:ss.SSS'; export default ({ getPageObjects, getService }: FtrProviderContext) => { + const kibanaServer = getService('kibanaServer'); const esArchiver = getService('esArchiver'); const browser = getService('browser'); - const pageObjects = getPageObjects(['common', 'infraHome', 'timePicker', 'infraHostsView']); - const kibanaServer = getService('kibanaServer'); + const security = getService('security'); + const pageObjects = getPageObjects([ + 'common', + 'infraHome', + 'timePicker', + 'infraHostsView', + 'security', + 'settings', + ]); + + // Helpers + + const loginWithReadOnlyUserAndNavigateToInfra = async () => { + await security.role.create('global_hosts_read_privileges_role', { + elasticsearch: { + indices: [{ names: ['metricbeat-*'], privileges: ['read', 'view_index_metadata'] }], + }, + kibana: [ + { + feature: { + infrastructure: ['read'], + advancedSettings: ['read'], + }, + spaces: ['*'], + }, + ], + }); + + await security.user.create('global_hosts_read_privileges_user', { + password: 'global_hosts_read_privileges_user-password', + roles: ['global_hosts_read_privileges_role'], + full_name: 'test user', + }); + + await pageObjects.security.forceLogout(); + + await pageObjects.security.login( + 'global_hosts_read_privileges_user', + 'global_hosts_read_privileges_user-password', + { + expectSpaceSelector: false, + } + ); + + await pageObjects.common.navigateToApp('infraOps'); + }; + + const logoutAndDeleteReadOnlyUser = async () => { + await pageObjects.security.forceLogout(); + await Promise.all([ + security.role.delete('global_hosts_read_privileges_role'), + security.user.delete('global_hosts_read_privileges_user'), + ]); + }; + + const navigateAndDisableHostView = async () => { + await esArchiver.load('x-pack/test/functional/es_archives/infra/metrics_and_logs'); + await pageObjects.common.navigateToApp('infraOps'); + await pageObjects.common.navigateToUrl('management', 'kibana/settings', { + basePath: `/s/default`, + ensureCurrentUrl: false, + shouldLoginIfPrompted: false, + shouldUseHashForSubUrl: false, + }); + await pageObjects.settings.toggleAdvancedSettingCheckbox( + 'observability:enableInfrastructureHostsView', + false + ); + return esArchiver.unload('x-pack/test/functional/es_archives/infra/metrics_and_logs'); + }; + + const navigateAndEnableHostView = async () => { + await esArchiver.load('x-pack/test/functional/es_archives/infra/metrics_and_logs'); + await pageObjects.common.navigateToApp('infraOps'); + await pageObjects.infraHostsView.clickTryHostViewLink(); + await pageObjects.infraHostsView.clickEnableHostViewButton(); + }; + + // Tests describe('Hosts view', function () { this.tags('includeFirefox'); @@ -26,21 +104,106 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => { await kibanaServer.savedObjects.cleanStandardList(); }); - describe('Basic functionality', () => { + describe('shows hosts view landing page for admin', () => { before(async () => { await esArchiver.load('x-pack/test/functional/es_archives/infra/metrics_and_logs'); await pageObjects.common.navigateToApp('infraOps'); - await pageObjects.infraHome.goToHostsView(); + await pageObjects.infraHostsView.clickTryHostViewBadge(); + }); + after(async () => { + return esArchiver.unload('x-pack/test/functional/es_archives/infra/metrics_and_logs'); + }); + + it('should show hosts landing page with enable button when the hosts view is disabled', async () => { + const landingPageEnableButton = + await pageObjects.infraHostsView.getHostsLandingPageEnableButton(); + const landingPageEnableButtonText = await landingPageEnableButton.getVisibleText(); + expect(landingPageEnableButtonText).to.eql('Enable hosts view'); + }); + }); + + describe('should show hosts view landing page for user with read permission', () => { + before(async () => { + await esArchiver.load('x-pack/test/functional/es_archives/infra/metrics_and_logs'); + await loginWithReadOnlyUserAndNavigateToInfra(); + await pageObjects.infraHostsView.clickTryHostViewBadge(); + }); + after(async () => { + // NOTE: Logout needs to happen before anything else to avoid flaky behavior + await logoutAndDeleteReadOnlyUser(); + return esArchiver.unload('x-pack/test/functional/es_archives/infra/metrics_and_logs'); + }); + + it('should show hosts landing page with callout when the hosts view is disabled', async () => { + const landingPageDisabled = await pageObjects.infraHostsView.getHostsLandingPageDisabled(); + const learnMoreDocsUrl = await pageObjects.infraHostsView.getHostsLandingPageDocsLink(); + const parsedUrl = new URL(learnMoreDocsUrl); + + expect(parsedUrl.host).to.be('www.elastic.co'); + expect(parsedUrl.pathname).to.be('/guide/en/kibana/current/kibana-privileges.html'); + expect(landingPageDisabled).to.contain( + 'Your user role doesn’t have sufficient privileges to enable this feature' + ); + }); + }); + + describe('enables hosts view page and checks content', () => { + before(async () => { + await navigateAndEnableHostView(); await pageObjects.timePicker.setAbsoluteRange( START_DATE.format(timepickerFormat), END_DATE.format(timepickerFormat) ); }); - after(() => esArchiver.unload('x-pack/test/functional/es_archives/infra/metrics_and_logs')); + after(async () => { + await navigateAndDisableHostView(); + }); + + describe('should show hosts page for admin user and see the page content', async () => { + it('should render the correct page title', async () => { + const documentTitle = await browser.getTitle(); + expect(documentTitle).to.contain('Hosts - Infrastructure - Observability - Elastic'); + }); + + it('should have six hosts', async () => { + const hosts = await pageObjects.infraHostsView.getHostsTableData(); + expect(hosts.length).to.equal(6); + }); + + it('should load 5 metrics trend tiles', async () => { + const hosts = await pageObjects.infraHostsView.getAllMetricsTrendTiles(); + expect(hosts.length).to.equal(5); + }); + + [ + { metric: 'hosts', value: '6' }, + { metric: 'cpu', value: '0.8%' }, + { metric: 'memory', value: '16.8%' }, + { metric: 'tx', value: '0 bit/s' }, + { metric: 'rx', value: '0 bit/s' }, + ].forEach(({ metric, value }) => { + it(`${metric} tile should show ${value}`, async () => { + const tileValue = await pageObjects.infraHostsView.getMetricsTrendTileValue(metric); + expect(tileValue).to.eql(value); + }); + }); + }); + }); - it('should render the correct page title', async () => { - const documentTitle = await browser.getTitle(); - expect(documentTitle).to.contain('Hosts - Infrastructure - Observability - Elastic'); + describe('should show hosts page for read only user and see the page content', async () => { + before(async () => { + await navigateAndEnableHostView(); + await loginWithReadOnlyUserAndNavigateToInfra(); + await pageObjects.infraHostsView.clickTryHostViewLink(); + await pageObjects.timePicker.setAbsoluteRange( + START_DATE.format(timepickerFormat), + END_DATE.format(timepickerFormat) + ); + }); + after(async () => { + // NOTE: Logout needs to happen before anything else to avoid flaky behavior + await logoutAndDeleteReadOnlyUser(); + await navigateAndDisableHostView(); }); it('should have six hosts', async () => { diff --git a/x-pack/test/functional/apps/lens/group2/dashboard.ts b/x-pack/test/functional/apps/lens/group2/dashboard.ts index 08811fd836858..caa2dd3ca1785 100644 --- a/x-pack/test/functional/apps/lens/group2/dashboard.ts +++ b/x-pack/test/functional/apps/lens/group2/dashboard.ts @@ -173,11 +173,14 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { await dashboardAddPanel.clickOpenAddPanel(); await dashboardAddPanel.filterEmbeddableNames('lnsPieVis'); await find.clickByButtonText('lnsPieVis'); + await PageObjects.header.waitUntilLoadingHasFinished(); await dashboardAddPanel.closeAddPanel(); - await panelActions.openContextMenu(); - await panelActions.clickContextMenuMoreItem(); - await testSubjects.existOrFail(ACTION_TEST_SUBJ); + await retry.try(async () => { + await panelActions.openContextMenu(); + await panelActions.clickContextMenuMoreItem(); + await testSubjects.existOrFail(ACTION_TEST_SUBJ); + }); }); it('should show all data from all layers in the inspector', async () => { diff --git a/x-pack/test/functional/apps/lens/group2/share.ts b/x-pack/test/functional/apps/lens/group2/share.ts index 02febbd1ce4ee..e50eb20ee7c3c 100644 --- a/x-pack/test/functional/apps/lens/group2/share.ts +++ b/x-pack/test/functional/apps/lens/group2/share.ts @@ -14,7 +14,8 @@ export default function ({ getService, getPageObjects }: FtrProviderContext) { const filterBarService = getService('filterBar'); const queryBar = getService('queryBar'); - describe('lens share tests', () => { + // Failing: See https://github.com/elastic/kibana/issues/149163 + describe.skip('lens share tests', () => { before(async () => { await PageObjects.visualize.gotoVisualizationLandingPage(); }); diff --git a/x-pack/test/functional/apps/maps/group4/discover.js b/x-pack/test/functional/apps/maps/group4/discover.js index fe0143911768d..b1a0e4677ce32 100644 --- a/x-pack/test/functional/apps/maps/group4/discover.js +++ b/x-pack/test/functional/apps/maps/group4/discover.js @@ -14,9 +14,7 @@ export default function ({ getService, getPageObjects }) { const from = 'Sep 22, 2015 @ 00:00:00.000'; const to = 'Sep 22, 2015 @ 04:00:00.000'; - // Failing: See https://github.com/elastic/kibana/issues/137408 - // Failing: See https://github.com/elastic/kibana/issues/149358 - describe.skip('discover visualize button', () => { + describe('discover visualize button', () => { beforeEach(async () => { await security.testUser.setRoles([ 'test_logstash_reader', diff --git a/x-pack/test/functional/config.base.js b/x-pack/test/functional/config.base.js index 1851289f240df..6afa7e4a437f9 100644 --- a/x-pack/test/functional/config.base.js +++ b/x-pack/test/functional/config.base.js @@ -55,7 +55,6 @@ export default async function ({ readConfigFile }) { '--xpack.discoverEnhanced.actions.exploreDataInContextMenu.enabled=true', '--savedObjects.maxImportPayloadBytes=10485760', // for OSS test management/_import_objects, '--uiSettings.overrides.observability:enableNewSyntheticsView=true', // for OSS test management/_import_objects, - '--uiSettings.overrides.observability:enableInfrastructureHostsView=true', // for Infra/Hosts View test, ], }, uiSettings: { diff --git a/x-pack/test/functional/page_objects/infra_hosts_view.ts b/x-pack/test/functional/page_objects/infra_hosts_view.ts index 5968a27c312e4..e5c30934146d6 100644 --- a/x-pack/test/functional/page_objects/infra_hosts_view.ts +++ b/x-pack/test/functional/page_objects/infra_hosts_view.ts @@ -11,6 +11,35 @@ export function InfraHostsViewProvider({ getService }: FtrProviderContext) { const testSubjects = getService('testSubjects'); return { + async clickTryHostViewLink() { + return await testSubjects.click('inventory-hostsView-link'); + }, + + async clickTryHostViewBadge() { + return await testSubjects.click('inventory-hostsView-badge'); + }, + + async getHostsLandingPageDisabled() { + const container = await testSubjects.find('hostView-no-enable-access'); + const containerText = await container.getVisibleText(); + return containerText; + }, + + async getHostsLandingPageDocsLink() { + const container = await testSubjects.find('hostsView-docs-link'); + const containerText = await container.getAttribute('href'); + return containerText; + }, + + async getHostsLandingPageEnableButton() { + const container = await testSubjects.find('hostsView-enable-feature-button'); + return container; + }, + + async clickEnableHostViewButton() { + return await testSubjects.click('hostsView-enable-feature-button'); + }, + async getHostsTableData() { const table = await testSubjects.find('hostsView-table'); return table.findAllByTestSubject('hostsView-tableRow'); diff --git a/x-pack/test/saved_object_tagging/functional/tests/dashboard_integration.ts b/x-pack/test/saved_object_tagging/functional/tests/dashboard_integration.ts index e0c1f162371ce..37da0d3205c9c 100644 --- a/x-pack/test/saved_object_tagging/functional/tests/dashboard_integration.ts +++ b/x-pack/test/saved_object_tagging/functional/tests/dashboard_integration.ts @@ -7,7 +7,6 @@ import expect from '@kbn/expect'; import { FtrProviderContext } from '../ftr_provider_context'; -import { TAGFILTER_DROPDOWN_SELECTOR } from './constants'; // eslint-disable-next-line import/no-default-export export default function ({ getPageObjects, getService }: FtrProviderContext) { @@ -15,28 +14,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { const kibanaServer = getService('kibanaServer'); const listingTable = getService('listingTable'); const testSubjects = getService('testSubjects'); - const find = getService('find'); - const PageObjects = getPageObjects(['dashboard', 'tagManagement', 'common', 'header']); - - /** - * Select tags in the searchbar's tag filter. - */ - const selectFilterTags = async (...tagNames: string[]) => { - // open the filter dropdown - const filterButton = await find.byCssSelector(TAGFILTER_DROPDOWN_SELECTOR); - await filterButton.click(); - // select the tags - for (const tagName of tagNames) { - await testSubjects.click( - `tag-searchbar-option-${PageObjects.tagManagement.testSubjFriendly(tagName)}` - ); - } - // click elsewhere to close the filter dropdown - const searchFilter = await find.byCssSelector('.euiPageTemplate .euiFieldSearch'); - await searchFilter.click(); - // wait until the table refreshes - await listingTable.waitUntilTableIsLoaded(); - }; + const PageObjects = getPageObjects(['dashboard', 'tagManagement', 'common']); describe('dashboard integration', () => { before(async () => { @@ -76,7 +54,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { }); it('allows to filter by selecting a tag in the filter menu', async () => { - await selectFilterTags('tag-3'); + await listingTable.selectFilterTags('tag-3'); await listingTable.expectItemsCount('dashboard', 2); const itemNames = await listingTable.getAllItemsNames(); @@ -84,7 +62,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { }); it('allows to filter by multiple tags', async () => { - await selectFilterTags('tag-2', 'tag-3'); + await listingTable.selectFilterTags('tag-2', 'tag-3'); await listingTable.expectItemsCount('dashboard', 3); const itemNames = await listingTable.getAllItemsNames(); @@ -113,7 +91,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.dashboard.gotoDashboardLandingPage(); await listingTable.waitUntilTableIsLoaded(); - await selectFilterTags('tag-1'); + await listingTable.selectFilterTags('tag-1'); const itemNames = await listingTable.getAllItemsNames(); expect(itemNames).to.contain('my-new-dashboard'); }); @@ -150,14 +128,13 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.dashboard.gotoDashboardLandingPage(); await listingTable.waitUntilTableIsLoaded(); - await selectFilterTags('my-new-tag'); + await listingTable.selectFilterTags('my-new-tag'); const itemNames = await listingTable.getAllItemsNames(); expect(itemNames).to.contain('dashboard-with-new-tag'); }); }); - // FLAKY: https://github.com/elastic/kibana/issues/106547 - describe.skip('editing', () => { + describe('editing', () => { beforeEach(async () => { await PageObjects.common.navigateToApp('dashboard'); await PageObjects.dashboard.gotoDashboardLandingPage(); @@ -176,7 +153,21 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.dashboard.gotoDashboardLandingPage(); await listingTable.waitUntilTableIsLoaded(); - await selectFilterTags('tag-3'); + await listingTable.selectFilterTags('tag-3'); + const itemNames = await listingTable.getAllItemsNames(); + expect(itemNames).to.contain('dashboard 4 with real data (tag-1)'); + }); + + it('retains dashboard saved object tags after quicksave', async () => { + // edit and save dashboard + await PageObjects.dashboard.gotoDashboardEditMode('dashboard 4 with real data (tag-1)'); + await PageObjects.dashboard.useMargins(false); // turn margins off to cause quicksave to be enabled + await PageObjects.dashboard.clickQuickSave(); + + // verify dashboard still has original tags + await PageObjects.dashboard.gotoDashboardLandingPage(); + await listingTable.waitUntilTableIsLoaded(); + await listingTable.selectFilterTags('tag-3'); const itemNames = await listingTable.getAllItemsNames(); expect(itemNames).to.contain('dashboard 4 with real data (tag-1)'); }); diff --git a/x-pack/test/saved_object_tagging/functional/tests/maps_integration.ts b/x-pack/test/saved_object_tagging/functional/tests/maps_integration.ts index fb484b61b96d5..7532263b4518c 100644 --- a/x-pack/test/saved_object_tagging/functional/tests/maps_integration.ts +++ b/x-pack/test/saved_object_tagging/functional/tests/maps_integration.ts @@ -7,36 +7,15 @@ import expect from '@kbn/expect'; import { FtrProviderContext } from '../ftr_provider_context'; -import { TAGFILTER_DROPDOWN_SELECTOR } from './constants'; // eslint-disable-next-line import/no-default-export export default function ({ getPageObjects, getService }: FtrProviderContext) { const kibanaServer = getService('kibanaServer'); const listingTable = getService('listingTable'); const testSubjects = getService('testSubjects'); - const find = getService('find'); - const PageObjects = getPageObjects(['maps', 'tagManagement', 'common', 'visualize']); - - /** - * Select tags in the searchbar's tag filter. - */ - const selectFilterTags = async (...tagNames: string[]) => { - // open the filter dropdown - const filterButton = await find.byCssSelector(TAGFILTER_DROPDOWN_SELECTOR); - await filterButton.click(); - // select the tags - for (const tagName of tagNames) { - await testSubjects.click( - `tag-searchbar-option-${PageObjects.tagManagement.testSubjFriendly(tagName)}` - ); - } - // click elsewhere to close the filter dropdown - const searchFilter = await find.byCssSelector('.euiPageTemplate .euiFieldSearch'); - await searchFilter.click(); - }; - - // Failing: See https://github.com/elastic/kibana/issues/89073 - describe.skip('maps integration', () => { + const PageObjects = getPageObjects(['maps', 'common', 'tagManagement', 'visualize']); + + describe('maps integration', () => { before(async () => { await kibanaServer.importExport.load( 'x-pack/test/saved_object_tagging/common/fixtures/es_archiver/maps/data.json' @@ -51,8 +30,9 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { describe('listing', () => { beforeEach(async () => { + // force refresh of maps listing page between tests await PageObjects.common.navigateToUrlWithBrowserHistory('maps', '/'); - await PageObjects.maps.gotoMapListingPage(); + await listingTable.waitUntilTableIsLoaded(); }); it('allows to manually type tag filter query', async () => { @@ -64,7 +44,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { }); it('allows to filter by selecting a tag in the filter menu', async () => { - await selectFilterTags('tag-3'); + await listingTable.selectFilterTags('tag-3'); await listingTable.expectItemsCount('map', 2); const itemNames = await listingTable.getAllItemsNames(); @@ -72,7 +52,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { }); it('allows to filter by multiple tags', async () => { - await selectFilterTags('tag-2', 'tag-3'); + await listingTable.selectFilterTags('tag-2', 'tag-3'); await listingTable.expectItemsCount('map', 3); const itemNames = await listingTable.getAllItemsNames(); @@ -89,7 +69,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.maps.saveMap('my-new-map', true, true, ['tag-1', 'tag-3']); await PageObjects.maps.gotoMapListingPage(); - await selectFilterTags('tag-1'); + await listingTable.waitUntilTableIsLoaded(); + await listingTable.selectFilterTags('tag-1'); const itemNames = await listingTable.getAllItemsNames(); expect(itemNames).to.contain('my-new-map'); }); @@ -125,7 +106,8 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await testSubjects.click('confirmSaveSavedObjectButton'); await PageObjects.maps.gotoMapListingPage(); - await selectFilterTags('my-new-tag'); + await listingTable.waitUntilTableIsLoaded(); + await listingTable.selectFilterTags('my-new-tag'); const itemNames = await listingTable.getAllItemsNames(); expect(itemNames).to.contain('map-with-new-tag'); }); @@ -133,16 +115,19 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { describe('editing', () => { beforeEach(async () => { + // force refresh of maps listing page between tests await PageObjects.common.navigateToUrlWithBrowserHistory('maps', '/'); + await listingTable.waitUntilTableIsLoaded(); }); it('allows to select tags for an existing map', async () => { await listingTable.clickItemLink('map', 'map 4 (tag-1)'); - await PageObjects.maps.saveMap('map 4 (tag-1)', true, true, ['tag-3']); + await PageObjects.maps.saveMap('map 4 (tag-1)', true, false, ['tag-3']); await PageObjects.maps.gotoMapListingPage(); - await selectFilterTags('tag-3'); + await listingTable.waitUntilTableIsLoaded(); + await listingTable.selectFilterTags('tag-3'); const itemNames = await listingTable.getAllItemsNames(); expect(itemNames).to.contain('map 4 (tag-1)'); }); diff --git a/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts b/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts index eeb9a162c24a7..d7160a590185d 100644 --- a/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts +++ b/x-pack/test/saved_object_tagging/functional/tests/visualize_integration.ts @@ -7,7 +7,6 @@ import expect from '@kbn/expect'; import { FtrProviderContext } from '../ftr_provider_context'; -import { TAGFILTER_DROPDOWN_SELECTOR } from './constants'; // eslint-disable-next-line import/no-default-export export default function ({ getPageObjects, getService }: FtrProviderContext) { @@ -15,7 +14,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { const kibanaServer = getService('kibanaServer'); const listingTable = getService('listingTable'); const testSubjects = getService('testSubjects'); - const find = getService('find'); const retry = getService('retry'); const PageObjects = getPageObjects([ 'visualize', @@ -25,26 +23,6 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { 'header', ]); - /** - * Select tags in the searchbar's tag filter. - */ - const selectFilterTags = async (...tagNames: string[]) => { - // open the filter dropdown - const filterButton = await find.byCssSelector(TAGFILTER_DROPDOWN_SELECTOR); - await filterButton.click(); - // select the tags - for (const tagName of tagNames) { - await testSubjects.click( - `tag-searchbar-option-${PageObjects.tagManagement.testSubjFriendly(tagName)}` - ); - } - // click elsewhere to close the filter dropdown - const searchFilter = await find.byCssSelector('.euiPageTemplate .euiFieldSearch'); - await searchFilter.click(); - // wait until the table refreshes - await listingTable.waitUntilTableIsLoaded(); - }; - const selectSavedObjectTags = async (...tagNames: string[]) => { await testSubjects.click('savedObjectTagSelector'); for (const tagName of tagNames) { @@ -120,7 +98,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { }); it('allows to filter by selecting a tag in the filter menu', async () => { - await selectFilterTags('tag-1'); + await listingTable.selectFilterTags('tag-1'); await listingTable.expectItemsCount('visualize', 2); const itemNames = await listingTable.getAllSelectableItemsNames(); @@ -128,7 +106,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { }); it('allows to filter by multiple tags', async () => { - await selectFilterTags('tag-2', 'tag-3'); + await listingTable.selectFilterTags('tag-2', 'tag-3'); await listingTable.expectItemsCount('visualize', 2); const itemNames = await listingTable.getAllSelectableItemsNames(); @@ -153,7 +131,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.visualize.gotoVisualizationLandingPage(); await listingTable.waitUntilTableIsLoaded(); - await selectFilterTags('myextratag'); + await listingTable.selectFilterTags('myextratag'); const itemNames = await listingTable.getAllSelectableItemsNames(); expect(itemNames).to.contain('My new markdown viz'); }); @@ -197,7 +175,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.visualize.gotoVisualizationLandingPage(); await listingTable.waitUntilTableIsLoaded(); - await selectFilterTags('my-new-tag'); + await listingTable.selectFilterTags('my-new-tag'); const itemNames = await listingTable.getAllSelectableItemsNames(); expect(itemNames).to.contain('vis-with-new-tag'); }); @@ -233,7 +211,7 @@ export default function ({ getPageObjects, getService }: FtrProviderContext) { await PageObjects.visualize.gotoVisualizationLandingPage(); await listingTable.waitUntilTableIsLoaded(); - await selectFilterTags('myextratag'); + await listingTable.selectFilterTags('myextratag'); const itemNames = await listingTable.getAllSelectableItemsNames(); expect(itemNames).to.contain('MarkdownViz'); }); diff --git a/x-pack/test/security_api_integration/tests/session_concurrent_limit/cleanup.ts b/x-pack/test/security_api_integration/tests/session_concurrent_limit/cleanup.ts index f882e5197abf9..f2253d5097130 100644 --- a/x-pack/test/security_api_integration/tests/session_concurrent_limit/cleanup.ts +++ b/x-pack/test/security_api_integration/tests/session_concurrent_limit/cleanup.ts @@ -26,6 +26,7 @@ export default function ({ getService }: FtrProviderContext) { const security = getService('security'); const esDeleteAllIndices = getService('esDeleteAllIndices'); const config = getService('config'); + const retry = getService('retry'); const log = getService('log'); const randomness = getService('randomness'); const testUser = { username: 'test_user', password: 'changeme' }; @@ -134,19 +135,19 @@ export default function ({ getService }: FtrProviderContext) { return parseCookie(authenticationResponse.headers['set-cookie'][0])!; } - async function toggleSessionCleanupTask(enabled: boolean) { - await supertest - .post('/session/toggle_cleanup_task') - .set('kbn-xsrf', 'xxx') - .auth(adminTestUser.username, adminTestUser.password) - .send({ enabled }) - .expect(200); + async function runCleanupTaskSoon() { + // In most cases, an error would mean the task is currently running so let's run it again + await retry.tryForTime(30000, async () => { + await supertest + .post('/session/_run_cleanup') + .set('kbn-xsrf', 'xxx') + .auth(adminTestUser.username, adminTestUser.password) + .send() + .expect(200); + }); } - // FLAKY: https://github.com/elastic/kibana/issues/149092 - // FLAKY: https://github.com/elastic/kibana/issues/149091 - // FLAKY: https://github.com/elastic/kibana/issues/149090 - describe.skip('Session Concurrent Limit cleanup', () => { + describe('Session Concurrent Limit cleanup', () => { before(async () => { await security.user.create('anonymous_user', { password: 'changeme', @@ -161,7 +162,6 @@ export default function ({ getService }: FtrProviderContext) { beforeEach(async function () { this.timeout(120000); - await toggleSessionCleanupTask(false); await es.cluster.health({ index: '.kibana_security_session*', wait_for_status: 'green' }); await esDeleteAllIndices('.kibana_security_session*'); }); @@ -179,13 +179,13 @@ export default function ({ getService }: FtrProviderContext) { expect(await getNumberOfSessionDocuments()).to.be(3); - // Let's wait for 60s to make sure cleanup routine runs after it was enabled. + // Poke the background task to run + await runCleanupTaskSoon(); log.debug('Waiting for cleanup job to run...'); - await toggleSessionCleanupTask(true); - await setTimeoutAsync(60000); - - // The oldest session should have been removed, but the rest should still be valid. - expect(await getNumberOfSessionDocuments()).to.be(2); + await retry.tryForTime(30000, async () => { + // The oldest session should have been removed, but the rest should still be valid. + expect(await getNumberOfSessionDocuments()).to.be(2); + }); await checkSessionCookieInvalid(basicSessionCookieOne); await checkSessionCookie(basicSessionCookieTwo, testUser.username, basicProvider); @@ -208,13 +208,13 @@ export default function ({ getService }: FtrProviderContext) { expect(await getNumberOfSessionDocuments()).to.be(6); - // Let's wait for 60s to make sure cleanup routine runs after it was enabled. + // Poke the background task to run + await runCleanupTaskSoon(); log.debug('Waiting for cleanup job to run...'); - await toggleSessionCleanupTask(true); - await setTimeoutAsync(60000); - - // The oldest session should have been removed, but the rest should still be valid. - expect(await getNumberOfSessionDocuments()).to.be(4); + await retry.tryForTime(30000, async () => { + // The oldest session should have been removed, but the rest should still be valid. + expect(await getNumberOfSessionDocuments()).to.be(4); + }); await checkSessionCookieInvalid(basicSessionCookieOne); await checkSessionCookie(basicSessionCookieTwo, testUser.username, basicProvider); @@ -275,13 +275,13 @@ export default function ({ getService }: FtrProviderContext) { refresh: true, }); - // Let's wait for 60s to make sure cleanup routine runs after it was enabled. + // Poke the background task to run + await runCleanupTaskSoon(); log.debug('Waiting for cleanup job to run...'); - await toggleSessionCleanupTask(true); - await setTimeoutAsync(60000); - - // The oldest session should have been removed, but the rest should still be valid. - expect(await getNumberOfSessionDocuments()).to.be(4); + await retry.tryForTime(30000, async () => { + // The oldest session should have been removed, but the rest should still be valid. + expect(await getNumberOfSessionDocuments()).to.be(4); + }); await checkSessionCookie(basicSessionCookieOne, testUser.username, basicProvider); await checkSessionCookie(basicSessionCookieTwo, testUser.username, basicProvider); @@ -303,13 +303,13 @@ export default function ({ getService }: FtrProviderContext) { expect(await getNumberOfSessionDocuments()).to.be(2); - // Let's wait for 60s to make sure cleanup routine runs after it was enabled. + // Poke the background task to run + await runCleanupTaskSoon(); log.debug('Waiting for cleanup job to run...'); - await toggleSessionCleanupTask(true); - await setTimeoutAsync(60000); - - // The oldest session should have been removed, but the rest should still be valid. - expect(await getNumberOfSessionDocuments()).to.be(2); + await retry.tryForTime(30000, async () => { + // The oldest session should have been removed, but the rest should still be valid. + expect(await getNumberOfSessionDocuments()).to.be(2); + }); await checkSessionCookie(basicSessionCookieOne, testUser.username, basicProvider); await checkSessionCookie(basicSessionCookieTwo, testUser.username, basicProvider); @@ -326,13 +326,13 @@ export default function ({ getService }: FtrProviderContext) { expect(await getNumberOfSessionDocuments()).to.be(3); - // Let's wait for 60s to make sure cleanup routine runs after it was enabled. + // Poke the background task to run + await runCleanupTaskSoon(); log.debug('Waiting for cleanup job to run...'); - await toggleSessionCleanupTask(true); - await setTimeoutAsync(60000); - - // The oldest session should have been removed, but the rest should still be valid. - expect(await getNumberOfSessionDocuments()).to.be(3); + await retry.tryForTime(30000, async () => { + // The oldest session should have been removed, but the rest should still be valid. + expect(await getNumberOfSessionDocuments()).to.be(3); + }); // All sessions should be active. for (const anonymousSessionCookie of [ @@ -355,13 +355,13 @@ export default function ({ getService }: FtrProviderContext) { expect(await getNumberOfSessionDocuments()).to.be(3); - // Let's wait for 60s to make sure cleanup routine runs after it was enabled. + // Poke the background task to run + await runCleanupTaskSoon(); log.debug('Waiting for cleanup job to run...'); - await toggleSessionCleanupTask(true); - await setTimeoutAsync(60000); - - // The oldest session should have been removed, but the rest should still be valid. - expect(await getNumberOfSessionDocuments()).to.be(3); + await retry.tryForTime(30000, async () => { + // The oldest session should have been removed, but the rest should still be valid. + expect(await getNumberOfSessionDocuments()).to.be(3); + }); // Finish SAML handshake (all should succeed since we don't enforce limit at session creation time). const samlSessionCookieOne = await finishSAMLHandshake( diff --git a/x-pack/test/security_functional/plugins/test_endpoints/server/init_routes.ts b/x-pack/test/security_functional/plugins/test_endpoints/server/init_routes.ts index 9ffcb635f041e..e77ebd8ea5af1 100644 --- a/x-pack/test/security_functional/plugins/test_endpoints/server/init_routes.ts +++ b/x-pack/test/security_functional/plugins/test_endpoints/server/init_routes.ts @@ -177,6 +177,18 @@ export function initRoutes( } } + router.post( + { + path: '/session/_run_cleanup', + validate: false, + }, + async (context, request, response) => { + const [, { taskManager }] = await core.getStartServices(); + await taskManager.runSoon(SESSION_INDEX_CLEANUP_TASK_NAME); + return response.ok(); + } + ); + router.post( { path: '/session/toggle_cleanup_task', diff --git a/x-pack/test/spaces_api_integration/common/suites/copy_to_space.ts b/x-pack/test/spaces_api_integration/common/suites/copy_to_space.ts index 4c5ae878bbf6e..5c519c8ae5b67 100644 --- a/x-pack/test/spaces_api_integration/common/suites/copy_to_space.ts +++ b/x-pack/test/spaces_api_integration/common/suites/copy_to_space.ts @@ -770,7 +770,8 @@ export function copyToSpaceTestSuiteFactory(context: FtrProviderContext) { await testDataLoader.deleteFtrSpaces(); }); - describe('single-namespace types', () => { + // FLAKY: https://github.com/elastic/kibana/issues/86545 + describe.skip('single-namespace types', () => { beforeEach(async () => { await testDataLoader.createFtrSavedObjectsData(SPACE_DATA_TO_LOAD); }); diff --git a/yarn.lock b/yarn.lock index a904689da8da9..eacc6c1c31d2b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6535,7 +6535,7 @@ resolved "https://registry.yarnpkg.com/@types/async/-/async-3.2.15.tgz#26d4768fdda0e466f18d6c9918ca28cc89a4e1fe" integrity sha512-PAmPfzvFA31mRoqZyTVsgJMsvbynR429UTTxhmfsUCrWGh3/fxOrzqBtaTPJsn4UtzTv4Vb0+/O7CARWb69N4g== -"@types/babel__core@*", "@types/babel__core@^7.1.14", "@types/babel__core@^7.1.20": +"@types/babel__core@*", "@types/babel__core@^7.1.14": version "7.1.20" resolved "https://registry.yarnpkg.com/@types/babel__core/-/babel__core-7.1.20.tgz#e168cdd612c92a2d335029ed62ac94c95b362359" integrity sha512-PVb6Bg2QuscZ30FvOU7z4guG6c926D9YRvOxEaelzndpMsvP+YM74Q/dAFASpg2l6+XLalxSGxcq/lrgYWZtyQ== @@ -6546,6 +6546,17 @@ "@types/babel__template" "*" "@types/babel__traverse" "*" +"@types/babel__core@^7.20.0": + version "7.20.0" + resolved "https://registry.yarnpkg.com/@types/babel__core/-/babel__core-7.20.0.tgz#61bc5a4cae505ce98e1e36c5445e4bee060d8891" + integrity sha512-+n8dL/9GWblDO0iU6eZAwEIJVr5DWigtle+Q6HLOrh/pdbXOhOtqzq8VPPE2zvNJzSKY4vH/z3iT3tn0A3ypiQ== + dependencies: + "@babel/parser" "^7.20.7" + "@babel/types" "^7.20.7" + "@types/babel__generator" "*" + "@types/babel__template" "*" + "@types/babel__traverse" "*" + "@types/babel__generator@*": version "7.0.2" resolved "https://registry.yarnpkg.com/@types/babel__generator/-/babel__generator-7.0.2.tgz#d2112a6b21fad600d7674274293c85dce0cb47fc" @@ -7424,10 +7435,10 @@ dependencies: "@types/node" "*" -"@types/node@*", "@types/node@18.11.18", "@types/node@>= 8", "@types/node@>=12.12.47", "@types/node@>=13.7.0", "@types/node@>=8.9.0", "@types/node@^10.1.0", "@types/node@^14.0.10 || ^16.0.0", "@types/node@^14.14.20 || ^16.0.0", "@types/node@^14.14.31": - version "18.11.18" - resolved "https://registry.yarnpkg.com/@types/node/-/node-18.11.18.tgz#8dfb97f0da23c2293e554c5a50d61ef134d7697f" - integrity sha512-DHQpWGjyQKSHj3ebjFI/wRKcqQcdR+MoFBygntYOZytCqNfkd2ZC4ARDJ2DQqhjH5p85Nnd3jhUJIXrszFX/JA== +"@types/node@*", "@types/node@16.11.68", "@types/node@>= 8", "@types/node@>=12.12.47", "@types/node@>=13.7.0", "@types/node@>=8.9.0", "@types/node@^10.1.0", "@types/node@^14.0.10 || ^16.0.0", "@types/node@^14.14.20 || ^16.0.0", "@types/node@^14.14.31": + version "16.11.68" + resolved "https://registry.yarnpkg.com/@types/node/-/node-16.11.68.tgz#30ee923f4d940793e0380f5ce61c0bd4b7196b6c" + integrity sha512-JkRpuVz3xCNCWaeQ5EHLR/6woMbHZz/jZ7Kmc63AkU+1HxnoUugzSWMck7dsR4DvNYX8jp9wTi9K7WvnxOIQZQ== "@types/nodemailer@^6.4.0": version "6.4.0" @@ -8630,7 +8641,7 @@ abab@^2.0.3, abab@^2.0.4, abab@^2.0.5, abab@^2.0.6: resolved "https://registry.yarnpkg.com/abab/-/abab-2.0.6.tgz#41b80f2c871d19686216b82309231cfd3cb3d291" integrity sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA== -abbrev@1, abbrev@^1.0.0: +abbrev@1: version "1.1.1" resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-1.1.1.tgz#f8f2c887ad10bf67f634f005b6987fed3179aac8" integrity sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q== @@ -11328,10 +11339,10 @@ core-js@^2.4.0, core-js@^2.5.0, core-js@^2.6.9: resolved "https://registry.yarnpkg.com/core-js/-/core-js-2.6.9.tgz#6b4b214620c834152e179323727fc19741b084f2" integrity sha512-HOpZf6eXmnl7la+cUdMnLvUxKNqLUzJvgIziQ0DiF3JwSImNphIqdGqzj6hIKyX04MmV0poclQ7+wjWvxQyR2A== -core-js@^3.0.4, core-js@^3.27.1, core-js@^3.6.5, core-js@^3.8.2, core-js@^3.8.3: - version "3.27.1" - resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.27.1.tgz#23cc909b315a6bb4e418bf40a52758af2103ba46" - integrity sha512-GutwJLBChfGCpwwhbYoqfv03LAfmiz7e7D/BNxzeMxwQf10GRSzqiOjx7AmtEk+heiD/JWmBuyBPgFtx0Sg1ww== +core-js@^3.0.4, core-js@^3.27.2, core-js@^3.6.5, core-js@^3.8.2, core-js@^3.8.3: + version "3.27.2" + resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.27.2.tgz#85b35453a424abdcacb97474797815f4d62ebbf7" + integrity sha512-9ashVQskuh5AZEZ1JdQWp1GqSoC1e1G87MzRqg2gIfVAQ7Qn9K+uFj8EcniUFA4P2NLZfV+TOlX1SzoKfo+s7w== core-util-is@1.0.2, core-util-is@^1.0.2, core-util-is@~1.0.0: version "1.0.2" @@ -13050,10 +13061,10 @@ ejs@^3.1.8: dependencies: jake "^10.8.5" -elastic-apm-http-client@11.0.4, elastic-apm-http-client@^11.0.1: - version "11.0.4" - resolved "https://registry.yarnpkg.com/elastic-apm-http-client/-/elastic-apm-http-client-11.0.4.tgz#3e44e56fa42235b1b16a33c6a7656cfde595f9ff" - integrity sha512-449Qj/STi9hgnIk2KQ7719E7lpM3/i4Afs7NUhSOX8wV3sxn/+ItIHx9kKJthzhDDezxIfQcH83v83AF67GspQ== +elastic-apm-http-client@11.2.0, elastic-apm-http-client@^11.0.1: + version "11.2.0" + resolved "https://registry.yarnpkg.com/elastic-apm-http-client/-/elastic-apm-http-client-11.2.0.tgz#4da8b975ca326c1e5beb59746ab1124c4feddad3" + integrity sha512-XHXK+gQmd34eRN/ffrml7AN4h1VwujB79WEO2C/J59ufvEk+mT1OGBhl6pntHPUWn4Um52C5m84O6jIXzaQwfw== dependencies: agentkeepalive "^4.2.1" breadth-filter "^2.0.0" @@ -13065,10 +13076,10 @@ elastic-apm-http-client@11.0.4, elastic-apm-http-client@^11.0.1: semver "^6.3.0" stream-chopper "^3.0.1" -elastic-apm-node@^3.38.0, elastic-apm-node@^3.41.1: - version "3.41.1" - resolved "https://registry.yarnpkg.com/elastic-apm-node/-/elastic-apm-node-3.41.1.tgz#e0829d69d5e8a6062ef567d0a8db0ec0e3736ea8" - integrity sha512-bLCVIyAgQC+ZfY5fd/UaAId+8dh3vusaxZF2A0YtHBAwx1YGpIA3dqOt5zc1UuYmbjCdsEAiUjaUEAHOWdjTzA== +elastic-apm-node@^3.38.0, elastic-apm-node@^3.42.0: + version "3.42.0" + resolved "https://registry.yarnpkg.com/elastic-apm-node/-/elastic-apm-node-3.42.0.tgz#22c11e98708a0df7a7de8c8fb195929b4fc90c00" + integrity sha512-Q9sugfpaw6jQ8xDeP09LlyF0MwE5k0hphQmUiap+qQKE2jrLvY00zk4WierDQ2GF/AguE6BtRZmXpUELDbHFyA== dependencies: "@elastic/ecs-pino-format" "^1.2.0" "@opentelemetry/api" "^1.1.0" @@ -13078,7 +13089,8 @@ elastic-apm-node@^3.38.0, elastic-apm-node@^3.41.1: basic-auth "^2.0.1" cookie "^0.5.0" core-util-is "^1.0.2" - elastic-apm-http-client "11.0.4" + debug "^4.1.1" + elastic-apm-http-client "11.2.0" end-of-stream "^1.4.4" error-callsites "^2.0.4" error-stack-parser "^2.0.6" @@ -13088,13 +13100,14 @@ elastic-apm-node@^3.38.0, elastic-apm-node@^3.41.1: is-native "^1.0.1" lru-cache "^6.0.0" measured-reporting "^1.51.1" + module-details-from-path "^1.0.3" monitor-event-loop-delay "^1.0.0" object-filter-sequence "^1.0.0" object-identity-map "^1.0.2" original-url "^1.2.3" pino "^6.11.2" relative-microtime "^2.0.0" - require-in-the-middle "^5.2.0" + resolve "^1.22.1" semver "^6.3.0" set-cookie-serde "^1.0.0" shallow-clone-shim "^2.0.0" @@ -16481,7 +16494,7 @@ inquirer@^8.2.3: through "^2.3.6" wrap-ansi "^7.0.0" -install-artifact-from-github@^1.3.1: +install-artifact-from-github@^1.3.0: version "1.3.1" resolved "https://registry.yarnpkg.com/install-artifact-from-github/-/install-artifact-from-github-1.3.1.tgz#eefaad9af35d632e5d912ad1569c1de38c3c2462" integrity sha512-3l3Bymg2eKDsN5wQuMfgGEj2x6l5MCAv0zPL6rxHESufFVlEAKW/6oY9F1aGgvY/EgWm5+eWGRjINveL4X7Hgg== @@ -19214,7 +19227,7 @@ make-error@^1.1.1: resolved "https://registry.yarnpkg.com/make-error/-/make-error-1.3.6.tgz#2eb2e37ea9b67c4891f684a1394799af484cf7a2" integrity sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw== -make-fetch-happen@^10.0.3, make-fetch-happen@^10.0.4: +make-fetch-happen@^10.0.4: version "10.2.1" resolved "https://registry.yarnpkg.com/make-fetch-happen/-/make-fetch-happen-10.2.1.tgz#f5e3835c5e9817b617f2770870d9492d28678164" integrity sha512-NgOPbRiaQM10DYXvN3/hhGVI2M5MtITFryzBGxHM5p4wnFxsVCbxkrBrDsk+EZ5OB4jEOT7AjDxtdF+KVEFT7w== @@ -20239,7 +20252,7 @@ mute-stream@0.0.8: resolved "https://registry.yarnpkg.com/mute-stream/-/mute-stream-0.0.8.tgz#1630c42b2251ff81e2a283de96a5497ea92e5e0d" integrity sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA== -nan@^2.16.0, nan@^2.17.0: +nan@^2.15.0, nan@^2.17.0: version "2.17.0" resolved "https://registry.yarnpkg.com/nan/-/nan-2.17.0.tgz#c0150a2368a182f033e9aa5195ec76ea41a199cb" integrity sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ== @@ -20503,22 +20516,6 @@ node-gyp@^8.4.1: tar "^6.1.2" which "^2.0.2" -node-gyp@^9.0.0: - version "9.3.0" - resolved "https://registry.yarnpkg.com/node-gyp/-/node-gyp-9.3.0.tgz#f8eefe77f0ad8edb3b3b898409b53e697642b319" - integrity sha512-A6rJWfXFz7TQNjpldJ915WFb1LnhO4lIve3ANPbWreuEoLoKlFT3sxIepPBkLhM27crW8YmN+pjlgbasH6cH/Q== - dependencies: - env-paths "^2.2.0" - glob "^7.1.4" - graceful-fs "^4.2.6" - make-fetch-happen "^10.0.3" - nopt "^6.0.0" - npmlog "^6.0.0" - rimraf "^3.0.2" - semver "^7.3.5" - tar "^6.1.2" - which "^2.0.2" - node-int64@^0.4.0: version "0.4.0" resolved "https://registry.yarnpkg.com/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b" @@ -20620,13 +20617,6 @@ nopt@^5.0.0: dependencies: abbrev "1" -nopt@^6.0.0: - version "6.0.0" - resolved "https://registry.yarnpkg.com/nopt/-/nopt-6.0.0.tgz#245801d8ebf409c6df22ab9d95b65e1309cdb16d" - integrity sha512-ZwLpbTgdhuZUnZzjd7nb1ZV+4DoiC6/sfiVKok72ym/4Tlf+DFdlHYmT2JPmcNNWV6Pi3SDf1kT+A4r9RTuT9g== - dependencies: - abbrev "^1.0.0" - normalize-package-data@^2.0.0, normalize-package-data@^2.3.2, normalize-package-data@^2.3.4, normalize-package-data@^2.5.0: version "2.5.0" resolved "https://registry.yarnpkg.com/normalize-package-data/-/normalize-package-data-2.5.0.tgz#e66db1838b200c1dfc233225d12cb36520e234a8" @@ -22780,14 +22770,14 @@ re-resizable@^6.1.1: dependencies: fast-memoize "^2.5.1" -re2@1.17.7: - version "1.17.7" - resolved "https://registry.yarnpkg.com/re2/-/re2-1.17.7.tgz#e14cab85a177a5534c7215c322d1b043c55aa1e9" - integrity sha512-X8GSuiBoVWwcjuppqSjsIkRxNUKDdjhkO9SBekQbZ2ksqWUReCy7DQPWOVpoTnpdtdz5PIpTTxTFzvJv5UMfjA== +re2@1.17.4: + version "1.17.4" + resolved "https://registry.yarnpkg.com/re2/-/re2-1.17.4.tgz#7bf29290bdde963014e77bd2c2e799a6d788386e" + integrity sha512-xyZ4h5PqE8I9tAxTh3G0UttcK5ufrcUxReFjGzfX61vtanNbS1XZHjnwRSyPcLgChI4KLxVgOT/ioZXnUAdoTA== dependencies: - install-artifact-from-github "^1.3.1" - nan "^2.16.0" - node-gyp "^9.0.0" + install-artifact-from-github "^1.3.0" + nan "^2.15.0" + node-gyp "^8.4.1" react-ace@^7.0.5: version "7.0.5" @@ -24017,15 +24007,6 @@ require-from-string@^2.0.2: resolved "https://registry.yarnpkg.com/require-from-string/-/require-from-string-2.0.2.tgz#89a7fdd938261267318eafe14f9c32e598c36909" integrity sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw== -require-in-the-middle@^5.2.0: - version "5.2.0" - resolved "https://registry.yarnpkg.com/require-in-the-middle/-/require-in-the-middle-5.2.0.tgz#4b71e3cc7f59977100af9beb76bf2d056a5a6de2" - integrity sha512-efCx3b+0Z69/LGJmm9Yvi4cqEdxnoGnxYxGxBghkkTTFeXRtTCmmhO0AnAfHz59k957uTSuy8WaHqOs8wbYUWg== - dependencies: - debug "^4.1.1" - module-details-from-path "^1.0.3" - resolve "^1.22.1" - require-in-the-middle@^6.0.0: version "6.0.0" resolved "https://registry.yarnpkg.com/require-in-the-middle/-/require-in-the-middle-6.0.0.tgz#01cc6416286fb5e672d0fe031d996f8bc202509d" @@ -26617,12 +26598,7 @@ tslib@^1.10.0, tslib@^1.8.1, tslib@^1.9.0, tslib@^1.9.3: resolved "https://registry.yarnpkg.com/tslib/-/tslib-1.13.0.tgz#c881e13cc7015894ed914862d276436fa9a47043" integrity sha512-i/6DQjL8Xf3be4K/E6Wgpekn5Qasl1usyw++dAA35Ue5orEn65VIxOA+YvNNl9HV3qv70T7CNwjODHZrLwvd1Q== -tslib@^2.0.0, tslib@^2.0.1, tslib@^2.0.3, tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.1, tslib@~2.4.0: - version "2.4.0" - resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.4.0.tgz#7cecaa7f073ce680a05847aa77be941098f36dc3" - integrity sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ== - -tslib@^2.4.0: +tslib@^2.0.0, tslib@^2.0.1, tslib@^2.0.3, tslib@^2.1.0, tslib@^2.2.0, tslib@^2.3.1, tslib@^2.4.0, tslib@~2.4.0: version "2.4.1" resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.4.1.tgz#0d0bfbaac2880b91e22df0768e55be9753a5b17e" integrity sha512-tGyy4dAjRIEwI7BzsB0lynWgOpfqjUdq91XXAlIWD2OwKBH7oCl/GZG/HT4BOHrTlPMOASlMQ7veyTqpmRcrNA== @@ -26797,14 +26773,7 @@ unc-path-regex@^0.1.2: resolved "https://registry.yarnpkg.com/unc-path-regex/-/unc-path-regex-0.1.2.tgz#e73dd3d7b0d7c5ed86fbac6b0ae7d8c6a69d50fa" integrity sha1-5z3T17DXxe2G+6xrCufYxqadUPo= -undici@^5.11.0: - version "5.11.0" - resolved "https://registry.yarnpkg.com/undici/-/undici-5.11.0.tgz#1db25f285821828fc09d3804b9e2e934ae86fc13" - integrity sha512-oWjWJHzFet0Ow4YZBkyiJwiK5vWqEYoH7BINzJAJOLedZ++JpAlCbUktW2GQ2DS2FpKmxD/JMtWUUWl1BtghGw== - dependencies: - busboy "^1.6.0" - -undici@^5.5.1: +undici@^5.11.0, undici@^5.5.1: version "5.14.0" resolved "https://registry.yarnpkg.com/undici/-/undici-5.14.0.tgz#1169d0cdee06a4ffdd30810f6228d57998884d00" integrity sha512-yJlHYw6yXPPsuOH0x2Ib1Km61vu4hLiRRQoafs+WUgX1vO64vgnxiCEN9dpIrhZyHFsai3F0AEj4P9zy19enEQ==